daabc05e7cf116655507a747c9503806609af15e088b49acea9f922bc1e6e2c0

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/04/2026, 09:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
test.txt
Size 1KB
Sample260417-lnvzpadt4v
SHA256 daabc05e7cf116655507a747c9503806609af15e088b49acea9f922bc1e6e2c0
MD5 c69455dcd0d1ca4217cdc7ef4e4e140d
SHA1 417b5d97f644d9c11e013499430bbf420280d5ea
SHA512 507a3d0cc116d84548d9b791ec0e43249bc8b2f7d449dc75098999f9faf09c2f99706b212ff2e606a81fdf2372d521fadb95d6657fdcdc133781c5eceba31daf
MD5 SHA1 SHA512

Score

4^/10

discovery ransomware

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3332	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134208925446279385"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
844	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 844	2472	cmd.exe	80
PID 3144 wrote to memory of 2484	3144	chrome.exe	82
PID 2500 wrote to memory of 2016	2500	chrome.exe	84
PID 3144 wrote to memory of 4912	3144	chrome.exe	85
PID 3144 wrote to memory of 4912	3144	chrome.exe	85
PID 3144 wrote to memory of 3332	3144	chrome.exe	86
PID 3144 wrote to memory of 1208	3144	chrome.exe	87
PID 3144 wrote to memory of 1208	3144	chrome.exe	87
PID 3144 wrote to memory of 1700	3144	chrome.exe	88
PID 3144 wrote to memory of 4844	3144	chrome.exe	89
PID 3144 wrote to memory of 1700	3144	chrome.exe	88
PID 3144 wrote to memory of 4844	3144	chrome.exe	89
PID 3144 wrote to memory of 2384	3144	chrome.exe	92
PID 3144 wrote to memory of 2384	3144	chrome.exe	92
PID 3144 wrote to memory of 5068	3144	chrome.exe	93
PID 3144 wrote to memory of 5068	3144	chrome.exe	93
PID 3144 wrote to memory of 728	3144	chrome.exe	94
PID 3144 wrote to memory of 4776	3144	chrome.exe	96
PID 3144 wrote to memory of 4776	3144	chrome.exe	96
PID 3144 wrote to memory of 2076	3144	chrome.exe	97
PID 3144 wrote to memory of 2076	3144	chrome.exe	97
PID 3144 wrote to memory of 1604	3144	chrome.exe	98
PID 3144 wrote to memory of 2144	3144	chrome.exe	99
PID 3144 wrote to memory of 3076	3144	chrome.exe	100
PID 3144 wrote to memory of 3976	3144	chrome.exe	101
PID 3144 wrote to memory of 3976	3144	chrome.exe	101
PID 3144 wrote to memory of 4044	3144	chrome.exe	102
PID 3144 wrote to memory of 4044	3144	chrome.exe	102
PID 3144 wrote to memory of 2288	3144	chrome.exe	103
PID 3144 wrote to memory of 2288	3144	chrome.exe	103
PID 3144 wrote to memory of 3932	3144	chrome.exe	104
PID 3144 wrote to memory of 3932	3144	chrome.exe	104

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\test.txt
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\test.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:844

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffb31ffc728,0x7ffb31ffc734,0x7ffb31ffc740
  2⤵
  PID:2484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1608,i,11447755749859019106,1170460217968757551,262144 --field-trial-handle=1860,i,12176100828398226461,17963546498554984343,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1856 /prefetch:2
  2⤵
  PID:4912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1456,i,2870424025962675005,3004611819875885934,524288 --field-trial-handle=1860,i,12176100828398226461,17963546498554984343,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2264 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2312,i,14116043691937112244,11010470438332957953,524288 --field-trial-handle=1860,i,12176100828398226461,17963546498554984343,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2400 /prefetch:13
  2⤵
  PID:1208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,6588288121483037975,2833342571548281361,2097152 --field-trial-handle=1860,i,12176100828398226461,17963546498554984343,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3248,i,12346254800013484750,10547241556609366415,2097152 --field-trial-handle=1860,i,12176100828398226461,17963546498554984343,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3232,i,8798571079866169349,9000882718569800107,2097152 --field-trial-handle=1860,i,12176100828398226461,17963546498554984343,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4276 /prefetch:9
  2⤵
  PID:2384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4676,i,5311634977436431714,3146460488358858855,2097152 --field-trial-handle=1860,i,12176100828398226461,17963546498554984343,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5488,i,1848602289490790990,10143243455430747746,524288 --field-trial-handle=1860,i,12176100828398226461,17963546498554984343,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5340 /prefetch:14
  2⤵
  PID:728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5840,i,18223415598879767027,15281286671322485060,2097152 --field-trial-handle=1860,i,12176100828398226461,17963546498554984343,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=6040,i,18141333028269793511,8411717802132234415,2097152 --field-trial-handle=1860,i,12176100828398226461,17963546498554984343,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:2076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4872,i,18352809740831791766,10410232347063711372,524288 --field-trial-handle=1860,i,12176100828398226461,17963546498554984343,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4848 /prefetch:14
  2⤵
  PID:1604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6108,i,7239675546028790672,160354342900870872,524288 --field-trial-handle=1860,i,12176100828398226461,17963546498554984343,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6132 /prefetch:14
  2⤵
  PID:2144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6128,i,6310546622088164960,2995641536170334770,524288 --field-trial-handle=1860,i,12176100828398226461,17963546498554984343,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5768 /prefetch:14
  2⤵
  PID:3076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4576,i,280132795634827426,14187157325254123018,2097152 --field-trial-handle=1860,i,12176100828398226461,17963546498554984343,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4448 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6112,i,15680300273490028367,5271236533521012691,2097152 --field-trial-handle=1860,i,12176100828398226461,17963546498554984343,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5976 /prefetch:1
  2⤵
  PID:4044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6224,i,406378525335054209,1644793811943738881,2097152 --field-trial-handle=1860,i,12176100828398226461,17963546498554984343,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6188 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6408,i,9650503054245226649,11294363426637748922,2097152 --field-trial-handle=1860,i,12176100828398226461,17963546498554984343,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6416 /prefetch:1
  2⤵
  PID:3932

