f95ad489dc539195ffc36f999708210109149bf169f18fe9358e6f9fdfaf9da3

Resubmissions

10/08/2026, 04:06

260810-epkf1sea343

10/08/2026, 03:58

260810-ejlrwsap2s3

Analysis

user interaction
yes
max time kernel
210s
max time network
211s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
payload.txt
Size 150B
Sample260810-ejlrwsap2s
SHA256 f95ad489dc539195ffc36f999708210109149bf169f18fe9358e6f9fdfaf9da3
MD5 69bf4e36d85c22989690b09cfc5dd56a
SHA1 49ffbd4d4396a045d73caa9ad38134a45852174c
SHA512 cf61809aa1da863a321b6245265c4fb270d1e1af1e330a7414df167d04dd385049e1ddfe407ed2388db5b246f8af25c7cfca964d8ad21ebe60580442c6bc35fa
TLSH
T10BC08C8D8DB0F03A44365486145D3008CA0B964A6EA2C12612AAA496C83783DDDB150F
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery ransomware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4428	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308079779313647"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5060	NOTEPAD.EXE

Script User-Agent 4 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc	stream
HTTP User-Agent header	49	https://api.jnkie.com/api/v1/luascripts/public/4ad6a2d2335968486879c1b1a2dcefc6937ea63c8acb88e703a1ec95a4a146ea/download	7
HTTP User-Agent header	49	https://api.jnkie.com/api/v1/luascripts/public/4ad6a2d2335968486879c1b1a2dcefc6937ea63c8acb88e703a1ec95a4a146ea/download	9
HTTP User-Agent header	49	https://api.jnkie.com/api/v1/luascripts/public/4ad6a2d2335968486879c1b1a2dcefc6937ea63c8acb88e703a1ec95a4a146ea/download	11
HTTP User-Agent header	49	https://api.jnkie.com/api/v1/luascripts/public/4ad6a2d2335968486879c1b1a2dcefc6937ea63c8acb88e703a1ec95a4a146ea/download	13

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
3532	chrome.exe
3532	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
5060	NOTEPAD.EXE
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 2108	5048	chrome.exe	91
PID 5048 wrote to memory of 5064	5048	chrome.exe	93
PID 5048 wrote to memory of 5064	5048	chrome.exe	93
PID 5048 wrote to memory of 4428	5048	chrome.exe	94
PID 5048 wrote to memory of 2748	5048	chrome.exe	95
PID 5048 wrote to memory of 2748	5048	chrome.exe	95
PID 5048 wrote to memory of 1048	5048	chrome.exe	97
PID 5048 wrote to memory of 1048	5048	chrome.exe	97
PID 5048 wrote to memory of 3120	5048	chrome.exe	98
PID 5048 wrote to memory of 3120	5048	chrome.exe	98
PID 5048 wrote to memory of 1988	5048	chrome.exe	99
PID 5048 wrote to memory of 1988	5048	chrome.exe	99
PID 5048 wrote to memory of 1736	5048	chrome.exe	100
PID 5048 wrote to memory of 1736	5048	chrome.exe	100
PID 5048 wrote to memory of 4732	5048	chrome.exe	101
PID 5048 wrote to memory of 4228	5048	chrome.exe	104
PID 5048 wrote to memory of 4228	5048	chrome.exe	104
PID 5048 wrote to memory of 4484	5048	chrome.exe	105
PID 5048 wrote to memory of 4484	5048	chrome.exe	105
PID 5048 wrote to memory of 1868	5048	chrome.exe	108
PID 5048 wrote to memory of 1676	5048	chrome.exe	109
PID 5048 wrote to memory of 4556	5048	chrome.exe	110
PID 5048 wrote to memory of 3532	5048	chrome.exe	111
PID 5048 wrote to memory of 4852	5048	chrome.exe	112
PID 5048 wrote to memory of 4852	5048	chrome.exe	112
PID 5048 wrote to memory of 4848	5048	chrome.exe	113
PID 5048 wrote to memory of 4848	5048	chrome.exe	113

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\payload.txt
1⤵
- Opens file in notepad (likely ransom note)
- Suspicious use of FindShellTrayWindow
PID:5060

