7dca991089c6e59859ef1e2ee86c4d520a5ed7b2298aa4aa02bd8b718d2e1578

Analysis

user interaction
yes
max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/04/2026, 01:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
envio.txt
Size 258B
Sample260426-bfhdhsdw4n
SHA256 7dca991089c6e59859ef1e2ee86c4d520a5ed7b2298aa4aa02bd8b718d2e1578
MD5 87d06a63fef1a2d246c7627f3afe8139
SHA1 a27c52e5a5f1d4a0714ab2818e4fb483190d2e8b
SHA512 76e41dae2cd3870cc07d9c3862181f20766cf093e64159889d0c4e7d8ebfcc81d5def7d9f4d87ce1a1ad4e8cdca0e08d159580fcee5e51ea432a921051724101
TLSH
T19AD02BE7280310C15A98198430B901D988279C586C4172A1974613B28A781B1014018B
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery ransomware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4308	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134216391261195720"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1240	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
640	chrome.exe
640	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3396	chrome.exe
Token: SeCreatePagefilePrivilege	3396	chrome.exe
Token: SeShutdownPrivilege	3396	chrome.exe
Token: SeCreatePagefilePrivilege	3396	chrome.exe
Token: SeShutdownPrivilege	3396	chrome.exe
Token: SeCreatePagefilePrivilege	3396	chrome.exe
Token: SeShutdownPrivilege	3396	chrome.exe
Token: SeCreatePagefilePrivilege	3396	chrome.exe
Token: SeShutdownPrivilege	3396	chrome.exe
Token: SeCreatePagefilePrivilege	3396	chrome.exe
Token: SeShutdownPrivilege	3396	chrome.exe
Token: SeCreatePagefilePrivilege	3396	chrome.exe
Token: SeShutdownPrivilege	3396	chrome.exe
Token: SeCreatePagefilePrivilege	3396	chrome.exe
Token: SeShutdownPrivilege	3396	chrome.exe
Token: SeCreatePagefilePrivilege	3396	chrome.exe
Token: SeShutdownPrivilege	3396	chrome.exe
Token: SeCreatePagefilePrivilege	3396	chrome.exe
Token: SeShutdownPrivilege	3396	chrome.exe
Token: SeCreatePagefilePrivilege	3396	chrome.exe
Token: SeShutdownPrivilege	3396	chrome.exe
Token: SeCreatePagefilePrivilege	3396	chrome.exe
Token: SeShutdownPrivilege	3396	chrome.exe
Token: SeCreatePagefilePrivilege	3396	chrome.exe
Token: SeShutdownPrivilege	3396	chrome.exe
Token: SeCreatePagefilePrivilege	3396	chrome.exe
Token: SeShutdownPrivilege	3396	chrome.exe
Token: SeCreatePagefilePrivilege	3396	chrome.exe
Token: SeShutdownPrivilege	3396	chrome.exe
Token: SeCreatePagefilePrivilege	3396	chrome.exe
Token: SeShutdownPrivilege	3396	chrome.exe
Token: SeCreatePagefilePrivilege	3396	chrome.exe
Token: SeShutdownPrivilege	3396	chrome.exe
Token: SeCreatePagefilePrivilege	3396	chrome.exe
Token: SeShutdownPrivilege	3396	chrome.exe
Token: SeCreatePagefilePrivilege	3396	chrome.exe
Token: SeShutdownPrivilege	3396	chrome.exe
Token: SeCreatePagefilePrivilege	3396	chrome.exe
Token: SeShutdownPrivilege	3396	chrome.exe
Token: SeCreatePagefilePrivilege	3396	chrome.exe
Token: SeShutdownPrivilege	3396	chrome.exe
Token: SeCreatePagefilePrivilege	3396	chrome.exe
Token: SeShutdownPrivilege	3396	chrome.exe
Token: SeCreatePagefilePrivilege	3396	chrome.exe
Token: SeShutdownPrivilege	3396	chrome.exe
Token: SeCreatePagefilePrivilege	3396	chrome.exe
Token: SeShutdownPrivilege	3396	chrome.exe
Token: SeCreatePagefilePrivilege	3396	chrome.exe
Token: SeShutdownPrivilege	3396	chrome.exe
Token: SeCreatePagefilePrivilege	3396	chrome.exe
Token: SeShutdownPrivilege	3396	chrome.exe
Token: SeCreatePagefilePrivilege	3396	chrome.exe
Token: SeShutdownPrivilege	3396	chrome.exe
Token: SeCreatePagefilePrivilege	3396	chrome.exe
Token: SeShutdownPrivilege	3396	chrome.exe
Token: SeCreatePagefilePrivilege	3396	chrome.exe
Token: SeShutdownPrivilege	3396	chrome.exe
Token: SeCreatePagefilePrivilege	3396	chrome.exe
Token: SeShutdownPrivilege	3396	chrome.exe
Token: SeCreatePagefilePrivilege	3396	chrome.exe
Token: SeShutdownPrivilege	3396	chrome.exe