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb31ffc728,0x7ffb31ffc734,0x7ffb31ffc740
  2⤵
  PID:2016

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 4ab90ee72321a1f65d12083802908cee44fd663c4de721d6a550a31b067a0f84
MD5 7a0d2e89df843297b6e4dff991e54a8d
SHA1 90c6e246b01e331a2a44f53bfd0bd631cecfbf41
SHA512 04f12d956d1319731fab914a4b22b6b8ef606d918dd131834b6c45f614832000491ab61798c9917c0dde78eb1dbf51e4e115c76da8d1b557cfdb569962f3c711
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 e5c868170b639ade619918d7f61b2754a0cedd13ffbd5a29e23e6f3b4ab89fb9
MD5 d5efaa5285104b72860ad7f88c07dbcc
SHA1 5c6a761dee61af66d61ffddcf89b5f37df1d8830
SHA512 f273026c2aaa4e220cba53b5e5f56fcdf09c11ff14394e31362452b087cb1bfd582786a6166a5c670e75ec29db1440a46bec006429438dcb5b160ef39d9bc9c6
TLSH
T107E02BDDE9219C2B08FD576870544B4AF72013573740484F3B3C810C4FB052B46C995C
MD5 SHA1 SHA512 TLSH

Submit Download

02e3fab171807be4_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\02e3fab171807be4_0
Size 252B
SHA256 dbda3e2baad1613bda6844e6e1f205fecf095df5439b7c3dee3045892c8cbb96
MD5 e74eb4ec5f8d561518d2dfc8b0e79fca
SHA1 5222d6332aa6f201c96209b2e0134b4becba607d
SHA512 11d1d7da2c2a4246c6549651e06e8297bc2c06f4c54f2547e5f187fa35aa8edefe78c95867c286ea12784cef40eb615e5394a5541d3f8d654b4a877e38051464
TLSH
T1D5D0A7FF90506C11C53915B186FE038FD75781954A79E4D9502191B56348BF1728A616
MD5 SHA1 SHA512 TLSH

Submit Download

221c5142c1c395ae_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\221c5142c1c395ae_0
Size 263B
SHA256 0b9dbc6d1f9b7e0bad23f965f1dcc70bd283527ee24211112d233f00008a83da
MD5 a19aca18f7031b9b3d9a22d647df32ac
SHA1 f55ebfc58e569fa55a1272ff544d37e4d619c206
SHA512 932e031736caecf6ce6c5488fca37257ca5ddda21dc4ed0d63330388fda3c15e4ffa12ba3a496f69716cd2da99ab347122373208df5f74f6472f370189b9c249
TLSH
T123D02BEF91D01405C63E81B083EE120F931311C108199866A413615317082F27746612
MD5 SHA1 SHA512 TLSH

