Analysis
- user interaction
yes - max time kernel
299s - max time network
206s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/09/2026, 15:13
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://4fln3-webdrive.top/ln/?121825011222
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
17 signatures
300 seconds
General
- Target https://4fln3-webdrive.top/ln/?121825011222
- Sample260925-sl4blsvvbz
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 260 chrome.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 7 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey svchost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey svchost.exe Key created \REGISTRY\USER\S-1-5-19 svchost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE svchost.exe - Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\ chrome.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1624 chrome.exe 1624 chrome.exe 1624 chrome.exe 1624 chrome.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
pid Process 1624 chrome.exe 1624 chrome.exe 1624 chrome.exe 1624 chrome.exe 1624 chrome.exe 1624 chrome.exe 1624 chrome.exe 1624 chrome.exe 1624 chrome.exe 1624 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1624 chrome.exe Token: SeCreatePagefilePrivilege 1624 chrome.exe Token: SeShutdownPrivilege 1624 chrome.exe Token: SeCreatePagefilePrivilege 1624 chrome.exe Token: SeShutdownPrivilege 1624 chrome.exe Token: SeCreatePagefilePrivilege 1624 chrome.exe Token: SeShutdownPrivilege 1624 chrome.exe Token: SeCreatePagefilePrivilege 1624 chrome.exe Token: SeShutdownPrivilege 1624 chrome.exe Token: SeCreatePagefilePrivilege 1624 chrome.exe Token: SeShutdownPrivilege 1624 chrome.exe Token: SeCreatePagefilePrivilege 1624 chrome.exe Token: SeShutdownPrivilege 1624 chrome.exe Token: SeCreatePagefilePrivilege 1624 chrome.exe Token: SeShutdownPrivilege 1624 chrome.exe Token: SeCreatePagefilePrivilege 1624 chrome.exe Token: SeShutdownPrivilege 1624 chrome.exe Token: SeCreatePagefilePrivilege 1624 chrome.exe Token: SeShutdownPrivilege 1624 chrome.exe Token: SeCreatePagefilePrivilege 1624 chrome.exe Token: SeShutdownPrivilege 1624 chrome.exe Token: SeCreatePagefilePrivilege 1624 chrome.exe Token: SeShutdownPrivilege 1624 chrome.exe Token: SeCreatePagefilePrivilege 1624 chrome.exe Token: SeShutdownPrivilege 1624 chrome.exe Token: SeCreatePagefilePrivilege 1624 chrome.exe Token: SeShutdownPrivilege 1624 chrome.exe Token: SeCreatePagefilePrivilege 1624 chrome.exe Token: SeShutdownPrivilege 1624 chrome.exe Token: SeCreatePagefilePrivilege 1624 chrome.exe Token: SeShutdownPrivilege 1624 chrome.exe Token: SeCreatePagefilePrivilege 1624 chrome.exe Token: SeShutdownPrivilege 1624 chrome.exe Token: SeCreatePagefilePrivilege 1624 chrome.exe Token: SeShutdownPrivilege 1624 chrome.exe Token: SeCreatePagefilePrivilege 1624 chrome.exe Token: SeShutdownPrivilege 1624 chrome.exe Token: SeCreatePagefilePrivilege 1624 chrome.exe Token: SeShutdownPrivilege 1624 chrome.exe Token: SeCreatePagefilePrivilege 1624 chrome.exe Token: SeShutdownPrivilege 1624 chrome.exe Token: SeCreatePagefilePrivilege 1624 chrome.exe Token: SeShutdownPrivilege 1624 chrome.exe Token: SeCreatePagefilePrivilege 1624 chrome.exe Token: SeShutdownPrivilege 1624 chrome.exe Token: SeCreatePagefilePrivilege 1624 chrome.exe Token: SeShutdownPrivilege 1624 chrome.exe Token: SeCreatePagefilePrivilege 1624 chrome.exe Token: SeShutdownPrivilege 1624 chrome.exe Token: SeCreatePagefilePrivilege 1624 chrome.exe Token: SeShutdownPrivilege 1624 chrome.exe Token: SeCreatePagefilePrivilege 1624 chrome.exe Token: SeShutdownPrivilege 1624 chrome.exe Token: SeCreatePagefilePrivilege 1624 chrome.exe Token: SeShutdownPrivilege 1624 chrome.exe Token: SeCreatePagefilePrivilege 1624 chrome.exe Token: SeShutdownPrivilege 1624 chrome.exe Token: SeCreatePagefilePrivilege 1624 chrome.exe Token: SeShutdownPrivilege 1624 chrome.exe Token: SeCreatePagefilePrivilege 1624 chrome.exe Token: SeShutdownPrivilege 1624 chrome.exe Token: SeCreatePagefilePrivilege 1624 chrome.exe Token: SeShutdownPrivilege 1624 chrome.exe Token: SeCreatePagefilePrivilege 1624 chrome.