hxxp://5[.]175[.]220[.]19[:]25566/

Analysis

user interaction
yes
max time kernel
900s
max time network
883s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/04/2026, 22:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://5.175.220.19:25566/
Sample260418-2s66hsfx21

Score

5^/10

discovery ransomware

Malware Config

Signatures

Drops file in System32 directory 11 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00002.jrs	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jcp	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jtx	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.jfm	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSStmp.log	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00001.jrs	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3212	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134210263232123209"	chrome.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1768	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
4476	chrome.exe
4476	chrome.exe
4844	mspaint.exe
4844	mspaint.exe
540	mspaint.exe
540	mspaint.exe
2524	mspaint.exe
2524	mspaint.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

pid	Process
4984	OpenWith.exe
3504	OpenWith.exe
4244	OpenWith.exe
2560	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe

Suspicious use of SetWindowsHookEx 27 IoCs

pid	Process
4984	OpenWith.exe
4984	OpenWith.exe
4984	OpenWith.exe
4984	OpenWith.exe
4984	OpenWith.exe
4984	OpenWith.exe
4984	OpenWith.exe
4984	OpenWith.exe
4984	OpenWith.exe
4984	OpenWith.exe
4984	OpenWith.exe
4984	OpenWith.exe
4984	OpenWith.exe
4984	OpenWith.exe
4984	OpenWith.exe
4984	OpenWith.exe
4984	OpenWith.exe
4984	OpenWith.exe
4984	OpenWith.exe
4984	OpenWith.exe
4984	OpenWith.exe
4844	mspaint.exe
3504	OpenWith.exe
540	mspaint.exe
4244	OpenWith.exe
2524	mspaint.exe
2560	OpenWith.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 5040	5036	chrome.exe	85
PID 5036 wrote to memory of 3212	5036	chrome.exe	86
PID 5036 wrote to memory of 536	5036	chrome.exe	87
PID 5036 wrote to memory of 536	5036	chrome.exe	87
PID 5036 wrote to memory of 1796	5036	chrome.exe	88
PID 5036 wrote to memory of 1796	5036	chrome.exe	88
PID 5036 wrote to memory of 2444	5036	chrome.exe	89
PID 5036 wrote to memory of 4268	5036	chrome.exe	90
PID 5036 wrote to memory of 2444	5036	chrome.exe	89
PID 5036 wrote to memory of 4268	5036	chrome.exe	90
PID 5036 wrote to memory of 5916	5036	chrome.exe	92
PID 5036 wrote to memory of 5916	5036	chrome.exe	92
PID 5036 wrote to memory of 1100	5036	chrome.exe	93
PID 5036 wrote to memory of 2512	5036	chrome.exe	97
PID 5036 wrote to memory of 972	5036	chrome.exe	111
PID 5036 wrote to memory of 996	5036	chrome.exe	112
PID 5036 wrote to memory of 3024	5036	chrome.exe	113
PID 4984 wrote to memory of 1768	4984	OpenWith.exe	116
PID 5036 wrote to memory of 4476	5036	chrome.exe	117
PID 5036 wrote to memory of 4212	5036	chrome.exe	126
PID 5036 wrote to memory of 4212	5036	chrome.exe	126