Token: SeCreatePagefilePrivilege	3396	chrome.exe
Token: SeShutdownPrivilege	3396	chrome.exe
Token: SeCreatePagefilePrivilege	3396	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 3396 wrote to memory of 4892	3396	chrome.exe	87
PID 3396 wrote to memory of 3480	3396	chrome.exe	88
PID 3396 wrote to memory of 4308	3396	chrome.exe	89
PID 3396 wrote to memory of 3480	3396	chrome.exe	88
PID 3396 wrote to memory of 1524	3396	chrome.exe	91
PID 3396 wrote to memory of 1524	3396	chrome.exe	91
PID 3396 wrote to memory of 4472	3396	chrome.exe	93
PID 3396 wrote to memory of 4948	3396	chrome.exe	92
PID 3396 wrote to memory of 4472	3396	chrome.exe	93
PID 3396 wrote to memory of 4948	3396	chrome.exe	92
PID 3396 wrote to memory of 4284	3396	chrome.exe	94
PID 3396 wrote to memory of 4284	3396	chrome.exe	94
PID 3396 wrote to memory of 2832	3396	chrome.exe	95
PID 3396 wrote to memory of 2832	3396	chrome.exe	95
PID 3396 wrote to memory of 4156	3396	chrome.exe	96
PID 3396 wrote to memory of 3048	3396	chrome.exe	99
PID 3396 wrote to memory of 3048	3396	chrome.exe	99
PID 3396 wrote to memory of 3960	3396	chrome.exe	100
PID 3396 wrote to memory of 3960	3396	chrome.exe	100
PID 3396 wrote to memory of 956	3396	chrome.exe	101
PID 3396 wrote to memory of 956	3396	chrome.exe	101
PID 3396 wrote to memory of 4040	3396	chrome.exe	102
PID 3396 wrote to memory of 4040	3396	chrome.exe	102
PID 3396 wrote to memory of 2488	3396	chrome.exe	110
PID 3396 wrote to memory of 1984	3396	chrome.exe	111
PID 3396 wrote to memory of 1516	3396	chrome.exe	112
PID 3396 wrote to memory of 640	3396	chrome.exe	114

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\envio.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:1240

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffb4439c728,0x7ffb4439c734,0x7ffb4439c740
  2⤵
  PID:4892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,7261592139668865773,8318744097189682242,262144 --field-trial-handle=2016,i,13119653090229063996,9186163068834857184,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2000 /prefetch:2
  2⤵
  PID:3480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=1616,i,12243281909917138311,839625175914600021,524288 --field-trial-handle=2016,i,13119653090229063996,9186163068834857184,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=2212,i,12269387758022880132,12970603928373040902,524288 --field-trial-handle=2016,i,13119653090229063996,9186163068834857184,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2600 /prefetch:8
  2⤵
  PID:1524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3284,i,2805207247857319264,14789715826647134262,2097152 --field-trial-handle=2016,i,13119653090229063996,9186163068834857184,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3116,i,5097056835911011096,16316598977051081048,2097152 --field-trial-handle=2016,i,13119653090229063996,9186163068834857184,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4488,i,13140088628584667382,16589770979140832561,2097152 --field-trial-handle=2016,i,13119653090229063996,9186163068834857184,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4456 /prefetch:2
  2⤵
  PID:4284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4788,i,3835764984635115532,11286895347895659864,2097152 --field-trial-handle=2016,i,13119653090229063996,9186163068834857184,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:2832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=5548,i,12392110171421454810,10397812212532960330,524288 --field-trial-handle=2016,i,13119653090229063996,9186163068834857184,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  PID:4156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3828,i,12214148110682505331,12598640864823274866,2097152 --field-trial-handle=2016,i,13119653090229063996,9186163068834857184,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:3048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3332,i,15919523642074141400,9289871960253551236,2097152 --field-trial-handle=2016,i,13119653090229063996,9186163068834857184,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:3960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5912,i,969736760243731650,16164376345307475392,2097152 --field-trial-handle=2016,i,13119653090229063996,9186163068834857184,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5860,i,15837230557695564453,9978626432683814063,2097152 --field-trial-handle=2016,i,13119653090229063996,9186163068834857184,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=4712,i,6621484760887256012,3721143096584021379,524288 --field-trial-handle=2016,i,13119653090229063996,9186163068834857184,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3300 /prefetch:8
  2⤵
  PID:2488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=4776,i,9769916671665180593,1086047199779729605,524288 --field-trial-handle=2016,i,13119653090229063996,9186163068834857184,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:1984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=4904,i,3501051274247096804,6587907376377641635,524288 --field-trial-handle=2016,i,13119653090229063996,9186163068834857184,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5780 /prefetch:8
  2⤵
  PID:1516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4456,i,13217663365545101851,7436710239992759983,262144 --field-trial-handle=2016,i,13119653090229063996,9186163068834857184,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=864 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:640

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2600

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 209de9e7a4268dd4b289920b558e4406719434ca77c9f13b46c08ad2d662de24
MD5 ad822ff9d3a809b6811ebea30cba7c6d
SHA1 9acd14170c673e0b8b2953487f0510aac6c335cc
SHA512 d96b15b9f7e7a0fe5f7566d9253110d0a8e63414c0ece8ce2ec8193749599b92de6c83ec8a6dd3fea214cd107840ee489c02dbb70c7d68312e5dc53bb8f73275
TLSH
T14DE02BAAC925AC2B0AFD171960855349EB45135B1751554F7A3C520C8FB063A5196C2C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 552B
SHA256 bc9ace8c7687eb4e1738404b1ecec5c3c420cdb968ba95465e11fdc3edfc257b
MD5 ea68bba03b0831191c9a2988837a5f2c
SHA1 d19fff65a003638f9b073cb3c01eabe92446e964
SHA512 b9ff6ef4c0aac9fec4b14a8ea4259139c40dbe3475cd56d2edfdd5ad8191ae60d7d4687584e92f54d1fef6fd52c5c2c1fc6eec3cb33bc71a24b7747f99c507c0
TLSH
T124F055C15E8DD024DB33067164EA8F713574383684BB0FEA93C441BD26936E25E58521
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 ebc6665490335404b29ddfb67638d2cc928e2fc6e3280286e7ad9b13e574279e
MD5 3100fd597d9a3905e476eca1a6477742
SHA1 c9975a80b3beb6966e4ddbed393911da3e08c2aa
SHA512 2dbc68a5560a0ca3513513624e299c488b2f1221ec6675659bdc94499ced51e2654816657eb4f93c716ddf2f02b60530cfcb8a65cd8dc3632ffa9d5d33fb07ed
SSDEEP 192:DuLeRemeDeeJe5eAevuaIauKxXeGeVeoe5efeSereCeFeMeqqeCBe5eOQeOVTeOD:DuLeRemeDeGe5eAevuaIauKxXeGeVeoU
TLSH
T16602C0F7C3E8892D881292F1A6286E1FCE6D0924831C7D668CE89F4B57E5471D341B5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 485e7071918138de239ab75c502611625ccd60b7320cb0e567cbbf8830f0e655
MD5 187dae5bc39adadeaf76517e03ce5162
SHA1 348e42f4790e4c1eed43e977e5fe11534533207a
SHA512 b94fe7a93a4c508f7aee241e582d23e58387989dc43b43d3c92ae6b17e352920692d249dd4476843d1780cdc35d5e6b12d11a626c63f62754c9a0fbcf3bf0c5e
SSDEEP 192:vR1xyAs4TH7v7rpAPRp2Cy9+Hsb+WNnP3hboeBAWTakgvK9VyIsnAUgvQaJ:vR1x/3DfUXCEwPGehaIvN
TLSH
T1DF52F92EA914697B9CC7C22EF9117B57D7F1203571902E84EAFCCA2C24E75CD222742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 9b52d8ddc7a882be79167b0ab25d26da610a34738bc1e2f3bd5c3058683b195e
MD5 9afb7e6507463a598d853cc071c2a99a
SHA1 78f01336d989ece2e326147ea400bdd7f55ec047
SHA512 82717da06c3ecf32565d902292d85d2b669f96a24ac0b690b16b9da7ff6f6af5231d6d7c54b1f38055503fca9663256e7e66f744e9cd49445926c4015237489a
SSDEEP 192:vR1xnnTbTH4v7rpAPRp2Cy9+Hsb+WNnP3hIX26AWTakgvKjVyIsnAUgtaJ:vR1xTPkfUXCEwPa2maO8
TLSH
T1A442E81EB914A97B9CDBD22EF9117657D7F1203571902E88EAFCCA2C24D35CD222742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 4c5dbe3f3071c1cdd70e39a99dd2a8e7a0233b08f2fef9e58bef03d6b9f0f954
MD5 eaf45e095eaf8d2e1b455626d5895959
SHA1 23bbb40f8390c77932f41805e60e5023c08cbcfb
SHA512 92ecc61b66421f057e483c277097699444f9b664b973b2ed4406a72d4c026914714c5b5c5496330675ccc8e112b23772dfe4e83882fbc0b2de5ba584e72837e6
SSDEEP 384:Wcji97KxkXqKf/pUZNCgVLH2HfgslE27pLuLcifU1XODid+ErU3+NHGSdTFO:Wwi97KxkXqKf/pUZNCgVLH2Hfgs227pA
TLSH
T1EB72F8676C0C9E3B4F98C68CD9267F4FACB5014B65EA885493FA982903D5BCB11061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 4749d1431ed44f5907df4929cc6ac32b9bd274fe7f76feb285e7d2254c2679bc
MD5 eb2e86aeed6bc1bed7de1703cb6ed056
SHA1 9a98cd504ef58b22b81c94bfe61e0e988457f57d
SHA512 d7af3e0775be3ed6863a872c885a30ed2b5ba9640c716296f7952358beb6a7beeddce9d7d46ce276db3bd0b8ed0a32827efa782674aae1d5a1b449a8c493ccc5
TLSH
T14CB01251C4019901C04303F41582449836ACAF308B0A1341E3E0697298269A08116190
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587d97.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe587d97.TMP
Size 96B
SHA256 9def721c847549e5fac9484cb044de306d512d59a763e2e4ac120ea3159148d4
MD5 38b17e717ba6da6f1297c4af874e372a
SHA1 aa102361c64cdec3887a0431e9e2d31fda4f9682
SHA512 9a27f3ed39f582bd49878cdf2dfb208e1d766a12c8d3cd435d0c2c09eaa60e16ba7bcc5f963689dc9a7094e4e2a36e604eee1e635ad1870d46a576196cfcc427
TLSH
T11DB02282C002E203C08303F828A2A0ECB020EF20C203020A82F00A23CC202308030020
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 195KB
SHA256 29e5699dd70de7c7a2315b5a1b281ebf48830c26b86420031f8dbc7bdee2504e
MD5 a0dc0c98f8cc7782059a41e7b4048dfd
SHA1 8d015b7eb91011a9375324a9e138f24ebd7b97c6
SHA512 174590c1253ac5e7e44d17f32ffc3605a7b9428d58026b2dc349c775ce69ae0a7a1d8b45b75b5f617bf2a822924bb0e9ada4ea0c8cf51d5295d9162e26868e7f
SSDEEP 6144:0Rqe7NvoXMZjC+a+lAFqBMQdrOk0HOGm/SFyEE7:0YY8GjC+28MQdrOjuGdF27
TLSH
T1331423B7DF2409EB692D9E767176B40E8C0289E9315B7C4C91AC270932CC5C53F76EA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 195KB
SHA256 769fdc0793d09da9b16e427c9ecfe029771ef7402b1abcc8c171df2dcc998574
MD5 ba35137ef3455495823ce9aa36c677a3
SHA1 4f4c8a8514b18aed7573960c00e3b8fa4c18fee9
SHA512 c89e493d008d97e3c88f160d57d3e12577fc05a724e03b008874220fa0f1f4517d33941602b8610371c0b74e68e89e4a7f9bb9ab6807caeede2515d50975bd53
SSDEEP 6144:/Rqe7NvoXMZjC+a+lAFqBMQdrOk0HOGm/SFyEE7:/YY8GjC+28MQdrOjuGdF27
TLSH
T1171423B7DF2409EB6A2D9E767176B40E8C0289E9315B7C4C91AC270932CC5C53B76EA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 196KB
SHA256 8f44d99c5532399aec27c204195e8ed634f618fe6bbd40a93144edf9fe4d5689
MD5 95643eee14b4537723263ac010061449
SHA1 28b39ea9303ad5fd78adb095d36e50c8a4f29a36
SHA512 ad71fc08303e14f5863370cece61c385bf3821d2f0702410dca716939ea12fb1459f5a9174be4d0c302a749ac3d041dad9b7ab14beb781f675b7c8098f6bd15d
SSDEEP 6144:07Rqe7NvoXMZjC+a+lAFqBMQdrOk0HOGm/SFyEE7:aYY8GjC+28MQdrOjuGdF27
TLSH
T1F41412B39F2409EB6A2D5EB67176B40E8C0289EB315A7C4C916C2B0931CC5853F76EB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 eddd9c6b33213960306f4106f023fc4b70a632d5e6ac172578b18d9fe7a4cbcd
MD5 54459963cc60e2db394c94645b07e0bc
SHA1 6fe458cf06367ad367c105f949c4226204977b7a
SHA512 b4e492a9ff1b5336a5849ef54f848b81b0e48fcc9bc2be4a3a6573657c3a366dfff77ce7f42ffc9ea4f57ff223529d88df6381e3388dcb94bec83814d7303668
SSDEEP 1536:jVpcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEm:xp3Qw/xLANk0mUW5GmRntSFCjEENQ
TLSH
T1069302BA5E174AE7957D4A9176AA7808CE12630D70AFA8CC319C638C21D01C92F73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download