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffa0483c728,0x7ffa0483c734,0x7ffa0483c740
  2⤵
  PID:2108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1776,i,3482476134092722608,9742529651714324596,262144 --field-trial-handle=2004,i,17793068525795608755,10966713139172667518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1980 /prefetch:2
  2⤵
  PID:5064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,6321721064481147368,9505949211261601739,524288 --field-trial-handle=2004,i,17793068525795608755,10966713139172667518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2380,i,4578454102638999273,17701986180641361686,524288 --field-trial-handle=2004,i,17793068525795608755,10966713139172667518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2392 /prefetch:8
  2⤵
  PID:2748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3276,i,16649405809667540890,6232780094389274686,2097152 --field-trial-handle=2004,i,17793068525795608755,10966713139172667518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:1048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3296,i,18141562143279358419,15323066212162795234,2097152 --field-trial-handle=2004,i,17793068525795608755,10966713139172667518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:3120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4476,i,12728594469912945513,11817919049996387003,2097152 --field-trial-handle=2004,i,17793068525795608755,10966713139172667518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4428 /prefetch:2
  2⤵
  PID:1988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4656,i,12168570235094077649,17691276828829828332,2097152 --field-trial-handle=2004,i,17793068525795608755,10966713139172667518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4644 /prefetch:1
  2⤵
  PID:1736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5544,i,14627703508626200842,3866451023824620975,524288 --field-trial-handle=2004,i,17793068525795608755,10966713139172667518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  PID:4732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5824,i,4378990355439873714,8376259322124703287,2097152 --field-trial-handle=2004,i,17793068525795608755,10966713139172667518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4684,i,5413713792674305647,2478667531530512227,2097152 --field-trial-handle=2004,i,17793068525795608755,10966713139172667518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4480,i,1854007374568612073,6592296572883926508,524288 --field-trial-handle=2004,i,17793068525795608755,10966713139172667518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3536 /prefetch:8
  2⤵
  PID:1868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4748,i,8001159638319359659,12011810320531313669,524288 --field-trial-handle=2004,i,17793068525795608755,10966713139172667518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3492 /prefetch:8
  2⤵
  PID:1676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4736,i,3672761852773777883,11449790974418456488,524288 --field-trial-handle=2004,i,17793068525795608755,10966713139172667518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2996 /prefetch:8
  2⤵
  PID:4556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5740,i,4859634940040405550,12930979899291340800,262144 --field-trial-handle=2004,i,17793068525795608755,10966713139172667518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3320 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3416,i,11653592440004457561,7200201215855808785,2097152 --field-trial-handle=2004,i,17793068525795608755,10966713139172667518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=1300,i,7468514294754858000,10518637227887827871,2097152 --field-trial-handle=2004,i,17793068525795608755,10966713139172667518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:4848