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1624 chrome.exe 1624 chrome.exe 1624 chrome.exe 1624 chrome.exe 1624 chrome.exe 1624 chrome.exe 1624 chrome.exe 1624 chrome.exe 1624 chrome.exe 1624 chrome.exe 1624 chrome.exe 1624 chrome.exe 1624 chrome.exe 1624 chrome.exe 1624 chrome.exe 1624 chrome.exe 1624 chrome.exe 1624 chrome.exe 1624 chrome.exe 1624 chrome.exe 1624 chrome.exe 1624 chrome.exe 1624 chrome.exe 1624 chrome.exe 1624 chrome.exe 1624 chrome.exe 1624 chrome.exe 1624 chrome.exe 1624 chrome.exe 1624 chrome.exe 1624 chrome.exe 1624 chrome.exe 1624 chrome.exe 1624 chrome.exe 1624 chrome.exe 1624 chrome.exe 1624 chrome.exe 1624 chrome.exe 1624 chrome.exe 1624 chrome.exe 1624 chrome.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1624 chrome.exe 1624 chrome.exe 1624 chrome.exe 1624 chrome.exe 1624 chrome.exe 1624 chrome.exe 1624 chrome.exe 1624 chrome.exe 1624 chrome.exe 1624 chrome.exe 1624 chrome.exe 1624 chrome.exe 1624 chrome.exe 1624 chrome.exe 1624 chrome.exe 1624 chrome.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe 3588 taskmgr.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3588 taskmgr.exe - Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 1624 wrote to memory of 4324 1624 chrome.exe 89 PID 1624 wrote to memory of 260 1624 chrome.exe 91 PID 1624 wrote to memory of 124 1624 chrome.exe 92 PID 1624 wrote to memory of 124 1624 chrome.exe 92 PID 1624 wrote to memory of 3296 1624 chrome.exe 90 PID 1624 wrote to memory of 3296 1624 chrome.exe 90 PID 1624 wrote to memory of 4104 1624 chrome.exe 94 PID 1624 wrote to memory of 1048 1624 chrome.exe 95 PID 1624 wrote to memory of 4104 1624 chrome.exe 94 PID 1624 wrote to memory of 1048 1624 chrome.exe 95 PID 1624 wrote to memory of 5960 1624 chrome.exe 96 PID 1624 wrote to memory of 5684 1624 chrome.exe 97 PID 1624 wrote to memory of 5684 1624 chrome.exe 97 PID 1624 wrote to memory of 5700 1624 chrome.exe 98 PID 1624 wrote to memory of 5700 1624 chrome.exe 98 PID 1624 wrote to memory of 2360 1624 chrome.exe 100 PID 1624 wrote to memory of 2360 1624 chrome.exe 100 PID 1624 wrote to memory of 3172 1624 chrome.exe 103 PID 1624 wrote to memory of 2856 1624 chrome.exe 104 PID 1624 wrote to memory of 3172 1624 chrome.exe 103 PID 1624 wrote to memory of 6076 1624 chrome.exe 106 PID 1624 wrote to memory of 2492 1624 chrome.exe 105 PID 1624 wrote to memory of 6076 1624 chrome.exe 106 PID 1624 wrote to memory of 2492 1624 chrome.exe 105 PID 1624 wrote to memory of 2552 1624 chrome.exe 108 PID 1624 wrote to memory of 912 1624 chrome.exe 107 PID 1624 wrote to memory of 2552 1624 chrome.exe 108 PID 1624 wrote to memory of 912 1624 chrome.exe 107 PID 1624 wrote to memory of 5004 1624 chrome.exe 112 PID 1624 wrote to memory of 1444 1624 chrome.exe 113 PID 1624 wrote to memory of 5540 1624 chrome.exe 114 PID 1624 wrote to memory of 604 1624 chrome.exe 126 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://4fln3-webdrive.top/ln/?1218250112221⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffbfd4ec728,0x7ffbfd4ec734,0x7ffbfd4ec7402⤵PID:4324
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1612,i,10750980679349230310,14292627090124078583,262144 --field-trial-handle=1908,i,15584596561808170229,55965762789194416,262144 --variations-seed-version --mojo-platform-channel-handle=1900 /prefetch:22⤵PID:3296
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1472,i,1344501510676760222,13259151837224994453,524288 --field-trial-handle=1908,i,15584596561808170229,55965762789194416,262144 --variations-seed-version --mojo-platform-channel-handle=2072 /prefetch:112⤵
