7dca991089c6e59859ef1e2ee86c4d520a5ed7b2298aa4aa02bd8b718d2e1578

Analysis

user interaction
yes
max time kernel
146s
max time network
144s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
26/04/2026, 01:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
envio.txt
Size 258B
Sample260426-bfhdhsdw4n
SHA256 7dca991089c6e59859ef1e2ee86c4d520a5ed7b2298aa4aa02bd8b718d2e1578
MD5 87d06a63fef1a2d246c7627f3afe8139
SHA1 a27c52e5a5f1d4a0714ab2818e4fb483190d2e8b
SHA512 76e41dae2cd3870cc07d9c3862181f20766cf093e64159889d0c4e7d8ebfcc81d5def7d9f4d87ce1a1ad4e8cdca0e08d159580fcee5e51ea432a921051724101
TLSH
T19AD02BE7280310C15A98198430B901D988279C586C4172A1974613B28A781B1014018B
MD5 SHA1 SHA512 TLSH

Score

4^/10

discovery ransomware

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3832	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134216391529192506"	chrome.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings	chrome.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\YDRAY-ryujinx-canary-1.3.269-win_x64-20260421T111826Z-3-001.zip:Zone.Identifier	chrome.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2128	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4340 wrote to memory of 2128	4340	cmd.exe	81
PID 2416 wrote to memory of 4980	2416	chrome.exe	83
PID 2416 wrote to memory of 4612	2416	chrome.exe	84
PID 2416 wrote to memory of 4612	2416	chrome.exe	84
PID 2416 wrote to memory of 3832	2416	chrome.exe	85
PID 2416 wrote to memory of 2984	2416	chrome.exe	86
PID 2416 wrote to memory of 2984	2416	chrome.exe	86
PID 2416 wrote to memory of 3128	2416	chrome.exe	87
PID 2416 wrote to memory of 3128	2416	chrome.exe	87
PID 2416 wrote to memory of 780	2416	chrome.exe	88
PID 2416 wrote to memory of 780	2416	chrome.exe	88
PID 2416 wrote to memory of 3084	2416	chrome.exe	89
PID 2416 wrote to memory of 3084	2416	chrome.exe	89
PID 2416 wrote to memory of 2968	2416	chrome.exe	92
PID 2416 wrote to memory of 2968	2416	chrome.exe	92
PID 2416 wrote to memory of 4152	2416	chrome.exe	93
PID 2416 wrote to memory of 1212	2416	chrome.exe	95
PID 2416 wrote to memory of 1212	2416	chrome.exe	95
PID 2416 wrote to memory of 3184	2416	chrome.exe	96
PID 2416 wrote to memory of 3184	2416	chrome.exe	96
PID 2416 wrote to memory of 2780	2416	chrome.exe	97
PID 2416 wrote to memory of 2780	2416	chrome.exe	97
PID 2416 wrote to memory of 3108	2416	chrome.exe	98
PID 2416 wrote to memory of 3108	2416	chrome.exe	98
PID 2416 wrote to memory of 1144	2416	chrome.exe	99
PID 2416 wrote to memory of 1144	2416	chrome.exe	99
PID 2416 wrote to memory of 2056	2416	chrome.exe	100
PID 2416 wrote to memory of 2056	2416	chrome.exe	100
PID 2416 wrote to memory of 4024	2416	chrome.exe	101
PID 2416 wrote to memory of 3400	2416	chrome.exe	102
PID 2416 wrote to memory of 3400	2416	chrome.exe	102
PID 2416 wrote to memory of 3640	2416	chrome.exe	103
PID 2416 wrote to memory of 3640	2416	chrome.exe	103
PID 2416 wrote to memory of 2004	2416	chrome.exe	105
PID 2416 wrote to memory of 1648	2416	chrome.exe	106
PID 2416 wrote to memory of 3272	2416	chrome.exe	107

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\envio.txt
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4340
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\envio.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2128