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 6dc4413c44afcc65977085e1435e98f4ce8270cb35746d9148531452b0b23c20
MD5 ba267538f0d3390c26cc8d4282ac6eaf
SHA1 62070ee86416b30d6d1cead52db69121543dbdce
SHA512 7112b48c1b7b4256a8f2b0c81bc6db0eb6b8152fbd8cfbb099d44701c5c81c66bb1a3cc391643a9f21ce5aca71ee6ef1320ae5a356bfae8d940e5719d740934d
TLSH
T189E02B69D821BC3708FE075850144B49EB58135B2A81550F3A3F5508CFF0A3641C6CAC
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ac3bd879b24ca192128ffb8ff9dd0d8737acb3d58ab601ca62727ee6514c158f
MD5 cdf007185126ba0e8d39f4c07ea6a948
SHA1 646b26cde302d6b2bf32fc95ccfbb516e34dd894
SHA512 8cebfa611d126f9122ab80b5db0ace7a9b61c2dc3cc2e7a04717e9f6a29f3932551a62979215340084c2b575bd2de532cedf85ba135a63dc37521ed2ae916b71
TLSH
T11D518BF7C3E8867D891192F4AB156F1FCE690914431C7C66C9D4AE1F93E6872D24064F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 5d1d0a1138e1556fa540aa6f179fb90952459c68329febc7c7451a55c386b9f6
MD5 cca640c744a703c3cf1525594830920f
SHA1 bedbafb26ec6a93d859d239f4c04c7bed78f1d5d
SHA512 56dc225b24df3137b563c7854949fb5505a4fe730194c76315da8f9dd9d113327b2836da3248e5cdccce090a0d49d29eeb6b9840b47ff354db254b8ce93656ff
TLSH
T1A1517AF7C3E8867D891152F4AB146F1FCE690A14531C7C66C9D4AE1F93E6872D20064E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 20f67b390c53d158953b0d687dbbc539819d979b493183a24360fa3b7941dba1
MD5 d947d739edb31f27fd3ba85c6b43ad41
SHA1 cf584c44491ad03f1555a57b6f5d568bf75d3bfe
SHA512 142d87b81313be8485bff8311d4e089b6c0d510c57eb809332d90a9c677c657a7d67528b7768bb8fbb3019fbb511dd51099bf3b7612cb1b3599aefe2a5b83610
SSDEEP 192:yR2Vtk9i2cv7spAPRp22339wHsb+WNn0LHyh284eBTaIVyIsnAUgtaJ:yR2V6pIYUX/nKwoY2Yas8
TLSH
T19342C62DF914693B5CDBD21AFA227B63D7F9102121842E54E6FC992C54D79CC222B42B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 2924484b7c66345924a0ebe3051dc663b8ae5445bd6128a7491627118e48166e
MD5 c365e8e090af93759122c8e4a0c30536
SHA1 3281108dd1d6a2589041dfba362c9174d0bafa2e
SHA512 8b12209ba7dd09bac240e7c934bfd48c6f58f8c7983350d9cabff1c61e5c38d022d738908cf7ad667bfeaf471f81c7f9a3065d1b6fb88803f035d08c96e2705c
SSDEEP 192:yR208Sotk9i2cv7spLPRpj2339wHsb+WNn0LH8DeQH4eBTajVyIsnAUgraJ:yR20a6pIYJXKnKwo0eQTaFe
TLSH
T1F962D72EB81869779CDAD229FA267F73D7F9102221842D54E6FC892C44E79DC3317427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 26e46a0de9d04bc4263f6d1293b4732118cbd29c831661c35f749c6d39af31e7
MD5 b001c63f854e7ce349d20d11f13f0b6b
SHA1 acbcf6fa85c2b1bdfd059894b6d2fed3b4d22160
SHA512 c0adaae39f9c0acf4e43ccbc3150a1bb12c658e3842f8013e704b074a02f8b27a1bc554e3d494bd905261913bca1f487a04e670084114e03a20e8312cf186946
SSDEEP 192:yR2zsQuhs8y9tk9i2Vv7spLPRpj2339wHsb+WNn0LH9KYhH4eBTajVyIsnAUgraJ:yR2WsT6plYJXKnKwoUYhTaFe
TLSH
T14C62E72EB81869775CDAD229FA267F73D7F9103222842E54E6FC992C44E79DC2317027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 4d297a540fd8b5e9abad354658ac18351eb262ae0f21f6402ccdd20a11faceb1
MD5 a469ac32ea06942973dfc5b2df453969
SHA1 2d6c15f232d9a63b99f7b53e2472e9b9b2a77b10
SHA512 2db8da8cb8e507f851de93cd77bb581d115404f9ad85107bb4c363b9d2c0ea7501e2f93ed6a2463b693993a18b871599b140af56e41a2699ab9fdf3e875378f0
SSDEEP 192:yR1Vtk9i2cv7spAPRp22339wHsb+WNn0LH8Deu4eBTaRVyIsnAUgraJ:yR1V6pIYUX/nKwo0eCa3e
TLSH
T1F652C72DF914697B5CDAD219FA227B63D7F9102121842E94E6FCC92C15E79CC232B427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 379d96542283773f422c052abe7293924621df1604b63c9a59676e1514d2db6c
MD5 d066f854d368cbebca026e5da297c2c3
SHA1 4f2f84d54b0a8dfd273bbdb70bcde51ad5e2f12f
SHA512 613285c6b38983d33fb336394c5eff7edb692f60dfa433defdbf45524dd1c84cadfc8cba744a39b1c75482b318f7db6eaaae9842cfa8649a9ad00cece8442e41
SSDEEP 384:gCjUH7KxkXqKf/pUZNCgVLH2HfgslsZ7pLuLcSjCDXODUr+ErU3/NHGcmyqOqjmo:gCUH7KxkXqKf/pUZNCgVLH2Hfgs+Z7pF
TLSH
T15A7209676C4C9E370F94C6CCD8267F4F9DB5024B65E9886483FA9C2903D5ACB114A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 4618f8f2bb89768443833e3a37fdb82ab8cebf9154aa72c6d29d76edff1bd12b
MD5 702d9b95f8cbda46193216acf7c9d52e
SHA1 8d4f35a7bfda35e56a653de35fda0b25a8cb764d
SHA512 79cea0a41db21b903b5d30dd0adb31eab06b2135621e68be6fff155247aa770c88f9f4cdacf81c5e954d809caf5b605a845709b2846a29e00a3ac0cc191a6436
TLSH
T143B0124080015101C08203F4168214CC73145F15960F170253E87E23C8351638015050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5901db.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5901db.TMP
Size 96B
SHA256 2f2d5386ddb1233e03e817fd6ab22c4e37f7e13bcb274585ec6534f6c54f6ea3
MD5 724bed208d0646a2169c5e000bbeac12
SHA1 f388458c56d28e26165b2d589329665fd2ff8435
SHA512 be300647405972fe92888dc779c7635704283d7e7db1d245f16c011021a4abde84beba338f2b3be6f23d740722318ecbd38b0d2e76aeed114f22e61097913cbc
TLSH
T102B00255D1436272C08607B07699A5DC7360DF25CE03121297E05E6BED366764629164
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 b127380857f07aee4b2f0893c90f8abdecc084030a822c11cd9666ca00ea8a6e
MD5 761b94dc918f6f94c9912b501da9d127
SHA1 e09d429b2d2beecb9efc3e822115f150bc802b07
SHA512 5d006beac856390b1fcaae9920a3c13b9b3c1aa5d5fb646c8f256aa15f825951a256bec5d7499f98e6eb972060e10e46a1cb8cd9f9f4e9c7f41333eabc9900d3
SSDEEP 6144:GX4NwhgqKR4ILo59R57lOYo8vm7Rkm1tYpBeh2BAog:GoNweqYhLw/7lg9oBGcAog
TLSH
T153342372DD366BBD5C79ABAF300C1E294FF29599D668E942C9D47A08335D9C80708A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 de8ffdbd019968259b14dcac77d326e1a21b9b2c425dd4c8ba76fac58f079887
MD5 b80e228694587f8d016a5b1c01aa38f8
SHA1 41bf6e9c3a02ecf70b9b4040490bf163a1aa485f
SHA512 fddbf2644be96dba13553130a38bd71e4d4e23a0e7e84a5f4d939d7bdaaf07716c2edf7bbce951d2a8c0180caa2f8547d4b758634f666ac1ec6744577b1e9a5e
SSDEEP 6144:MJX4NwhgqKR4ILo59R57lOYo8vm7Rkm1tYpBeh2BAog:CoNweqYhLw/7lg9oBGcAog
TLSH
T1ED342372DD326FB95CB9AF6F300C2A294FF1D699D668E946C8C47A08335D5884B09D3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 50455abafc8b116d0808a3c3ad46aef4b269caf0afbc957dd08070412556557d
MD5 97722725433fd5ed15e1cb18a308a8cf
SHA1 53630f83cb084e112dad17f39d5a07a9dedbadac
SHA512 85cefd73ee1aa4d42a31f8cca2c2aca8e97e66236f5e0c12d7629c8c6985647af160c02be32f8a58514cb63f4a904cf6ab493d17a412454ee7d78ef008b56d13
SSDEEP 6144:YJX4NwhgqKR4ILo59R57lOYo8vm7Rkm1tYpBeh2BAog:moNweqYhLw/7lg9oBGcAog
TLSH
T1B4342372DD326FB95CB9EF6F300C2A294FF19699D668D946C8C47A08335D5884B09D3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 b52ee729976181cb9efcc420a00a1c9219f534f490ad7042b2a070fdd53674f0
MD5 73071bd542488f6f526d6b7275621870
SHA1 199fad446ac0b2f8b6686b87abd05e71099d0005
SHA512 2fb819ea117a5a5f63dccb68956b8b03824df3219ef7c04581cfc218aefa2129e02420daa0f345d25e578357e8caedaf0e0d0f905f12a41be4d66069c041f22c
SSDEEP 6144:pX4NwhgqKR4ILo59R57lOYo8vm7Rkm1tYpBeh2BAog:poNweqYhLw/7lg9oBGcAog
TLSH
T11A342372DD366BBD5C79ABAF300C1E294FF29599D668E942C9D47A08335D9C80708E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 cfe77d745a9277085de105a6afe46e59d4a8d84d1a682147f102e9103c3f879e
MD5 ab3d0ae9bff842ab820bbc1583484eba
SHA1 f38420f4bc82bfd2eb70d4508263417245110edf
SHA512 26860d07247280d748c8b3011408a880804f7119972d82ac3066dd60925b6d25c90fa4e717c3e4d8fde5ab322d466c80779bf2c6821ec1a5671b986aa42af4ab
SSDEEP 3072:LGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:Sm7Rkm1tYpBeh2BAoK
TLSH
T122C3123B5D65E97B9979B70EB08E0B1F1EF149A2D920DE92C8D86A0437F97CD0A04D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download