- System Time Discovery
PID:260
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2216,i,11541000479350795242,16276237306688410591,524288 --field-trial-handle=1908,i,15584596561808170229,55965762789194416,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:132⤵PID:124
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3204,i,4263113998682265895,87355105912247733,2097152 --field-trial-handle=1908,i,15584596561808170229,55965762789194416,262144 --variations-seed-version --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:4104
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3196,i,3684300731444394106,6400278703475779479,2097152 --field-trial-handle=1908,i,15584596561808170229,55965762789194416,262144 --variations-seed-version --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:1048
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4912,i,6951165634602247134,4237700401939056235,524288 --field-trial-handle=1908,i,15584596561808170229,55965762789194416,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:142⤵PID:5960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5320,i,17380572149962056657,14580066617414286049,2097152 --field-trial-handle=1908,i,15584596561808170229,55965762789194416,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:12⤵PID:5684
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5332,i,16957597400983334586,9006426373373600056,2097152 --field-trial-handle=1908,i,15584596561808170229,55965762789194416,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:12⤵PID:5700
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5644,i,358202451248008935,15774417062596436696,2097152 --field-trial-handle=1908,i,15584596561808170229,55965762789194416,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:12⤵PID:2360
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=6128,i,12322668565981425713,8531051193555836343,2097152 --field-trial-handle=1908,i,15584596561808170229,55965762789194416,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:12⤵PID:3172
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6452,i,3548793654400687839,7477721884773381680,524288 --field-trial-handle=1908,i,15584596561808170229,55965762789194416,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:142⤵PID:2856
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6196,i,12208208272281424329,16286133076970301894,2097152 --field-trial-handle=1908,i,15584596561808170229,55965762789194416,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:12⤵PID:2492
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6604,i,5304054303958342595,17436251738831071066,2097152 --field-trial-handle=1908,i,15584596561808170229,55965762789194416,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:12⤵PID:6076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5808,i,207166523507978381,2014419209356715793,2097152 --field-trial-handle=1908,i,15584596561808170229,55965762789194416,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:12⤵PID:912
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5552,i,5330278132092085073,2965432075266779398,2097152 --field-trial-handle=1908,i,15584596561808170229,55965762789194416,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:12⤵PID:2552
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6456,i,13661092306385496559,6788014985420980683,524288 --field-trial-handle=1908,i,15584596561808170229,55965762789194416,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:142⤵PID:5004
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6488,i,11833658328199805467,9553390453896135361,524288 --field-trial-handle=1908,i,15584596561808170229,55965762789194416,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:142⤵PID:1444