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffb8af8c728,0x7ffb8af8c734,0x7ffb8af8c740
  2⤵
  PID:4980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1692,i,7765217984976789798,4003070409029180091,262144 --field-trial-handle=1952,i,14847644894085772114,7200474044549221018,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1940 /prefetch:2
  2⤵
  PID:4612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2276,i,1648691178313850039,15459481653126648238,524288 --field-trial-handle=1952,i,14847644894085772114,7200474044549221018,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2280 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2396,i,12044986274880135005,6218950955447990185,524288 --field-trial-handle=1952,i,14847644894085772114,7200474044549221018,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2408 /prefetch:13
  2⤵
  PID:2984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3264,i,3538157117128841881,15796589606114136842,2097152 --field-trial-handle=1952,i,14847644894085772114,7200474044549221018,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3320,i,11162748475726859051,7922112447966623008,2097152 --field-trial-handle=1952,i,14847644894085772114,7200474044549221018,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4244,i,7311219452462844170,17761069883323579087,2097152 --field-trial-handle=1952,i,14847644894085772114,7200474044549221018,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4268 /prefetch:9
  2⤵
  PID:3084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4588,i,4662124278279485898,11785508720499470267,2097152 --field-trial-handle=1952,i,14847644894085772114,7200474044549221018,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4680 /prefetch:1
  2⤵
  PID:2968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5444,i,7538730356977590410,16739223791148179065,524288 --field-trial-handle=1952,i,14847644894085772114,7200474044549221018,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5448 /prefetch:14
  2⤵
  PID:4152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5668,i,17249997601857728046,11293969488588604889,2097152 --field-trial-handle=1952,i,14847644894085772114,7200474044549221018,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:1212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3692,i,17539927240770761588,1208294937919292082,2097152 --field-trial-handle=1952,i,14847644894085772114,7200474044549221018,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3660 /prefetch:1
  2⤵
  PID:3184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5760,i,14612208556780950097,8536971000543821215,2097152 --field-trial-handle=1952,i,14847644894085772114,7200474044549221018,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4540 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5748,i,10908755774989831076,15538658366748772843,2097152 --field-trial-handle=1952,i,14847644894085772114,7200474044549221018,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3720,i,18438492391243570748,16230057177534552177,2097152 --field-trial-handle=1952,i,14847644894085772114,7200474044549221018,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4548 /prefetch:1
  2⤵
  PID:1144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5960,i,11885195552242028482,12836766286718406024,2097152 --field-trial-handle=1952,i,14847644894085772114,7200474044549221018,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:2056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6320,i,6697767649471830480,6760215028204339333,524288 --field-trial-handle=1952,i,14847644894085772114,7200474044549221018,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6292 /prefetch:14
  2⤵
  - NTFS ADS
  PID:4024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6228,i,6686564358442768401,1603841386071288603,2097152 --field-trial-handle=1952,i,14847644894085772114,7200474044549221018,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6412 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6568,i,4526754078451167936,12324479917513302779,2097152 --field-trial-handle=1952,i,14847644894085772114,7200474044549221018,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6544 /prefetch:1
  2⤵
  PID:3640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6932,i,2236813512739763792,7034164403157621226,524288 --field-trial-handle=1952,i,14847644894085772114,7200474044549221018,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6936 /prefetch:14
  2⤵
  PID:2004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6888,i,12852954531603036027,5043176603883389978,524288 --field-trial-handle=1952,i,14847644894085772114,7200474044549221018,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6952 /prefetch:14
  2⤵
  PID:1648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6940,i,11509464168896843704,15770212195971187753,524288 --field-trial-handle=1952,i,14847644894085772114,7200474044549221018,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6960 /prefetch:14
  2⤵
  PID:3272

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4184

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4396

C:\Users\Admin\Downloads\YDRAY-ryujinx-canary-1.3.269-win_x64-20260421T111826Z-3-001\ryujinx-canary-1.3.269-win_x64-20260421T111826Z-3-001\ryujinx-canary-1.3.269-win_x64\publish\Ryujinx.exe
"C:\Users\Admin\Downloads\YDRAY-ryujinx-canary-1.3.269-win_x64-20260421T111826Z-3-001\ryujinx-canary-1.3.269-win_x64-20260421T111826Z-3-001\ryujinx-canary-1.3.269-win_x64\publish\Ryujinx.exe"
1⤵
PID:1736

