hxxps://gofile[.]io/d/6ODbxJ

Analysis

geolocation tags

eueuropefrfrance
user interaction
yes
max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 17:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gofile.io/d/6ODbxJ
Sample260804-v3m23awdkc

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
19	752	chrome.exe

Executes dropped EXE 2 IoCs

pid	Process
3884	TC External UPDATED.exe
2184	TC External UPDATED (1).exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
4	api.gofile.io
8	api.gofile.io

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
752	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303382910550678"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4520	chrome.exe
4520	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe

Suspicious use of FindShellTrayWindow 53 IoCs

pid	Process
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4520 wrote to memory of 4932	4520	chrome.exe	89
PID 4520 wrote to memory of 752	4520	chrome.exe	91
PID 4520 wrote to memory of 2472	4520	chrome.exe	94
PID 4520 wrote to memory of 2472	4520	chrome.exe	94
PID 4520 wrote to memory of 4796	4520	chrome.exe	93
PID 4520 wrote to memory of 4796	4520	chrome.exe	93
PID 4520 wrote to memory of 5360	4520	chrome.exe	95
PID 4520 wrote to memory of 5360	4520	chrome.exe	95
PID 4520 wrote to memory of 2284	4520	chrome.exe	96
PID 4520 wrote to memory of 2284	4520	chrome.exe	96
PID 4520 wrote to memory of 3972	4520	chrome.exe	97
PID 4520 wrote to memory of 3972	4520	chrome.exe	97
PID 4520 wrote to memory of 3340	4520	chrome.exe	98
PID 4520 wrote to memory of 3340	4520	chrome.exe	98
PID 4520 wrote to memory of 2596	4520	chrome.exe	99
PID 4520 wrote to memory of 2596	4520	chrome.exe	99
PID 4520 wrote to memory of 4852	4520	chrome.exe	100
PID 4520 wrote to memory of 4684	4520	chrome.exe	101
PID 4520 wrote to memory of 4684	4520	chrome.exe	101
PID 4520 wrote to memory of 1508	4520	chrome.exe	102
PID 4520 wrote to memory of 1508	4520	chrome.exe	102
PID 4520 wrote to memory of 1944	4520	chrome.exe	105
PID 4520 wrote to memory of 5068	4520	chrome.exe	106
PID 4520 wrote to memory of 5068	4520	chrome.exe	106
PID 4520 wrote to memory of 5408	4520	chrome.exe	107
PID 4520 wrote to memory of 5408	4520	chrome.exe	107
PID 4520 wrote to memory of 6080	4520	chrome.exe	108
PID 4520 wrote to memory of 6080	4520	chrome.exe	108
PID 4520 wrote to memory of 2324	4520	chrome.exe	109
PID 4520 wrote to memory of 2096	4520	chrome.exe	110
PID 4520 wrote to memory of 2096	4520	chrome.exe	110
PID 4520 wrote to memory of 2324	4520	chrome.exe	109
PID 4520 wrote to memory of 3884	4520	chrome.exe	111
PID 4520 wrote to memory of 5376	4520	chrome.exe	112
PID 4520 wrote to memory of 5376	4520	chrome.exe	112
PID 4520 wrote to memory of 4304	4520	chrome.exe	113
PID 4520 wrote to memory of 4304	4520	chrome.exe	113
PID 4520 wrote to memory of 6060	4520	chrome.exe	114
PID 4520 wrote to memory of 2184	4520	chrome.exe	115
PID 4520 wrote to memory of 3232	4520	chrome.exe	117
PID 4520 wrote to memory of 4948	4520	chrome.exe	118
PID 4520 wrote to memory of 4688	4520	chrome.exe	119

