c63690801e40fcb42de087e3301462328b53d7bd7cbe7bbd8de498beb7065e31

Analysis

user interaction
yes
max time kernel
154s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/04/2026, 01:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
Ransomware.Satana.zip
Size 34KB
Sample260420-cch2babv2z
SHA256 c63690801e40fcb42de087e3301462328b53d7bd7cbe7bbd8de498beb7065e31
MD5 0672084efff0a6907382c7a5d666fe00
SHA1 43300b13ba071f5bee966ae4c3fee8d3b8d17d03
SHA512 e1193575691c58c41c2fce651740b92edef338f1077333dd52b2a49c4195f4eb831e06bbe544e73381b65075e88edf1dcda850fb55e08039b53c6fc5827725fa
SSDEEP 768:GNKcgsGE4FpKnFwHsiazXeBET2UiWk6w5oiSD5O9n2e4H2Hp3:/BfLHxIOBET2Uvk6w5yD5O92x2HV
TLSH
T1FAF2F1692A6DDC8DE24AED79E7FF48391E480FE609EEE824218D4F7916CD814701B2C5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4080	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 17 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134211238006725330"	chrome.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "196"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3448	LogonUI.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 1908	2908	chrome.exe	96
PID 2908 wrote to memory of 3316	2908	chrome.exe	97
PID 2908 wrote to memory of 4080	2908	chrome.exe	98
PID 2908 wrote to memory of 3316	2908	chrome.exe	97
PID 2908 wrote to memory of 748	2908	chrome.exe	100
PID 2908 wrote to memory of 748	2908	chrome.exe	100
PID 2908 wrote to memory of 5728	2908	chrome.exe	101
PID 2908 wrote to memory of 6028	2908	chrome.exe	102
PID 2908 wrote to memory of 5728	2908	chrome.exe	101
PID 2908 wrote to memory of 6028	2908	chrome.exe	102
PID 2908 wrote to memory of 1352	2908	chrome.exe	103
PID 2908 wrote to memory of 1352	2908	chrome.exe	103
PID 1308 wrote to memory of 1976	1308	chrome.exe	105
PID 2908 wrote to memory of 3288	2908	chrome.exe	106
PID 2908 wrote to memory of 3288	2908	chrome.exe	106
PID 2908 wrote to memory of 6032	2908	chrome.exe	108
PID 2908 wrote to memory of 756	2908	chrome.exe	110
PID 2908 wrote to memory of 756	2908	chrome.exe	110
PID 2908 wrote to memory of 4268	2908	chrome.exe	111
PID 2908 wrote to memory of 4300	2908	chrome.exe	112
PID 2908 wrote to memory of 4256	2908	chrome.exe	113

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Ransomware.Satana.zip
1⤵
PID:4924

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffb6da1c728,0x7ffb6da1c734,0x7ffb6da1c740
  2⤵
  PID:1908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1704,i,7069048745074950173,8127863607640467527,262144 --field-trial-handle=1944,i,15168617654679902573,12307467688420163321,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1936 /prefetch:2
  2⤵
  PID:3316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1832,i,8360353375046032823,15464652984919958940,524288 --field-trial-handle=1944,i,15168617654679902573,12307467688420163321,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2068 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2440,i,17983159583617014728,16616648861014546745,524288 --field-trial-handle=1944,i,15168617654679902573,12307467688420163321,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2588 /prefetch:8
  2⤵
  PID:748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3272,i,18270129305832505376,240838829306545806,2097152 --field-trial-handle=1944,i,15168617654679902573,12307467688420163321,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:5728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3484,i,3372113058209412740,9870834322014547566,2097152 --field-trial-handle=1944,i,15168617654679902573,12307467688420163321,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:6028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4260,i,14190268467362207790,6195111227846034094,2097152 --field-trial-handle=1944,i,15168617654679902573,12307467688420163321,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4304 /prefetch:2
  2⤵
  PID:1352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4656,i,7624828387365015600,2261853591185683966,2097152 --field-trial-handle=1944,i,15168617654679902573,12307467688420163321,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:3288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5524,i,4691506402951563122,8343222630314860069,524288 --field-trial-handle=1944,i,15168617654679902573,12307467688420163321,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5576 /prefetch:8
  2⤵
  PID:6032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3744,i,16530122804185352492,16742495328618884660,2097152 --field-trial-handle=1944,i,15168617654679902573,12307467688420163321,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6004 /prefetch:1
  2⤵
  PID:756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6052,i,4812190716930563673,16774112141151470864,524288 --field-trial-handle=1944,i,15168617654679902573,12307467688420163321,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  PID:4268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6048,i,4709785745922269491,15065348313804681698,524288 --field-trial-handle=1944,i,15168617654679902573,12307467688420163321,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5580 /prefetch:8
  2⤵
  PID:4300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5968,i,4406106470026273349,2342635821853525760,524288 --field-trial-handle=1944,i,15168617654679902573,12307467688420163321,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6124 /prefetch:8
  2⤵
  PID:4256