C:\Users\Admin\Downloads\YDRAY-ryujinx-canary-1.3.269-win_x64-20260421T111826Z-3-001\ryujinx-canary-1.3.269-win_x64-20260421T111826Z-3-001\ryujinx-canary-1.3.269-win_x64\publish\Ryujinx.exe
"C:\Users\Admin\Downloads\YDRAY-ryujinx-canary-1.3.269-win_x64-20260421T111826Z-3-001\ryujinx-canary-1.3.269-win_x64-20260421T111826Z-3-001\ryujinx-canary-1.3.269-win_x64\publish\Ryujinx.exe"
1⤵
PID:4628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 7c8a995aa1790ba85f7e1bd0218f074813add55cb9c587b6f3bc2f6ed018d95c
MD5 d98b6b30f3d1a27022d0a74011ae1d0a
SHA1 e74b376fbc40006ed3e48dbfaaa7c1ad17b6a664
SHA512 b26adf6cba2914ad1126415fc65d821c00266e15c16a83df1038377a3ba20e581fac8a25c529a42ed9b715d3fcf3168ac103b851d7545fd8ee99b769e5d81c3b
TLSH
T1DBE02BABCC119D270CFD1B187458868BF740236B2741485F7A3E420C4FB1637054586C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 864B
SHA256 9b64f07029f7b2a47df6c1f99a3e4e34140ecd8664b98c2c379e0857cf0fd6e5
MD5 823253d8c0d8290d50cf41d09250cfd1
SHA1 9de998a7f0cf69f195adeadfd5f5b257d127580b
SHA512 43e4b529921c0d7168897090927ef58b8029565f9c89a97769e53357023ba4d0f71c42eb94d798fbeaadf944cb86a0a88e50eec3719b3b8a7a0cdae5740a3177
TLSH
T12B11262D4789E011FF634170F4A81F76F52615F948871B1F43F125BE69D2AD93451C12
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 87dfb9b2afcffa54daeb99e74994ed34a5fed069a544e61520466e64f5f9b65b
MD5 7e8feb8d32b61cf8448b0c5e54638447
SHA1 59c62d5b8fd14c933061e7e9cc3364aee7439543
SHA512 6ba64a25b185217cafb86dc6c68f6d81f0de2b49ba378f776861574a6fbc3b752d8432334ab5b08cfdbaecbed85216c842db421722d83ff6c69313f7f3a9d0b2
SSDEEP 192:Dt6eXe8JeAezeeFepeVeIeQJeXSBaIajaeTeAeze8eY/eqwe3HeveQeteCzexeOW:Dt6eXeYeAezeeFepeVeIeceXSBaIajab
TLSH
T1C12280F3C3E8896DC41252F1AA286E1FCE6E0924831C7D6989E8AF4B53E5471D341B5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 73b6b5ae573aa39fc240880164a49673c2674d10a17cb17dd789ad9025d2b6fa
MD5 eb3e8ad726e69857476b3913c28b777d
SHA1 babc07ea13bdc4e3fabac640d7adfc31b73fd63f
SHA512 bfa2b9ff25141d641ab2b6752965d5f814303759c073121616045cd9ed1280649f19e89247903e638b6aaf019788b56c8e92b130186273212fe9bf354d46623b
SSDEEP 192:GRcxfmZVnv7swmPRpQK29AHsb+WNna424W2nSqKMkwUaJjVyIsnAUgvQaJ:GRcxgvgHXw2wB02510aJFvN
TLSH
T11A52F62EBC14297B5CD7C61AFD25BB97E3F5203561902E88EAFC8A1C24D75CC622B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 2212ed39112f71ef91cafb2eb1b8722037c36347631a1ef980a864fcded84825
MD5 b2895ac17069a663d6b7e0acd07952e3
SHA1 40141f72f58f82785758eadf3c94fa1289f5cf2f
SHA512 7e51c6d36d2eb2699426a1db52c2d755c523fb73a437ffb04ca1f85816918411a383450857f963944ffb5808fa08a7000f0077ece2a3be0666e2eda416afe34c
SSDEEP 192:IRPdymZVnv7spAPRp2K29AHsb+WNn8yh4W2dSqKMkwUaJjVyIsnAUg5QaJ:IRPdlvgUXe2wRT2710aJF5N
TLSH
T1AD42062EBD24293B5CD7C21AFD25779BE3F5202561942E88EAFCCA1C24D75CC622B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 66bf3cd15850be6900b8782a0bc3e759460cee929c949ea47e474e319a218635
MD5 f338082af4f901651977ea70fab6b7cd
SHA1 10be87ab217b699dd1838bf782742695a43fc732