Submit Download

dcc3fa755705b89f_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\dcc3fa755705b89f_0
Size 270B
SHA256 21df9e6ee5ba47fbd352bc63e53c51ba140f8b2d915b656cb2af5561f6643c8c
MD5 2224820303faad902ec4b26476101449
SHA1 20f5bba5664686db54e68801f752070028a7b204
SHA512 16dc951af9d674f2d8d796b3d1fd453ebbc89ba92abba5a175ecad07bfffa70760f9f3d5596e6451a2897e24efe46aaf8aeac642a88a1480d7a0898c95f083ea
TLSH
T122D02EBF94406C28E13A73F082EA4A4BE29300C31D9C909E6420B0AA33186F032CA613
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 a7b8d46bf588d9a2901ad02610ad4cd5746ad2351ed2bd3f6f0076d6bb1901c2
MD5 4d28a078ea7cfbf69b73f0d0ccb8e4b5
SHA1 8ac39d3cc09606bc3cff4576db2dac7878d03d9d
SHA512 2e4e80c01a53c2f0cc5d6db2c7f6bb21e084a3251f04c23e4e2030d4b9f9138caa0971c5477b000ab19102c44c11e90cac287e1a6af9825e2dea0eb812a2270b
TLSH
T12A21302FA8F1E245EF2236B8A8CA8C2D3329654D4F5A0F7BC5C9C4AFD0173D1D126294
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 14KB
SHA256 15066ccb0da3ffa6aad0658ebd7b218b8c99b164d1c0b7e9e4847b3388086a12
MD5 6fdba7282584b1df0d400dc5a6087ab0
SHA1 29a8d4a01caf19ac25facad602cc0cabac2f24b5
SHA512 9d2501488eb477e8c92c83c5602972242aab894ab238bea49dc3c8975dd77d912d8a03ddb63825d767ae67778027361efb50d090837a326cfa606abeee6c8cbe
SSDEEP 384:Do1ZIPbxtZYydDenfvtnyeAfU7JsJRIaaiKXNQdKtoePAANgiB/ixgVK1HAqTH1l:8EXbuYBzewpqq
TLSH
T13C626BFBC3E4912DC99152F4AB147E2BCD2D0D2847283C6789E8AF4B63E1472E21165E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 fcdaeb180a66fd8ba0c5e621ef14fb2b9350f0e8d9af42b4c568f5952bcb52dd
MD5 dcdc7c1ea4f03bf073bfdf271fc9cc37
SHA1 82f686a160c58854bad90a13997c45582143e549
SHA512 56f9687eaf6743f6bca118804948d4df2a8983e2285c79354285bd7e0fbe49faf00acf0d5fad156a76689ce274d4733c4db54902c01a2ebbfb18f4bfc0767a79
SSDEEP 192:vRkcBz56rifHuHt4v7AhAPRp21ca9qHsb+WNnW+Bq52Vl2qylskwcaFVyIsnAUg8:vRkmz5fHaks8XU4wzW2D21+8az8
TLSH
T1FF52092FAD14293B5CCAD21AFD55B767E7F6102121942E88E7FC8B2C05D75CD221B42B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 04d9a46f01c70334e5aebb2c7d5a23e82a03a93ada3bd10402c47640cb8840ab
MD5 72eb103abb6d0397fb4a387a84e9df74
SHA1 25d14f29f55b5cf3e0180e11259e2ec53ed845b0
SHA512 979638ccdbf80f45f0c516562e8be589eff5f176dae0d6d8d4f3ea73d37190532ba1e73dc22b1c7446ca71553e06ed5d9d60ad547fad5b13b6cc6d1b22e58686
SSDEEP 192:vRkcBz56rifHuHt3v7AhgPRpia/cZt9qHsb+WNhaW+bEw+q6ePl2qylskwcaAVyr:vRkmz5fHafssXU4wA3Ge921+8aEe
TLSH
T16F62092FA8142D3B9DD6D22AF915B727E7F6102161C42E88E7FC8B1C04E76CD621B51B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 b888880248cfdebb3631efa278d8899d8fe82d92a5091a45c589fa3c23f69815
MD5 c23ba125b1f03155a8889cbc3a96559f
SHA1 dcacb06bf10c9f337c95af351f02c17245b73025
SHA512 37cf4cad82b47ee296071ae882c901acb8751ab21ead087c9744be2ced73525b822277a0d8f7e37632a1fc1c8271d5c808a6500f13080046857a8d47237b5913
TLSH
T1BCB01250C4019662C04303F4168348883514DF20C705130553E069B5983A290C014151
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe597fc5.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe597fc5.TMP
Size 96B
SHA256 e567faa983954148c3884ca07d893896ada709eb4df03661018c95c85c690d6e
MD5 6c84279f7dd5a5f8fabce9d9386916ca
SHA1 aba8fcdd3b7e87910838c292d28da6de2500e1b9
SHA512 91b435d3b483899db6668cece800f7fa12ab7bcf254c7326d6277c166675fcb8eebb0f3ab5acfbb2a127022ea54c107b01341a423a176affed4bc0f93e6a4c89
TLSH
T1EFB00455D5115313C041137515D555D47570DF15D5035135F1D11575DD35750C515770
MD5 SHA1 SHA512 TLSH