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=256,i,15749565376454852623,15145150912412518281,524288 --field-trial-handle=1908,i,15584596561808170229,55965762789194416,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:142⤵PID:5540
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5964,i,15728273037121759523,16983336826832935121,262144 --field-trial-handle=1908,i,15584596561808170229,55965762789194416,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:102⤵PID:604
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:396
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4244
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
- Modifies data under HKEY_USERS
PID:5736
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2692
-
C:\Users\Admin\Downloads\Fling-Standalone20.331.55707\Fling-Standalone42.931.3742.exe"C:\Users\Admin\Downloads\Fling-Standalone20.331.55707\Fling-Standalone42.931.3742.exe"1⤵PID:796
-
C:\Users\Admin\Downloads\Fling-Standalone20.331.55707\Fling-Standalone42.931.3742.exe"C:\Users\Admin\Downloads\Fling-Standalone20.331.55707\Fling-Standalone42.931.3742.exe"1⤵PID:2476
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3588
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:1604
-
C:\Users\Admin\Downloads\Fling-Standalone20.331.55707\Fling-Standalone42.931.3742.exe"C:\Users\Admin\Downloads\Fling-Standalone20.331.55707\Fling-Standalone42.931.3742.exe"1⤵PID:4608
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
- Size 264KB
- SHA256 28cb7b9dbf7c7d21bbe2929695a1a431662c8efa99f11d7b3161848da1ac1f3d
- MD5 8245565dafa11af7765379b1401dcb44
- SHA1 11c91a47b0e99e4d6368236f75d215e2450a73db
- SHA512 16bbbc72f2925092f375f41e7d7da74b91caa60a51e8e11e376bc3c5ea8662218b5155ec991b146804ff373a0153ba325e7a04f092f52b4a4bd56514bc8cfe1c
- SSDEEP 3:MsEllllkEthXllkl2zEgltcG:/M/xT02zjaG
- TLSH T10A440204EF917409C60030308422C3511360D45805329747645504125C85B402C40000
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 3fe0e4ad9ed8227ac35c6479cf952e1bf9d9b8f31702114231a5ff991d00a3b6
- MD5 6f5ce051a4b9342d88c0f628f5d1a125
- SHA1 3fb23dce258c2a28b8081f0e9af235b084343d47
- SHA512 7c9878b6bf7cac37bfcf6a9d857369b1dcc94093cc5d56fbbde830b655bb49344cff98d94b60f4988738157bfd30efbdf0715c8a23ca228bcaf37aa5d90a2635
- TLSH T12C51AFF7C3E8866D891156F4AB156E2BCE2D0A24526C3C17C9D9DF4F97E28B1E30064E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 fcb2fe49413b707ad54649afd3800ea65326034762a36d3156861c6c748c2064
- MD5 c0fd0d7778217236d28d946d24570e61
- SHA1 5c87e28edfb7ec2e8663d7bd0316f7006c040f45
- SHA512 354a5a916e0aba2354b7a0e866624eebf13e24a9b97a665035ad4771ed37c7b9e17901fd2b931c875385b696b72a23f5643ad252bd9190ac0f9ac3f6b731bf74
- TLSH T14D51AFF7C3E8866D891156F4AB156E2BCE2D0A24526C3C17C9D9DF4F97E28B1E30064E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 356B
- SHA256 1d273352a0270097ec9fb1f7420d5c7e4f61a0b435c7e3680da8805911bc963e
- MD5 03a0dde41f5b982e0c4b3700f8de4f55
- SHA1 2c48fd30b889c4746c1b2bcbe9a400efc88384f0
- SHA512 0942cefc58b27046ea6a75e86f791b101a076ae870e785c6f7e9b4c591e1c81846d310f6fbb236ec749e923f50f6d1589cd179c708ed74c3e8eb1d083373d41f
- TLSH T124E020F7E6AD79B310BD45661E00B40A5EB5A831024268F8CF9A416CE1455E71F12403
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 11KB
- SHA256 d3259acb189de67573097276dea90d9b75b72b918c70eba72689cc045c322394
- MD5 79e563cd90b2b20605fefd8ea159cb23
- SHA1 a4da8c82ad1712373cde48727fffb75d3110878c
- SHA512 9ad411ec1d5bfc98ce2a944450364beb424bdfb72e3d7b9a55c7365c5abfd72e8a55de5a3a7e86dd43395140f22e3ae28779d675c6388dda67687fca019dcaf3
- SSDEEP 192:gRfVSZIsvv7cvAPRp2A2wXsb+WNnYPbVrI2rt2BykwEiyIsnAUge:gRfVSZIsnA6XxDXw4bS2B2sle
- TLSH T14932952DAD14B93B9CDED22AFA267B57D3F9102134902E84E6FD893D15E79CC621700B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 11KB