SHA512 9afc624ab4cd015372061e67bce9f28c462e78750d9a00480c179912ab226085dfb133f2c669d692cc8c4c6cb2ec1068a50118eb5a6b0c58d7589b2fc4974ab0
SSDEEP 192:GRPxfmZVnv7swmPRpQK29AHsb+WNna424W2nSqKMkwUaJjVyIsnAUgvQaJ:GRPxgvgHXw2wB02510aJFvN
TLSH
T16B52F62EBC14297B5CD7C61AFD25BB97E3F5203561902E88EAFC8A1C24D75CC622B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ada3a53f4971ca0351f4c4e99395802897bcc90983414a8f3090992f4880f5db
MD5 2c8ebe4a5b9beabc030111b2500dbd39
SHA1 4a7987b5003294c387b86bec21cb661a890e0285
SHA512 b6de2d8d51b6e91826f019732f1f3aed6ff3865d37bcd5f97d865d39c1dc837fe8f5f705f7919b648921cbf5575147e57b958605805ac5b35c32327d0d80164f
SSDEEP 192:GRPxymZVnv7swAPRp2K29AHsb+WNna424W27SqKMkwUaJjVyIsnAUg5QaJ:GRPxlvgBXe2wB02d10aJF5N
TLSH
T11752072EBD14293B5CD7C21AFD25779BE3F5202561942E88EAFCCA1C24D75CC622B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 5ab444414a02d4891c7cbb4db3735bec720facb3265bdedc915a68f6beef1cd9
MD5 191a425abbe14997e55d6c34d96395de
SHA1 567b4a799716eb9b3db36abe7163a0aaec1148fd
SHA512 d0c7f690ea61add197a2dbd706250b5de93bf454a11e6e82e25faa2759a36b7158f1e02247d411bcd65234e3d4eb5605c539a97b277b15db18786f9fbc17ab4a
SSDEEP 384:UujAr7KxkXqKf/pUZNCgVLH2Hfgsl+m7pLuLcifmnXODAH+ErU3xWHGWmvhxVtfC:UeAr7KxkXqKf/pUZNCgVLH2Hfgsgm7p/
TLSH
T15D720A677C4C9E770F94CACCD8167A4FADF6024B65E9889583FA982903C5ACF11061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 2a62ad1523616aae540e285f60235c7128f664b84b8870adb6ac797a40ef5e80
MD5 a790f6b94914da7e9015afe6185294bd
SHA1 63b1674793a450ada966764d3478a7a9508606cc
SHA512 cc034832853bd540c993f96727c5b43a02c543fa66b3d1e7ee5d26e7d8b1ef967c0e90c37fae97887a11ae324b35ca80439821ad9688adbd97985ed33c652d33
TLSH
T1AAB01260C0019501C41303F8158644993124DF21C709230153E06A72A82F190C064161
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d55c.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58d55c.TMP
Size 96B
SHA256 435c418401a6b77656caa30758968d7cbc456a0d05e7e9d1cd9575cfac6c8680
MD5 5d36f72a6fff1f8f32216070d5c019f5
SHA1 500b5636046807ad8d54fd8fb42bf6968685a9db
SHA512 31b54c809dd9fe55eb8ba03f6b3b8f3d8092965d4df57b76d360034bac24a42e566c8d3f6c1ef13148b18bbf681acdd56a02de309ba0b23dfc8a3247ff4b7ad6
TLSH
T1EEB0220AC202A202C00303B02EF0C2ECF220CF20C20F2323C3E20BB3CC222200220030
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 196KB
SHA256 547aa2ec06a493f3839a068fd13090721894f2eb3d1af1b51d1cf00bf32ce267
MD5 c9932f4979689469c1ab6bf1b10eacc8
SHA1 9817e8a2e95acc587b34fc15d48c6300158c58bd
SHA512 9a149e0b4a1b334afc22bc0424f61025dd34493120eb8fedff7eeeb4ec81e1e31d8d63925e5c772e4d4f248e8063a9c82100a5ab811efb71a47fc5459e2c38ea
SSDEEP 6144:9tRqe7NvoXMZjC+a+lAFqBMQ/++JjcMW2VcVLlJ:9tYY8GjC+28MQBOMWjJ
TLSH
T19F1413B79F282D7A274DDB769033AC9D4CC3CCED2110686C51DA2F0A25DCB82266E8D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 e9547dbe01f555c53bc6c7a970cb3f67ee35685646916ee13fdfaa8a5de18866
MD5 39e01245c55c5727bb39a0df2bb0a1e3
SHA1 13eff7e7eab3e3b734f0e2af92676ca704dda27a
SHA512 128718ecde69f51ef0635b8a29adea89ba68e046a72258604905e4166d548796e2cbdbb5ea362eddc4ade14b6e6ac86f487330988b9b81679b6378f911b2580d