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://5.175.220.19:25566/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc50fdc728,0x7ffc50fdc734,0x7ffc50fdc740
  2⤵
  PID:5040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,2048464308973288144,4908061005431039518,524288 --field-trial-handle=2072,i,17472510407645306159,9577791034249282889,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2132 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1720,i,15137229067000094680,16796254704272242827,262144 --field-trial-handle=2072,i,17472510407645306159,9577791034249282889,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2392,i,17684093580454022998,13358141656245808718,524288 --field-trial-handle=2072,i,17472510407645306159,9577791034249282889,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2280 /prefetch:8
  2⤵
  PID:1796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3076,i,585191482682753261,7286782248778421747,2097152 --field-trial-handle=2072,i,17472510407645306159,9577791034249282889,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:2444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3088,i,17474876880212650449,14843906187244804020,2097152 --field-trial-handle=2072,i,17472510407645306159,9577791034249282889,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4372,i,14347801194194435845,3902015884678944247,2097152 --field-trial-handle=2072,i,17472510407645306159,9577791034249282889,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4420 /prefetch:2
  2⤵
  PID:5916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5532,i,3689465517057371839,7578528995272849361,524288 --field-trial-handle=2072,i,17472510407645306159,9577791034249282889,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  PID:1100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5548,i,6772443859933708353,4165703583821422360,524288 --field-trial-handle=2072,i,17472510407645306159,9577791034249282889,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  PID:2512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5964,i,9489441606087753344,12037135278067530110,524288 --field-trial-handle=2072,i,17472510407645306159,9577791034249282889,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5996 /prefetch:8
  2⤵
  PID:972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5988,i,15551504342025389839,1070374598508835120,524288 --field-trial-handle=2072,i,17472510407645306159,9577791034249282889,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5992,i,8443685857780182779,14460587196090349805,524288 --field-trial-handle=2072,i,17472510407645306159,9577791034249282889,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5792 /prefetch:8
  2⤵
  PID:3024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4412,i,4654251447328483602,7883846938926158348,262144 --field-trial-handle=2072,i,17472510407645306159,9577791034249282889,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4804 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4804,i,464586169372776257,18123331007738406214,524288 --field-trial-handle=2072,i,17472510407645306159,9577791034249282889,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1132 /prefetch:8
  2⤵
  PID:4212

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3968

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1160

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_download.zip\nexo_1_21_11\assets\minecraft\atlases\blocks.json
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1768

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_download.zip\assets\nexo\textures\6006c8c7-74e2-4f0c-bd4f-802fbc6e20ff.png" /ForceBootstrapPaint3D
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4844

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
1⤵
- Drops file in System32 directory
PID:660

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3504

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_download.zip\assets\nexo\textures\9403e4ad-fa07-466c-9177-58362394f3e6.png" /ForceBootstrapPaint3D
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:540

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4244

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_download.zip\assets\nexo\textures\item\nexo_armor\forest_horse_armor.png" /ForceBootstrapPaint3D
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2524