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4324

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb6da1c728,0x7ffb6da1c734,0x7ffb6da1c740
  2⤵
  PID:1976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3368

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa396e055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 6845dc964e521a1f71d86a520a5a6535af6301398514da6d1a49c8ab4b9725b0
MD5 eeada1874586398ed8bdf1f3c912dc61
SHA1 24c7547fbb116ba15d1da38b649da9f4d9f32838
SHA512 13aab50c5c41f7c555b9fefe5ddb2b2a5be7ca990841a8bee3b2b08185c6fbc690ca5ebc811c2895d25cadccc26029f252f1907d14808c47b683cb5838d2f964
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 36a67aa8427a63ca6af7bf0503c88485f4d948890a1263087b356f53d4217996
MD5 e1fd63392af5c363c0c272743f8f17f3
SHA1 b88ab774d63fd8f79a5a6b9f704e18d19931e6f7
SHA512 123141a8c144234a4c8888df551c2258cdce07b64e6bed510c9701c3cbb4dfe48446ccd1a9d2b3ecbc4680e9711737f2762e37e8b8256509ea19f5803a275545
TLSH
T104E02BEAC931EC2718FD1B6C70550A56E68503872B40495F3E3E92088FB863A018681C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 a3161aea47f7fdab45073f217581c4bc16640954c062b48dfb5924331633281b
MD5 f71d3574b026b28bba696a5f5a95b3b1
SHA1 cd8ba262880c295a2d299e1ed22c2ff11a79ed76
SHA512 ee8d7b82fa31c6b0d38e532363aac7f264946a7a797fac1c4c42e6b82965abd5e2f8c099655eeea0aefc5be87db833b1a88c5b62d07ee2b276e985a4ac15c8b0
TLSH
T17831E1E4F675CC0ADB2D9132B7865EA474FD1706CCCC5E016ADEA09931E347B0899D6C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 5ec520cd515a9d5a68d4020deea7d2a0cd16a8ca00ee29e5ba969a1042b04f8a
MD5 c955b9edc21d706a6e2dc636760d9237
SHA1 f5d54f45a7571e2f970ce644600a3bc597e16d0a
SHA512 f6d3d612c497c78c8a98f40d1697174dc2f17077d94adf17d75d775f7d2cd525b3ec5c168ecdb7a100af439ab0ef814f8e8f0f2758388cf53f99f2e2cee5ac80
SSDEEP 192:DP0xLm/xrNCBe0caIabmjiQYKJUSYXI6IdddI0Ipeg:DP0xLm/xrNCBe0caIabmjiQYKJUSYXIY
TLSH
T104F19BB3C3E8C62D891556F49B266F1FCE190A18432C3C66C8D8AE5B93E2871E21575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 07155bfe72742e5634827d1446059526cae6ddc8d69dd375b7cf12916e6968da
MD5 9090dfe9596a37969322d3bb8105148e
SHA1 fb0c5e61a7f3b1a9828eb8382bf3f433f89fb3a8
SHA512 3aadc0b297ecbc5fedf3452f8d5a2b3232e34c1a942794aa4c0b1c82094b9b5c1831766c10f54ffc42565ce784115d6852988be71e39b05c40d72462271e664b
SSDEEP 192:xRUcBzrZNvd8iRv7tYpuPRp8h3dc9CHsb+WNnbTBKhc7XDaGhvqej8yIsnAUgraJ:xRUmzrrBhYeXg+4wH+cXaHZe
TLSH