- SHA256 d189f5f38e1a9a8be6d82a8b666fcb7cb1a59d0cbeca765fade5b42c5e91f423
- MD5 6f8a9c9e95d67a1217f636ac803342cf
- SHA1 16c2aaf9b1a2a6772314cbd4eceeb8686a72d1b6
- SHA512 3f8a65327f8bf487b9feaac31a5cb31a0f35548785e61bf514a7ea2b1640772bdb9fcf0667d826d9a103234d586dd076da804a55a81b0aaac6104219382af3b3
- SSDEEP 192:gRfVSZIsvv7cvkPRp5A2wXsb+WNnYPbVrI2I0t2BykwkiyIsnAUgE:gRfVSZIsnAuXeDXw4bS2Ik2sFE
- TLSH T1BB42A52DAD14B93B9CDAD22AFA267B53D3F9103124902E84E6FD893D15E79CD6217007
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 11KB
- SHA256 8c7577b544ed7b37385a604e13b40c4aea4648d3fae8962db8611e8a63408e51
- MD5 732de8cdfa44549aee916b3128c61ae3
- SHA1 6201a4a55c97cdb8b57cb3f61ba893d5dd358b5d
- SHA512 9eaa398ed23d1f4dae033777b1069636a7e8002d4594f290b2f598fe3e323c19011e7f57a6c16f1c0f5707f938b0c4452ee8efb283aab7141207038e04899ecb
- SSDEEP 192:ens4K6fb7KxkXqK4I40pUZNCgVLHrKHfFKslESfFXzKD/wX+ErUkKN902A/gkoPn:usjYb7KxkXqKf/pUZNCgVLH2HfgslzFQ
- TLSH T1BE32F92BA48D9A3F4FD8D51DDC136F4FACB502966228092497FB9C0803F978E514A1FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 5KB
- SHA256 34291f6ca0f9b351339587c52e2ba56a7007febebcfa603883c0fedf32939dc2
- MD5 f2f6d812f56251328f03e456e4e4327b
- SHA1 1c970a1edd04c8da78e73bd0a78c34775edf057e
- SHA512 a7bef0b59e778fe36d4747096edc29adc06f91b32911b05c46f6783a70c5683edde8b0a32ae9774808b47caed131912cf18b89ea0f08f375b061d3798afeafc7
- SSDEEP 96:AC0d+TWqN/K890wxi+9M7fX3urjUydyESl8h4otop5epVDRB6bGyvteer5AuxWtC:AC0oWqNVVxi+9oP1IiU2cdn7tMxWtwdr
- TLSH T13EC11A31B86DA87759E7D856F0032E538FB860AB56619FA4EDEA0F1C11E70AD1342523
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 4KB
- SHA256 5ba5dccab357e04a3c38c316fab4e32fae1d3f0dac5c3208200cad4319b44c90
- MD5 098fc433a05859e161168ad2989353cb
- SHA1 2407337e3d2f0a57a8654894cdec3563699d3559
- SHA512 e74f81a596eb5b312351a3ccace63ddd407ad395e4a6e57e3d5db9e9d3d005e1cf68cdd010e6ec39dc95c0d8a58c6f50cdc3fcf6bf6207d2da0aef8551707d09
- SSDEEP 96:CC0d+TWqN/K890wxi+9M7fX3urjUBdyRDotok5ep0cDRB6vGyvtBWG0cs3bOv4a:CC0oWqNVVxi+9oP8DUDc0KnDeW9cs3bQ
- TLSH T134A10A31A87D997789F6D585B1462E538FB970AB6521DFD4E8EE191C10F30EC0342627
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 5KB
- SHA256 df6cb751ae50c84002dc5ee3621c68df7d97ba658cc512fd664b6c33a9173665
- MD5 7744004c8cb1eb648716b72634604734
- SHA1 25a24b57cb8dc2783fea456e390e61d84614c82b
- SHA512 612c93fe6676dd5b741e25ce5a0e566dd5a0cfdd391c1731491052d697e2de5e149e9de663c0a09c4c092ce2975ba5323587419d1e344a6c33cb1155a4a96e53
- SSDEEP 96:AbJ0d+TWqN/K890wxi+9M7fX3urjUydyESl8h4otok5epKDRB6bGyvteQWtYkdsR:At0oWqNVVxi+9oP1IiUDcsn7tQWtBdsR
- TLSH T1C9C10A71A86D9C6B4DF6A485B0032D538DB8606B6A25BF58FDEA5E1C00F34DD1383633
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 5KB
- SHA256 2950badb1d66b36ba64faa1f519f428b8b69bc631d34f4d9f5e40c73cec7e2b4
- MD5 57338d7a8356c1fdeaad7cab36dc2ff6
- SHA1 abe4cfb48d48b06acd395d5a135f21a043852a19
- SHA512 4b656fbd8c5f4ebf0bed36806625b35b9e18ec7ea621f3f140d33578bb6c3b0ae3bc71312180231ac4e4d34e535e5114fad763d517315e75b98ddf330d56d5fa
- SSDEEP 96:AbJ0d+TWqN/K890wxi+9M7fX3urjUydyESl8h4otop5epVDRB6bGyvteQWtRkdsW:At0oWqNVVxi+9oP1IiU2cdn7tQWtGdsW
- TLSH T14BC10931A86DAD6B4DF6A885B0032D438DBC206B6A65BF94FDEA5E1C00E34DD1343633
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 5KB
- SHA256 94908b3843b82b85e89c8d99b97976b8aec4afcf06c7be2bc5254138bec80513
- MD5 ca0cfa08c0e6b1b68d7b708fe1bad807
- SHA1 624f1fc74350f00dc5f90f2f9469d0d59029ed8f
- SHA512 5aa406e18a75386be96633ae301f3af124c263b2f4aaeb3adfdac10cc3655da29302957688459ac34ffd4a7f98f4c765c763e5bc79ddc5dba2c8a511e0864e21
- SSDEEP 96:AbJ0d+TWqN/K890wxi+9M7fX3urjUydyESl8h4otop5epVDRB6bGyvteer5AuxWI:At0oWqNVVxi+9oP1IiU2cdn7tMxWtwdr
- TLSH T1D5C11A30B86DA87749E7E856F0023E53CFB8606B56619FA4EDEA0F1C11E709D1342523
- MD5 SHA1 SHA512 SSDEEP TLSH