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 7cc78bb0fd97cc3c65e01628d61b2cf8adb2293c5cfc96f33746d8941e0af460
MD5 613ad8e7271c2b7ed725d5e0ed43a771
SHA1 8b9c3ff1f022cca0076b424d46ca760a072bb839
SHA512 5795da0730e6fe6c9cd3a07ccc7f0f5665e8e4093b8a64c0c24349d20cd5e4cf5017be16a8565e93edb4dafad995da4704f66d7360b76b1384aa5944a9d09db6
TLSH
T131E02BEBC896EC2709F9171C64651749EE11135B2B51590B7A3C860C8FF563B459285C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 8ca68a4b42d000154bd84b0e6ad92209a1ca5ab1c1229080589f3d89703472bd
MD5 ec7a40a7dd7286c7fc731635e1db5db7
SHA1 edde58343247f36337d8f57f98dd207cf1ec2402
SHA512 d6d47d2fbd7080ec93f01023d055bccc317501ef374841e8a107e10fe88fe4ea6c03755800e400c8adaa47189d9db79e75beb4fcdfdbb6a565d31f07a818029c
TLSH
T1D251ABF793A4997DC51196E4DB146E2FCE790A14031C7C6689D4AE1B53F28B2D20178E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 2c4e2ae5748563a619b015b728527fd7d870b9da34acc77f953f5879cd25dca4
MD5 812014f777a400ef7c9822f07202b6e8
SHA1 66f3fdb773795f0733c628862d645952f8ed9b4a
SHA512 7744ead8b592361f514861dc00d04c309b988e929b8ee1cbf10e931e2e6db33508333e98a7f9b5be205447c8648ca325a365273f4bfad8e96ce61ab8f574218d
TLSH
T16651B1F783E4897DC51196F4EB146E2FCE790514036C7C6289D4AE1B53F28B2D24178E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 9318fb73c94d8e472fe54d351b639de6e2d2e32f7d231754de7e28fd414a917a
MD5 072e8655ac45256ae9f50009f40ecf4b
SHA1 9720d74b1f59c9e8108a3fca74eae638769172e6
SHA512 eb4f3bae23547e8c6bbea34f37d0299132968b30c8f4a408be58c87094c1ad4e6fb830bb182f1bc00aaa9bbde15a860243c00cc7caf3e4490e535f9227ca2f8f
TLSH
T12351C0F383E4897DC61196F4EB156E2FCE790A14036C7C6289D4AE1B53F28B2D24178E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 49c229ac87ce810292ceea246f8b216e69b4c1edb15160731dcf09aa803eab45
MD5 379be092fb468fc260a15227253c37bd
SHA1 de90183bdf0de0f1026899b0cb0c742e3bf17405
SHA512 25607d4611204a98475f2e101cabac71817eeeb16002c69cf07d6db960e966a45d06b077b89ccdf285185f228952c3d319761fbf1a8c71b9d80cec49613e9494
TLSH
T17BF09EA7E72B799B60BD44A71D08B9096CB5A832064158F4CF6AC16DE0859E75F02413
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 75b1f839ef018c77c2dd672acb172bdb75f3ec73db88f5398c171dd0ad81db6b
MD5 2eb05983828d8ce0489d8b6966cfb306
SHA1 1f1ee968b828b3a39c31597a04d4d365dd559811
SHA512 8a84aea86b52daf13d23993d9bff38723dee1f03341bb0cf37cefae2c7419185831c83f9a19c1902c9c85551c467b86fa610a022bf3adb4514ad30d98d089d2b
SSDEEP 192:KRIh1B6h0Pmvv7japAPRp2w9mHsb+WNn78P5E2mtkwwa+JVyIsnAUge:KRIha+mnaUXbIwgPC2GQa+ve
TLSH
T12642D92EA914743B5CCBD22EFA767727DBF5102121D42E84EAFC8A2C15DB6CD621701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 58a7453dc468d175261cc846f72851280897b70d3bf920d4470d64bb5ad34b65
MD5 83c6c35427b0407fe434e5a2bb24a347
SHA1 d1e97ede1b3cccf528b394ebd41a0b06b9a622f3
SHA512 9f49f85bf0382f293d947e84c91bfc88d91ec07d93f73226d0ea7abb505dcb344cba22accee658fd4d1adfefa7fc151ea73d20a625611012d5f6771e973a3153
SSDEEP 192:KRIhIB6h0Pmtv7jap5PRpNw9mHsb+WNn78PkuBE2mtkwwaIJVyIsnAUgE:KRIhj+mNafXCIwgPS2GQaIvE
TLSH
T15652E92EA914743B5CDBD22EFA667B27DBF5102121D02E84EAFC8A2C15DB6CD7217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 56a1e8c00cba78461b814b7af7b99a3de58a4329a7a44475b23e4150677716ca
MD5 6932e737f9fb5bb798f741f34796b7e1
SHA1 58bd5e6597f4a5801de9e176eca39fb244cddab8
SHA512 6e0d027f757f85c0e73419b5d0cc63c8778e317595fc91efbb163ddebee9c4ad7ab8467ebddc43b66b02293c61347fd81b0b3e241e6794b5bc99b05d775c9885
SSDEEP 384:y4jGR7KxkXqKf/pUZNCgVLH2Hfgslyi7pLuLcifIpXODGJ+ErU3DcHG8akl78fPY:yMGR7KxkXqKf/pUZNCgVLH2Hfgswi7pz
TLSH
T1FC720AA76C4C997B0F94CACCC8177F4FADB5015B65E9886493FB582603D8BCB11091EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 d3d553464108b257c5ac1a5abd842e08c79b77629a93bb96d32df20138a9123b
MD5 ce6ae444ac194f316ab970e78a37ce89
SHA1 f17df244ee770f58b030457e48e578c3f74d7f2c
SHA512 8bacf8d663028a6b5305a757a480e72c9622d02571005d9cd72a1b2885e468ce1c0e59ee0e75943dddcae854f4e0c201be4204556604ce7b8fa5014966ea69ab
TLSH
T18FB012588C42D602C05702B0119604C831145F24D7051305E3F06976E8369B14114191
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe585222.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe585222.TMP
Size 96B
SHA256 b5f9d15d89af07f7cb39351e2cec25e505b3d79d124ea0e1122c875e6b7d320e
MD5 cf97e863168dd2970656bceef52d49b2
SHA1 48196f742c4c7fc9ee8ca1d7efc3460ea97c77ad
SHA512 833fc5c50dc361370719226a423d9cd091a22d7809ee0c304ec72c1edf2b557852ed6b8096219416e7c37ddf24c7e5de8b2d824e88b647071987b9db6f7272cd
TLSH
T18EB02280C002A202C00203F02080A2CCF220CF20CB03322282E02AB2EE28230022C020
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 29bd0762d91aa96e449768396f9feeaeb6534cda42f7d933dc4f505495cd2080
MD5 cb2fd1c1a6bf79e8c49d5aab1a8fcef9
SHA1 41c9429287c79695d0fa9f4f71fbbbdc260f88bf
SHA512 f95abe3b823f57dd8b9522d80d458c7651c28216c2ad4a3fd8c2df1dcd004cf31f2f3c448c5c1363aa9ff07787bd82bd688cf48c2e20c0e29d72a6bfdfa81361
SSDEEP 1536:0cCbcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9Yj:0H3Qw/xLANk0mUW5GmRntSFCjEENW
TLSH
T10C9302BA9E2646E7957E468176AE780CCE13130D709FA9CC719C639C21D42C92B72F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 90231a6a23adf78f8b35964de803c76d397a46b18e0457ae241d7177f94f2cc1
MD5 608e6986f612dc33fbe4de1484314b7c
SHA1 8e0591dba75b8e11a151e0532ff1342145b1d303
SHA512 5aaedb7ebbd7203d7af1790912013dd9679eb1f4129cdb58245e515b5ba1e12b7e6b33b81a6256d87406121412f27d1ce6a1e0a4e6adb47d8fa5cfb03ecbb40e
SSDEEP 1536:02CSecYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9e:0r3Qw/xLANk0mUW5GmRntSFCjEENW
TLSH
T1929312BA9E1A46E795BE46D1769E7809CE13130D709FA8CC72AC538C21D41C92B73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 4afddf2ffb8310be83105ad076a2261d409694855db144cd9258e61f9da051b9
MD5 305d636b724a26a66b02ad008fb4cec7
SHA1 12f857196c96e90fe8038a9a5fbf0cd128b5e582
SHA512 8de8b94064df21090dd1badf9a7591f86cb00b6b7a150e7e9260ef9f538fb8ed45ce6907769bbcd807634fe0e4f7a42e29dc773ae4306cbb79bc0c5081b4c938
SSDEEP 1536:0bCQ4cYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9e:0p43Qw/xLANk0mUW5GmRntSFCjEENW
TLSH
T1C39302BA9E2A45F795BE5691769E780DCE13130D709F68CC71AC634C21D41C82B72E63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 a6cc914041e9a08ed76e2d5b441a821fabcd43db99327e22fd63883c79416e66
MD5 828000dc389177edf0bfab73c3f77c18
SHA1 9da1fbfcb6b1d16eaf8676a7f401852f35fe965e
SHA512 fc07857c8bcb5e748b35f40618d4b55c82f10a93019151503b3bef9e9f1feb3e2c29303e30683b221c8be729cd59717dc020435daa25a47516d0a991f8fc7ebf
SSDEEP 1536:0XCSecYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9e:0o3Qw/xLANk0mUW5GmRntSFCjEENW
TLSH
T1179312BA9E1A46E795BE46D1769E7809CE13130D709FA8CC72AC538C21D41C92B73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 869048d9687d6bde0273a5037c5d54c58db42d975dc1dd57ae1d02c92fefe6fa
MD5 15e5e42c24e9e1f0572ad66330c10f3d
SHA1 f64ca9e3dd5d00b4160107a879516fa44f52ec2a
SHA512 cd6f74b917f1fb5f4c1c278fcb16c8505e93c21c95ed020a3ae59c101e2071da63b5836c91d4e81c4a3470ec037a99405d8f1d3bd97c87f3a9048b7be7c8ffad
SSDEEP 1536:0XCQ4cYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9e:0V43Qw/xLANk0mUW5GmRntSFCjEENW
TLSH
T1669302BA9E2A45F795BE5681769E780DCE13130D709FA8CC719C534C21D41C92B72E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DSS.chk

Path C:\Windows\System32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk
Size 8KB
SHA256 ac5e0352705f25c9ce672ca989f78f7e4d1fe88b03ed0853f70918c081743d8c
MD5 e8743b96e9dde0cf40078da5c4b99dd9
SHA1 589759d9b3d74688ca2090994e6816ccac226422
SHA512 2ff42ac329e12d12410c53118af5a63dc68f3090370e8bca8694fc728152c337eed4aaa4dfa0c6206ec8856558846379a81998c2a4b1d12a46573e792bf4a13b
SSDEEP 12:G2o6Ph6CX6Ph6CwVlBI2o6Ph6CX6Ph6CwVlB:M8h6Q8h6pM8h6Q8h6p
TLSH
T1F9F1A002D31509B2C9299D3E588BAB008B3AF406328C42120089A05EFEC92163FB2CFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/540-151-0x000002415E4D0000-0x000002415E579000-memory.dmp

Download

memory/660-131-0x0000025C77420000-0x0000025C77430000-memory.dmp

Download

memory/660-127-0x0000025C769B0000-0x0000025C769C0000-memory.dmp

Download

memory/660-142-0x0000025C7F5C0000-0x0000025C7F5C1000-memory.dmp

Download

memory/660-143-0x0000025C7F650000-0x0000025C7F651000-memory.dmp

Download

memory/660-144-0x0000025C7F650000-0x0000025C7F651000-memory.dmp

Download

memory/660-145-0x0000025C7F660000-0x0000025C7F661000-memory.dmp

Download

memory/660-146-0x0000025C7F660000-0x0000025C7F661000-memory.dmp

Download

memory/660-256-0x0000025C7F760000-0x0000025C7F761000-memory.dmp

Download

memory/660-251-0x0000025C7F770000-0x0000025C7F771000-memory.dmp

Download

memory/660-140-0x0000025C7F5C0000-0x0000025C7F5C1000-memory.dmp

Download

memory/660-138-0x0000025C7F540000-0x0000025C7F541000-memory.dmp

Download

memory/660-150-0x0000025C7F680000-0x0000025C7F729000-memory.dmp

Download

memory/1160-46-0x000001D0DC020000-0x000001D0DC0BB000-memory.dmp

Download

memory/1768-125-0x000001DFE7D10000-0x000001DFE7DAB000-memory.dmp

Download

memory/1768-126-0x000001DFE7D10000-0x000001DFE7DAB000-memory.dmp

Download

memory/2352-13-0x000001DE523F0000-0x000001DE52499000-memory.dmp

Download

memory/2524-154-0x00000240F2450000-0x00000240F24F9000-memory.dmp

Download

memory/2560-155-0x0000026A51EC0000-0x0000026A51F5B000-memory.dmp

Download

memory/3504-149-0x000001EB28CA0000-0x000001EB28D3B000-memory.dmp

Download

memory/4244-152-0x00000275503E0000-0x000002755047B000-memory.dmp

Download

memory/4844-148-0x000001661BF40000-0x000001661BFE9000-memory.dmp

Download

memory/4984-121-0x0000020A2D6D0000-0x0000020A2D76B000-memory.dmp

Download