SSDEEP 1536:4L5P++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNxZ:gB++J3qUQm08KMWF0bFTcVHr6zgZ
TLSH
T17D9302B9991E7D79636ED396A0079CAC8CD3DCCE1510657C30C76F0E14BA3A2A31B8A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 196KB
SHA256 fbfd5b22a741ea7efba9671da77b5a137fae42bac4b9a3537a664712dbbc3768
MD5 589a54523982595b6464dcf22fe51e76
SHA1 c3050a32cde90ac1b28efec197b3d7b22ed0de41
SHA512 843a1820c33dc343d2e597156c95c4cd1c2720c60ca4f1a956972edb09c1cbaa4d633e0f400e1cc5da099e02ed175b390d322bbc751c298ada62fc0e419d15c5
SSDEEP 6144:9kRqe7NvoXMZjC+a+lAFqBMQ/++JjcMW2VcVLlJ:9kYY8GjC+28MQBOMWjJ
TLSH
T1A71413B79F282D7A274DDB769033AC9D4CC3CCED2110686C51DA2F0A25DCB82266E8D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 197KB
SHA256 f4d2110e53cdebf60c9dced469ec64b9fe5c6ca255d46dd2f0cbf954fc7667cb
MD5 1953c9c770ec92b1f3ee7ee459c3db44
SHA1 489ae13942e5b7e31f5e0446f79f6e65d4a0f4da
SHA512 db87dbff47ec2ac2bebe44c09145f9502c5124f245fdd8785a53a4a63cf913e48c55200b0dfaf99146991247f31665db1fc831689c1c1b4f0be9af498ebf08f4
SSDEEP 6144:6TRqe7NvoXMZjC+a+lAFqBMQ/++JjcMW2VcVLlJ:6TYY8GjC+28MQBOMWjJ
TLSH
T1281413B7AB296C6E271EDB769023AC5D4CD3CCEF2114681C61992F0A259C682276F8D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 196KB
SHA256 ca190c502909b19b724fdfebd8fb909d1843a70b1e96aecfa83e4747caff90da
MD5 41c3423c04e6a4613f5b6c55dd7f29c3
SHA1 97473007eb8b9c98771e02e286d5e3a85c960135
SHA512 d5b0d33b2cee1fc9eba1ae2236f822be2533b1a2b5dfe6ee61040048299eb3a66e7c3e80a29f61e24a0fdfc9b29677f358750964780947ac9188c65a006bfda1
SSDEEP 6144:6tRqe7NvoXMZjC+a+lAFqBMQ/++JjcMW2VcVLlJ:6tYY8GjC+28MQBOMWjJ
TLSH
T1A61413B79F282D7A274DDB769033AC9D4CC3CCED2114686C51DA2F0A25DCB82276E8D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YDRAY-ryujinx-canary-1.3.269-win_x64-20260421T111826Z-3-001.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\YDRAY-ryujinx-canary-1.3.269-win_x64-20260421T111826Z-3-001.zip:Zone.Identifier
Size 843B
SHA256 31ae5693908c01987b50a8ef02fb8448ca0ab98c502b0bcaa885ec3a2f243506
MD5 07efbc5eafebdd479265c217cb2a441f
SHA1 9587f5404049d8328830783695b4da79f667d01e
SHA512 6bfcfe4989d06ffc51f142589949bcb31022f4e0c584433174a9014197cb2b2adc3af74d7b4cc63fa8989b8a556169049aeef9dcda1aba4744d1a729bc42faf5
TLSH
T1540152B320946045FE427AB968B884B8714EFAB46A983941D70118C32CBEBE8966B553
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1736-266-0x000001BD724A0000-0x000001BD72818000-memory.dmp

Download

memory/2128-238-0x000001B0E2850000-0x000001B0E2BC8000-memory.dmp

Download

memory/2128-0-0x000001B0E2850000-0x000001B0E2BC8000-memory.dmp

Download

memory/2128-308-0x000001B0E2850000-0x000001B0E2BC8000-memory.dmp

Download

memory/2128-309-0x000001B0E2850000-0x000001B0E2BC8000-memory.dmp

Download

memory/2128-2-0x000001B0E2850000-0x000001B0E2BC8000-memory.dmp

Download

memory/4396-207-0x0000021F4AD80000-0x0000021F4AE9E000-memory.dmp

Download

memory/4628-289-0x0000023EEC9F0000-0x0000023EECD68000-memory.dmp

Download