T10152F72EB914793B9DC7C219F9627B27D7F5102121D42E94EBFC8A2C15EBACD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 76bf03b50b75907b92bc02beb01b30f9278c68848f192ba9b9feec1c4f75f2d4
MD5 d1303fedd270127af452594123f614a2
SHA1 b386b90106562e248c17cd5f038e6bef0b922fb9
SHA512 bac67270ca3fa1910b15112c953087bea8bb9fb94f02efa10eb277c1b15e84ea30faa638079ab2c5e094b6ef78154a59dc14288374d9e3a8661f97fa835bfbf1
SSDEEP 192:xRUcBzrMvd8iRv7tYpAPRp2h3Ej9CHsb+WNnbTBUw2nXDaGhvYejVyIsnAUgtaJ:xRUmzrABhYUXeC4wHB2Ta3W8
TLSH
T18452D72EBA14793B5DC6C219F962772BDBF5102131D42E94E7FC8A2C14EBACD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 077b6660a818b403986434a353b0792518f54dd06beca3fcbca03e912cf416f2
MD5 731c0521d82e306d546ab1bb16ce01c9
SHA1 f6706d357592e1717186615a28a08be50064002b
SHA512 4ce9bab9a25af609ac710e472dbb37dcabdecc32b0385c1124dec81625d087114ed0d9166f051da229911aef21c74a5936bd949c83fe749dd6105e63d59590bb
SSDEEP 192:xRUcBhrMvd8iRv7tYpAPRp2h3uv9CHsb+WNnbTBWGReJqXDaGhvYejVyIsnAUgtK:xRUmhrABhYUXeQ4wHhewa3W8
TLSH
T18452D72EB914793B5DC6C229F9627767DBF5102131D42E94E7FC8A2C14EBACD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 e3e85507733b74e650902d1645f4c8e2a47131f5f4d003efbf580d80d51d1e18
MD5 d25832a19ff9c1c57c95ef5ecf3d457d
SHA1 30d5ae73ddd9dfab1127bd841aef79ad540016fb
SHA512 680876039281bd13201af5a0d12b9eed3257e3547eb60a743076a4ef44ddf64d39464fedf9d363ec15f80fae0d8dd3610e3a09d4d4a9512ce92d01878e2ab95f
SSDEEP 384:S0jWV7KxkXqKf/pUZNCgVLH2Hfgslvy7pLuLcifcdXODW1+ErU3IQHGtHkr0:SYWV7KxkXqKf/pUZNCgVLH2Hfgshy7pd
TLSH
T15372D8676C4C99370F94C6CCDC167E4FADB6024B65DD886893FA582A03D5ACF120A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 86287f22f4643ab0b4aa1dc02c07211dd44ee7c1531be2a568941457c28e7e4f
MD5 4ed8c7cbb160294c75902becf94abbf0
SHA1 3c50a55ac71fb3559f5c68d4f7ebdec09ce41692
SHA512 9e4f3f6ebd38bc1de03153dc411c3b92501215e4d7072c13cea0607b153e23e160516958ba09ffccbf3b61c8cb0dfc5da0af3463175f6f4be0e097f771d587ea
TLSH
T169B012A080419501C04302F9339268E83114DF108F05134157F0697198365904115154
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f901.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58f901.TMP
Size 96B
SHA256 83119ed64b2357a4923458368bd7c1452c029ca08b58ebee94bfd4adce89c24b
MD5 139cb1396c1273cf556e7da077284c57
SHA1 885db713f06c237aa979038a614ce3410466ca5a
SHA512 d9550374f6cba2781757614f4bf8b76f58163f32af653ee50df5bbee6732e6e4d1e3d5ac92523643da36ec9c1bf994f1a52412bfcfef98859d50e362173b89b0
TLSH
T13FB00255C602B212D04613B07AD5D6D87560DF29E6135226A6F11B7EDC39AB046256A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 f63329c2807ced941f35e4fc7b03cd0012e4f656292feb21216bed122fddfe97