Submit Download

a0950d1c-4bef-4aea-8b89-cb6a8e8ffc62.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a0950d1c-4bef-4aea-8b89-cb6a8e8ffc62.tmp
Size 17KB
SHA256 02fa3748cc960b0ed806669146286ae61d8f8c37c72e1c20fff625c9b568d7c5
MD5 e1d791f76039330e35fa0e1827d639ea
SHA1 a37e7b6749565fdef84e626eb8e8ab5cfd1eaf09
SHA512 4cd2d4ec371de591ed8fc49a3c9c69bf2d80c0d8879044f55af268ee4a35e216538e529304db502c0dc2822c3e20cfadd9949c623d30489800bbc0cdffa3ddcc
SSDEEP 384:2Mjqt7KxkXqKf/pUZNCgVLH2Hfgslo67pLuLcifklXODqt+ErU3sjHG9TDWxSal2:2Aqt7KxkXqKf/pUZNCgVLH2Hfgsq67pU
TLSH
T1B672E8676C0C9D7B0F94C58CD8267E4FADB9024B65ED886483FA582A03D5BDF110A1F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 fb016e4549604f1fc4b59a15dcb69341aa0d57835246eb7c6abfd72a274e9b98
MD5 f91b75b85a226f9b118c027ca4591116
SHA1 92e49a793411335f9335cf15c36068ccd8847923
SHA512 ba6714a4532e1dfbb332989c9ef752369650009fe2259f493614e3cd0c86ce307ce46b3a99407fe4a08b9ea979f6e59218b1fb2328b67622f3d8ff974f49e9f4
SSDEEP 3072:bW0JMtYqNcUmRjxvO23Pg4ffQTXI7PEs6v0q8bh++J3qUQm08KMWF0bFTcVHr6zT:bEpkv3PpHEshbh++JjcMW2VcVLA
TLSH
T1B51412B9EC0E6CE667DFD796B01B5C6B4CE384CF0E15A7B86191AF0D082D742069BC61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 193KB
SHA256 e5996e87085b892d433005b02daf9f90615b57d4b9a7a66aa92e9ede7da07fe0
MD5 a668ed3b3357f0b71bd27c7baf18840c
SHA1 65e05ff74322d67b742287150a9ea3cd0e740e74
SHA512 1b87631b7a5dab29559cf1f3ea545e9c9b5ccc2d61666bd4f20e26e2297f796bc215a66eda63c04ea63e64c39a4ce3e16d447e36df3b4c2ba20f23ef3c8722a2
SSDEEP 3072:+0JMtYqNcUmRjxvO23Pg4ffQTXI7PEs6v0q8bh++J3qUQm08KMWF0bFTcVHr6zT:8pkv3PpHEshbh++JjcMW2VcVLA
TLSH
T1C31412B8EC0E6DA667DFD756B11B4C6F8CE380CE092597F421A6AF0D096D742029BC61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 f1bd2b04fbb0850fc1b46efceb75649926bebbfc374e22e8e0302ae748524fe8
MD5 4024739fa1721dceb34b339b59456147
SHA1 a310444d69c13dc5d901cefd146a17b6132281f7
SHA512 6a0893d2bbb639e4c31a1a22cbce005d09622f9a724d83d5085160faf3e38695d4b3d5d3db8cca7dc3c03ccbbc4967e232a88e1f81b5a8fd5b4ff741241e0e42
SSDEEP 1536:hZYP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNs:G++J3qUQm08KMWF0bFTcVHr6zT
TLSH
T13B9312BA591E7D79636AC396D0079CAC8CE3CCCE1514557C30C7AB1E18BA393A30B8E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 193KB
SHA256 b36b199cfad625ee03d0e9e2611541b7df880bdf2ec2e692a6231b37af2981bb
MD5 d7db470e643e61a5dc3ca63c5230a47f
SHA1 5d9c71e007b25c9785a14033350023cf03626220
SHA512 e39155afe7a544ce1315e6e11be893bd18b129025dcddc673a9ad961483ad15b9a1ba51187910dcb9288d752659c803a55eb99122c1057b587da224cbe88a7e5
SSDEEP 3072:B0JMtYqNcUmRjxvO23Pg4ffQTXI7PEs6v0q8bh++J3qUQm08KMWF0bFTcVHr6zT:Vpkv3PpHEshbh++JjcMW2VcVLA
TLSH
T1181412B8EC0E6DA667DFD756B11B4C6F8CE380CE092597F421A6AF0D096D742029BC61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download