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/6ODbxJ
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffc7d09c728,0x7ffc7d09c734,0x7ffc7d09c740
  2⤵
  PID:4932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1464,i,3051935918400442871,1426951776580401938,524288 --field-trial-handle=1892,i,5279679961634414299,15690930533547019914,262144 --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1592,i,11097967051647106493,3527112238426706855,262144 --field-trial-handle=1892,i,5279679961634414299,15690930533547019914,262144 --variations-seed-version --mojo-platform-channel-handle=1888 /prefetch:2
  2⤵
  PID:4796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2180,i,3031024878746457218,7248054607544363228,524288 --field-trial-handle=1892,i,5279679961634414299,15690930533547019914,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:13
  2⤵
  PID:2472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3220,i,13007343333984263031,12987168339392275336,2097152 --field-trial-handle=1892,i,5279679961634414299,15690930533547019914,262144 --variations-seed-version --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:5360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3232,i,16718431240607204009,6302878272343232848,2097152 --field-trial-handle=1892,i,5279679961634414299,15690930533547019914,262144 --variations-seed-version --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4692,i,3754871512559281460,1294004280767456953,2097152 --field-trial-handle=1892,i,5279679961634414299,15690930533547019914,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:3972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3504,i,9973473550665566533,2267657113808976899,2097152 --field-trial-handle=1892,i,5279679961634414299,15690930533547019914,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:1
  2⤵
  PID:3340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3272,i,8508722806562053631,5915688572145649208,2097152 --field-trial-handle=1892,i,5279679961634414299,15690930533547019914,262144 --variations-seed-version --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:2596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5932,i,13586684713413095672,16125294613863440155,524288 --field-trial-handle=1892,i,5279679961634414299,15690930533547019914,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:14
  2⤵
  PID:4852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3432,i,17440699315751789566,16006840002377496838,2097152 --field-trial-handle=1892,i,5279679961634414299,15690930533547019914,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3496,i,10149878665785255670,8378838881343322158,2097152 --field-trial-handle=1892,i,5279679961634414299,15690930533547019914,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:1508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6012,i,17510879314812291135,5713106388560715117,524288 --field-trial-handle=1892,i,5279679961634414299,15690930533547019914,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:14
  2⤵
  PID:1944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6264,i,2147076530023011994,18380255024982417317,2097152 --field-trial-handle=1892,i,5279679961634414299,15690930533547019914,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3484,i,2624774413245255102,12960555650535674718,2097152 --field-trial-handle=1892,i,5279679961634414299,15690930533547019914,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:5408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3468,i,3039178553427788618,7667445271236001385,2097152 --field-trial-handle=1892,i,5279679961634414299,15690930533547019914,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:1
  2⤵
  PID:6080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6544,i,4536716782456565928,9962820174911639632,2097152 --field-trial-handle=1892,i,5279679961634414299,15690930533547019914,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:2324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6620,i,8095446651200016481,7546683044400708707,2097152 --field-trial-handle=1892,i,5279679961634414299,15690930533547019914,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:2096
- C:\Users\Admin\Downloads\TC External UPDATED.exe
  "C:\Users\Admin\Downloads\TC External UPDATED.exe"
  2⤵
  - Executes dropped EXE
  PID:3884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=3452,i,7797569135991767894,3830447578366117545,2097152 --field-trial-handle=1892,i,5279679961634414299,15690930533547019914,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:5376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6440,i,3893496214275259367,16314077400906949499,2097152 --field-trial-handle=1892,i,5279679961634414299,15690930533547019914,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5996,i,11626088590772026245,14990809619464512574,524288 --field-trial-handle=1892,i,5279679961634414299,15690930533547019914,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:14
  2⤵
  PID:6060
- C:\Users\Admin\Downloads\TC External UPDATED (1).exe
  "C:\Users\Admin\Downloads\TC External UPDATED (1).exe"
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=256,i,3297971328187720584,1151555915970460507,524288 --field-trial-handle=1892,i,5279679961634414299,15690930533547019914,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:14
  2⤵
  PID:3232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6136,i,783691342585708083,15825016277087034874,524288 --field-trial-handle=1892,i,5279679961634414299,15690930533547019914,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:14
  2⤵
  PID:4948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4852,i,10237032004822465502,5827371859288985244,524288 --field-trial-handle=1892,i,5279679961634414299,15690930533547019914,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:14
  2⤵
  PID:4688

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4832

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 720B
SHA256 a52b7aee2912421f44ad614cef4de429483a62f498c6432b8fa767c79239b1ba
MD5 6d288b07c38973977d8d75aaa6e16334
SHA1 69c12356592aed740ae9bb54201a8b5ada793272
SHA512 e870401622aad358ad4b2334306fb29b1ba314d10a55f3b45514883680baf376eb682b1fa200cea55131ae99ab7ed32c1c2d98de80b3981c60588a03a75aebc0
TLSH
T1B0012B953CE59269E7516F34D6C5B26031F6576034530EF7618241F4B7193847507F6C
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 f1a545c5022cc90f2a0e3393094b702311c6eef0884c2f260536faf7b27504f2
MD5 a5ba785fff1477948bb7bb0af96a4f3c
SHA1 7c2eeb95dd2c41528f18767e36ce8e05e083347e
SHA512 cbe4e14d3ac5804d0b8b081a46c7a1a2ace82fd6764584f4d3967c705fa9221becd6edc9848f0e9f69bec48a01cadcfe8488f5d328ccbb0901012339e27f9138
SSDEEP 3:MsEllllkEthXllkl2zEklBW1C:/M/xT02zn
TLSH
T14C44044C7FC0140DC55010304431D35403F0D5311535775334510713FCC55400C00C00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 e32761db0d74b0f99b84c66c1d3cf0dd327a28b9fbde83000a9416468a669c67
MD5 188ad6ed9f50b7aefd73152c5b9cf16e
SHA1 bfed88921e4b9cfa9bc051e6360ff47371380002
SHA512 c92f3682f787117062cdcb648c885b46317e7582c80257a41c2017ad165a44e530e95f401f375b541a34ec1bedaac9d7c341e0f1dbc4fc0c474586f10058b6db
TLSH
T19E71ACF7C3E8957D892152F8AB156F1BCD590914432C3D66C9E4AE1BA3E2871E20464F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 d76e10d727d385c4ceed726277dcac745926f898e88c0e86a5d259322ed019c5
MD5 1a3c5b27caa4435c21c33ff4f2166d66
SHA1 773200f7ee59e84044b0784f2905267d3398f8eb
SHA512 2220af6a8502b6e3b724d01f4360f3c9980efb6211ec49a4dfa4075432f2aa5818da6afbaa34fe0303eaec500c60e505477c80ea6019ddc1636eb5537883fa0b
TLSH
T194216A9BAB7F745B127C587E1D49B8877CB9A432019124F0EF5682BCB0859EF1B02423
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 8340216c7d815f466d6104f4c07fabb216cfb22ad472fc76fc03ef2c750057f4
MD5 ce00b0b7547f86afd778703986d18b11
SHA1 abb169ee2b8fe68e6a750f58dbaaac104047ea62
SHA512 8f52cedf5a1d347cab2734a7d9c1b7bb74df3baf20c2a70d933f29f31ee2a9bb007281c64922a7e4221848c8754ae9e640547a1bbcb39acb2537057469f335d0
SSDEEP 192:7RlhlfP6v7KvAPRp22lz9NLHsb+WNnL7QPD29022njKnskwIRbVyIsnAUgR:7RlhlnWu6Xf3w/E2622nmsYR
TLSH
T13F32962EB915293B6ECAC71AF9617793DBF9102121902EC4E7FC992C15E76DC3227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 cb38638894a738619f3e9200619e140eac29c8e90357b6e8dafd54976d6b0b45
MD5 64dd70e8eafae9b0eeca625cff1ec971
SHA1 04c93875e5e505e03aaa373bcc5a158962d7aa29
SHA512 dd2dd4c223c0ccdef5358a072cf3436837b93a103df42bfc8df0d1a3928c461a5ff4a6b9f68fd3996d449216a5600c4dfb2b2afb3956abc43d4b97a9d37530e0
SSDEEP 192:7RlhgfP6v7KvAPRp22lz9NLHsb+WNnL7QPIAEYF022njKnskwIRbVyIsnAUge:7RlhgnWu6Xf3w/gE522nmsYe
TLSH
T13A32952EBD11793B6ECAC61AF9657793DBF9102121902EC4E6FC992C15E76CC3227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 671ef27e60254e76bc74b8a59daff4fd387e5df13faaa6fdaccff9cb579baa91
MD5 258bb719888282be9d511059f6651856
SHA1 a35449b5ab811d1a12da4f8a075acb120ae4024c
SHA512 1493f0e7316ce2faaa3a596b590a801b01d2a5e04d46a379cbd82ef5ca5dea941969b40e59b8c4c272ce661d35bc546ad256b2a6113069ce2ad7d6e8e560bbc9
SSDEEP 192:ecP4K63X7KxkXqK4I40pUZNCgVLHrKHfFKslE1rxXzKD/6h+ErUkKN9Yr0XAn57C:ZPjwX7KxkXqKf/pUZNCgVLH2Hfgsl8xG
TLSH
T1AF32F927A48D5A7F0FD8E50DDC126F4B6DB5029377681D2492FB9D0803A87CE214A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 ddd2484a3eff7899ce12dd1e89882bb7e4d9fd6cd208ad4ae030ade3ef6ff955
MD5 204fea800f9462dbe4a747836c06ba58
SHA1 4c80ef102d85f77af52aebdc340a9a3a2b82694e
SHA512 f96c30a1e04e349917f1673ee221381b367d8172824cbee89bc8595aec341027e33c6e6b048ecc4996b46d24f6efda76f12e105d36da6423dffd83b624462f0a
SSDEEP 96:BC0d+hDK+UyKovbfaNQYYeteRDotok5uqD9DB6WGyvUU+esbL/Mmv4a:BC0qDHUgvIdaDUD/bCI+esbL/N
TLSH
T1B3A10A32B46D5D776A76D549F96A2E43CEB46027EA31BE84D9DE0E0C11E70EC1342613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 8d173fd1468db8357b3c2325e96a3adc5f2873ba19ec63912dc748e6972b398c
MD5 8778a9a18aeaf5bf423e3373fb554f7d
SHA1 70dc8d4247fa65ed69ee421123e1ad77ae986a2e
SHA512 24a57a6bb7093db7beddd80657edbfd91fa59fda2722655ca127cca32a5bc11e38b34a8a1ccdea234a848e04bf80bf4da646c8b992b304ed46206f3a81587dda
SSDEEP 96:hC0d+hDK+UyKovbfaNQY/tBSl8h4otop5u6D9DB6edGyvUgIlG1QzbOQGEfeb0j0:hC0qDHUgvIdViU23bFwsIlTLGEfebU+9
TLSH
T19CC13975B46DAC731EB2D616F4132A83CDFA606B9A117EA4D6DA0F0C01D74DC2343923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 3cf4574db256a53773a6ffdcdef95151afda0e563a1f7359311a1028bb200054
MD5 91160086055d3064248a796ea11d7d5e
SHA1 5edfb70945db2916e49c9ec09451091244ecb7db
SHA512 325ea83ae16e32cd50b5c6f7807e78a370c596f4d2bd27c919e8062a93e7222d298cc8ddee0455668df03c6ee60a64b8b29b343e4b8596f80c324c98e3b4f359
SSDEEP 96:hbJ0d+hDK+UyKovbfaNQY/tBSl8h4otok5ucD9DB6edGyvUgIlG1QzbOQGEfeb0w:ht0qDHUgvIdViUD9bFwsIlTLGEfebU+9
TLSH
T154C14A75B46DAC735DB2E606F4132A83CDFA606B9A116FA4D6DA0F0C01D74DC2343923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TC External UPDATED.exe

Path C:\Users\Admin\Downloads\TC External UPDATED.exe
Size 3.3MB
SHA256 7ff48fb5fad779bf62587917d2f02df204335b10aa8d9ccce741e6eb27e9f9a1
MD5 ebf5a6ca5a9bdf431a33cc887a2bfd92
SHA1 2cd822fbc7041ce870cb42aae83b4c332c0aec8a
SHA512 1cb87fc4e8111868c9d99d76dd9588c6e035d62c18f54521e206a885b916b3df216e0d7fd84d82e0e36d1ca0569a8972d804754d3bc0d4b54ac3e9345efc2b98
SSDEEP 49152:BJ9AnoIft9tOeCSMw2Xh6CMW30M3jmpHmplZKDZK72d7WpKkqwod9K3r4nCPvtQ:+Ztryw8hb0MzmNmfEDE72dkd+9Y
TLSH
T126F5DF42734506E5D82AC1B9DA4BA717F374384943104ADBFBD84D923FA76E12B3A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download