MD5 0c626ff83a022ad2bced8d41979c40eb
SHA1 83fa0082645eea899b6869db7952f11e96164d27
SHA512 6eb510f26c7cdfcfecb44ef701d466717688ab1f36e44cf7c165b93b19176d4d543394763fcbf8b2484ad08cdcdcb2a66ac09d6aa98f9ca6cccfc45e6c17aa59
TLSH
T1BBA002981153CB43E041037151A101807215C8917621235142954A588DBC6C1C66308C
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 c0cae2754937d9f9ea679a3963cf4ee1418a58d1aa0a94e2614fc3384025c588
MD5 9a307fe9a9f209646fd971614c4caecb
SHA1 8dc0bd2e7e4721a702264c88b27a8ec07a1a871d
SHA512 65b10573cb6206a3cd8c5c4e3805febe206f79632ac22f96e4c0c7c3da82030d44fd9fcb62a482e08843061d9b2c3a0ff44003e6fd65613cb906b4d74641b610
SSDEEP 3072:dcothHWNfF1sE1hE5i9v8qvaJFY3Qw/xLANk0mUW5GmRntSFCjEENp:dB2daE1Ki9v8KGYrOk0HOGm/SFyEEb
TLSH
T1781413B5DE0B46F3D97E82C572A5150ECD2197CBB07EA55837DC4F4DA0C52881B73A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 193KB
SHA256 51e43913af5ba7e8c94865e521b3d0dffeebd0f4baa01b285421e6ada8b1fb45
MD5 d39f3c0466e7f63e57d25e7ae701b10c
SHA1 e52ec9407a93242c928b88716695ab7e631457ea
SHA512 3d07ed0ba1915d4fb0c99db088f6fb8001b638276b9f2ce3710a24256e34c641cf3cfc5de068970120172bb05dad8a67d4cf9ecb07ef0b2ff8b8f10f5f4f9d89
SSDEEP 3072:DcothHWNfF1sE1hE5i9v8qvaJFY3Qw/xLANk0mUW5GmRntSFCjEENp:DB2daE1Ki9v8KGYrOk0HOGm/SFyEEb
TLSH
T15A1412B2DF0B4AF3D97E82D572B9150ECD1197C9707F656437EC4B8EA0C528817A2A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 8c73859b1dc4b5d56d8462fe684f0482a1d5fd584a64afbef1ac60ca28901877
MD5 7540cf8fef1d5217fbb2aab905c7e7ce
SHA1 194092bfc54c937b7f299bd6e5c69192f11728dc
SHA512 13d9909b0a9690a062ad1bd99a69ed78715b323f7292772817f681f1f5776ff3d0e1aa99f8ed3b3795e5a610b667a973595cab840b1c1c45276d8f2cfe6ccae1
SSDEEP 1536:0N8cYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEB:I83Qw/xLANk0mUW5GmRntSFCjEEN3
TLSH
T1AD9312BA4E1A46E7997E46C176AD7808CE22130D70AFA9CC316C639D61D41C92B73F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 193KB
SHA256 c29a02b5e3df0ee74adae0a6996ffadf2c8e87bfe4c2a3a8649921a84e177661
MD5 bc909d2dacd82d58e6dc2cf46c82aa07
SHA1 28815ddf49a85d4eeb28669c016a57fb82f6a123
SHA512 241b6834228030bddc61250327946b7c36f0873aaf2b07ae4ce32979a14c74c26167c39e5d0847e4208f2b57134ab412fe4979374e795c0f5c20e559b9c0bcd5
SSDEEP 3072:ScothHWNfF1sE1hE5i9v8qvaJFY3Qw/xLANk0mUW5GmRntSFCjEENp:SB2daE1Ki9v8KGYrOk0HOGm/SFyEEb
TLSH
T1111412B2DF0B4AF3D97E82D572B9150ECD1197C9707F656437E84B8EA0C528817A2A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads