hxxps://geocities[.]ws/graalhelp/home[.]html

Analysis

user interaction
yes
max time kernel
450s
max time network
451s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
17/08/2026, 14:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://geocities.ws/graalhelp/home.html
Sample260817-rw6daascpg

Score

3^/10

discovery persistence ransomware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2788	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134314508352216728"	chrome.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4516	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
380	chrome.exe
380	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe

Suspicious use of FindShellTrayWindow 50 IoCs

pid	Process
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
1276	setup.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 3556 wrote to memory of 4648	3556	chrome.exe	83
PID 3556 wrote to memory of 4960	3556	chrome.exe	84
PID 3556 wrote to memory of 4960	3556	chrome.exe	84
PID 3556 wrote to memory of 2788	3556	chrome.exe	85
PID 3556 wrote to memory of 1476	3556	chrome.exe	86
PID 3556 wrote to memory of 1476	3556	chrome.exe	86
PID 3556 wrote to memory of 3968	3556	chrome.exe	88
PID 3556 wrote to memory of 3968	3556	chrome.exe	88
PID 3556 wrote to memory of 3800	3556	chrome.exe	87
PID 3556 wrote to memory of 3800	3556	chrome.exe	87
PID 3556 wrote to memory of 1592	3556	chrome.exe	90
PID 3556 wrote to memory of 1592	3556	chrome.exe	90
PID 3556 wrote to memory of 4536	3556	chrome.exe	92
PID 3556 wrote to memory of 2544	3556	chrome.exe	95
PID 3556 wrote to memory of 1440	3556	chrome.exe	96
PID 3556 wrote to memory of 2508	3556	chrome.exe	98
PID 3556 wrote to memory of 1248	3556	chrome.exe	99
PID 3556 wrote to memory of 3604	3556	chrome.exe	100
PID 3556 wrote to memory of 380	3556	chrome.exe	111
PID 3556 wrote to memory of 4484	3556	chrome.exe	113
PID 3556 wrote to memory of 4484	3556	chrome.exe	113
PID 3556 wrote to memory of 5032	3556	chrome.exe	114
PID 3556 wrote to memory of 5032	3556	chrome.exe	114
PID 3556 wrote to memory of 552	3556	chrome.exe	115
PID 3556 wrote to memory of 552	3556	chrome.exe	115
PID 3556 wrote to memory of 528	3556	chrome.exe	116
PID 3556 wrote to memory of 528	3556	chrome.exe	116

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://geocities.ws/graalhelp/home.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7fff0c12c728,0x7fff0c12c734,0x7fff0c12c740
  2⤵
  PID:4648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1724,i,2689466198686313058,14651657959070649485,262144 --field-trial-handle=2024,i,4040968407786223031,2072497999447042022,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2020 /prefetch:2
  2⤵
  PID:4960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2100,i,18054237849977710128,10402875792965965044,524288 --field-trial-handle=2024,i,4040968407786223031,2072497999447042022,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2408,i,7512190880609043797,13435523732751957279,524288 --field-trial-handle=2024,i,4040968407786223031,2072497999447042022,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:1476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3136,i,5042220141163950525,7598560379762811071,2097152 --field-trial-handle=2024,i,4040968407786223031,2072497999447042022,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:3800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3140,i,15802647037674023260,5980778430736212043,2097152 --field-trial-handle=2024,i,4040968407786223031,2072497999447042022,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:3968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4216,i,3573727582508267174,4979250852055577779,2097152 --field-trial-handle=2024,i,4040968407786223031,2072497999447042022,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4360 /prefetch:2
  2⤵
  PID:1592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5220,i,8768030299127615451,13467972352104524257,524288 --field-trial-handle=2024,i,4040968407786223031,2072497999447042022,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5104 /prefetch:8
  2⤵
  PID:4536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5676,i,12634565624790886256,8775213219399336819,524288 --field-trial-handle=2024,i,4040968407786223031,2072497999447042022,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5692 /prefetch:8
  2⤵
  PID:2544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5664,i,1866641150684826954,4073613671280790996,524288 --field-trial-handle=2024,i,4040968407786223031,2072497999447042022,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  PID:1440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5740,i,9149933086393297765,8359159896399683614,524288 --field-trial-handle=2024,i,4040968407786223031,2072497999447042022,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  PID:2508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5760,i,15229458197924234989,4777116510788449697,524288 --field-trial-handle=2024,i,4040968407786223031,2072497999447042022,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5656 /prefetch:8
  2⤵
  PID:1248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5808,i,496062196464482024,16264485992347742368,524288 --field-trial-handle=2024,i,4040968407786223031,2072497999447042022,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:3604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4372,i,4951732929211552135,12139053606909164397,262144 --field-trial-handle=2024,i,4040968407786223031,2072497999447042022,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5748 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5748,i,8158230485585733288,6893001981496539954,524288 --field-trial-handle=2024,i,4040968407786223031,2072497999447042022,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  PID:4484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4448,i,15738325705744159536,18102191136479978158,2097152 --field-trial-handle=2024,i,4040968407786223031,2072497999447042022,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5752,i,2079623192282490422,10820574061673925058,2097152 --field-trial-handle=2024,i,4040968407786223031,2072497999447042022,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6180,i,11699979022000033404,3890792120118557107,2097152 --field-trial-handle=2024,i,4040968407786223031,2072497999447042022,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6220 /prefetch:1
  2⤵
  PID:528

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5008

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3748

C:\Users\Admin\Downloads\graalsetup\setup.exe
"C:\Users\Admin\Downloads\graalsetup\setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:1276

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Graal2001\setup.log
1⤵
- Opens file in notepad (likely ransom note)
PID:4516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 ec964910836212180a9f3d8c37f17ab6d90381f91ea169789694a4ee0fcff844
MD5 c4a75bc971362dc0452dd9ff0852fdf8
SHA1 29d8f3d7972c89772979039db1fa487aca4892c4
SHA512 315de94d8aa59306791139d58da365d5aeef5a31e701460233d5e7e7017257c8cd148925746aad73eb2ca2dabfab494972a0c430549d08ad9403e068ea797cc6
TLSH
T148E02BA6C861ED2708FD1B1890608E42E740136B2B408E5F3F3CC1288FB57364AD6D1C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 5f5f2d01485b51b527f0e97f361ddd00386d460872834004bcda9d72369dad1f
MD5 ac81a48e34be0ad83c81d240d3937e33
SHA1 d872c17b4852dde0b3b5a3a26b8a4a964be59efe
SHA512 3f30287831913c9fec726ed953f45c47296ad06c7d040ddb94e645663f1728a2e14d37ef12a43b0683051b0abf6dbe4b6bc477a4cec0bae7dbec54ac8dd1f842
TLSH
T14BC02B12CFF11800CF1101F29D310CC810448FBFD0B4E30F40850C40CAB31F282900E1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 1a2aaf15fc665d20e18b52937091e41b7cb4b1dae412e82fd4b4c99ea968c2f3
MD5 9bded92a780e7f47dae7f01e111651ac
SHA1 35051942cc1fa37ae899ea7b12fc18cff73b229a
SHA512 77d36ebecbf57309b916a4d70d8c571b0e5e8d69cccf11823341af116f1d71cf8191850c7e609371b4871e9a3374c3599e4dc597e46de6064a268137a78bc2f8
TLSH
T141B01259D7F42A40DB40A176333008C628D059DF1184331B85CD1C44C8B7FE0D183091
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 f3275ce3431922f3bc04116cfb0c561b6a01e2265b8e016cd4e3c97433da0d18
MD5 f928522f0a9fcc3b38bfb94c9f9e9172
SHA1 4ba3d28473290788d710b1edc1e3cf7013d3488f
SHA512 96ac306e587a6f81ff390641cd47b35249a7bb14f8d8cb4f96886ed4dcc14c80043809838f173a43acc603973eb6b131d213b389d839f0349b04d94d1a359b1e
TLSH
T15A716AF793F4956E891192F09B146E1FCE690A24532C39B6C9D4AE1BD3E2872E10174E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 42978adf1ee858ccfdd641caeabe2ceaa64f1a6aa71f7251f9260100eead5f58
MD5 1136a11056a8631c980d83bb9dc3d783
SHA1 6e80d4941ea09be705522f2f91b6f85b4a11a406
SHA512 46622c4553437d2684b67c675c5089de0851348a125b59922381c8bdf1d51ddb2ad8294bbd17db77540b538732ae103507f86e2cc9171baed8d2cc40c616b5da
TLSH
T170518CFB93F4957E891192F09B156E2FCE690A24132C39B6C9D45F1783E2872D10174F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 49292b1eef291b3d765cc2a28cac775fcbecb140b4e899c21a2165ba365d61ee
MD5 ce3909e581ef3f5dcd250a5041c479a4
SHA1 317254695c9f3ab6d873cfd53a49abf3aa727186
SHA512 cf9a4b2a32599d2dbbd63d69b6413438bae7733a94357b17f66b650cf5bf46f9db7a4bff6925db3a0694379c9144c1c40b23ad25c2185a25accd4c1d630fc70e
SSDEEP 192:CReg1xoaoZLbSv7bpUPRpilA99/H/0PIb+WNnVKABveraWkwFVyIsnAUgE:CReg1oJ+PQXR188sue2WTE
TLSH
T1CC52C52EB910697B6CCAD22AF961BB57D7F5203221D01E84EBFC8A2C05EB5CD711741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 bd371bbd2930575d4e00a3a986ab196e69102e3d26c9c06bc542d2e2cf65a623
MD5 08bd015fe7eef0885dece40b0b6568f9
SHA1 e8e1468277281e8b17f49e638348444d119d2f43
SHA512 245d3c33bec1d3984b11b002a1c87964e6386c746a91518742c6508d0d54f2eedd81522179e33d9d6d79b4e4f542a70aa1f76bdb7e36d616a04f493edc9eda7f
SSDEEP 192:CReg1xoaoZLbDv7bpUPRpiln9/H/0PIb+WNnVKABveraWkwFVyIsnAUgE:CReg1oJ7PQXY188sue2WTE
TLSH
T11352C52EF910697B6CDAD22AF961BB57D7F5202221D01E84EBFC8A2C05EB5CC311741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 011123bbd6e419d41a5c827969de12a19b0cb232780f67bb5fe858ad495c8f1d
MD5 aeb8c12a7a4123ed4ca4af856011d16d
SHA1 4681b2e36cf3e9b8e9ed7aa53a1bdb3d172932ce
SHA512 89297d6ec01a43a99ebb2b72a56c751282b2733910f352bf1f2f4afe8fbfcae4dbd24ad6159e451f456013ac94639c19e3f2390ea346ead0ab91a0df970d17a7
SSDEEP 192:CReQ1xoaoZLbKv7bpAPRp259/Hsb+WNnVKPeaWkw8VyIsnAUge:CReQ1oJGPUXe1wsPxW4e
TLSH
T1FA42C62EBA10693B6CDAD22BF922BB53D7F5203121D41E44EAFC8A2C15EB5CC611741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 fabd38025bd67328db958245fe37e9111d2d33c8ffd1759883c5b7487d3bb786
MD5 20c48955af226b18a996722d089a6c3b
SHA1 714da641b7771ef5e487894f88b850a9163898d1
SHA512 f9fc5aa120b67e174c8dfdb669c63da7072c6be98bf806ae8aa1786626724fbf6c24e6af2087a61194c0d5f4bfa8273770de0b771c40bcc73c68e2fb7c7e5963
SSDEEP 192:CReg1xoaoZLbxv7bpAPRp2ln9/Hsb+WNnVKAIo82IaWkwPVyIsnAUgE:CReg1oJhPUXc1wsx2rWJE
TLSH
T10642C62EBA10697B6CDAD22AF961BB57D7F5202221C01F44EAFC8A2C15EB5CC711741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 4a8de811b93ad52e9d4022e9fa8a9091cc20b5ffab88a1e0f530f17ec1f4af83
MD5 469645fc081cfe6eb6c54d3ab7d6055c
SHA1 a833172ee1a4cfdf987c031a33c493f52999a2a9
SHA512 e6874d4c0de8dab37c06cfe06c0e7f6a0485f59eca431899ec8c9501c7f2f35d5061c79cd8a90a2176dfdb88432ceb4ee67ce09a6e5a875caf924a573ae28e55
SSDEEP 384:RrjNI7KxkXqKf/pUZNCgVLH2Hfgsl4Tv7pLuLcSj/6XODNI+ErU3BtvHG+lGGEVP:RHNI7KxkXqKf/pUZNCgVLH2HfgsmT7pL
TLSH
T13D7209677C4C9A3B0F94C6CCE8177B4FADB5025B26E9886543FA582503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 a3abdf8475887fcd4c3eddb1008cd0c8f8c27fd08fef5ff141a6c2f22115b110
MD5 cdc259d557f938476a30c134b97dfa6d
SHA1 d62668bddc6a0abbd9d54c7fd41d116dc01c67f8
SHA512 7bcd8e739286cac959b4835b8c3ae00385b70eeb76b78d4f39f96d7be4daa279263b915c4e3064a3892a9098105572b5319547c0450d26a43df2e801c69ba208
TLSH
T145B0120984015182C09202B01142159CB1285F10DA0A1B0143F07922DC251728024050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58997c.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58997c.TMP
Size 96B
SHA256 e52b90daf04bcac69a74cfb77616895fd2e3d4b8fc297ff316d5332df0561e9c
MD5 c57fccfd9b6024fd5fb8d144d392d5aa
SHA1 11c76bf7e2b961b1956155f105852fc67ce27efa
SHA512 269a3693fec344c171682f0b6e5efe48e8dca68746e2c84e2a670eddd25940dc934b79cd521b9fb61042661c114288967f9b7d59d43cb972f3cdeaaeee3da711
TLSH
T13FB00255C512A222E04303B0369795DCB264DFA9C613136693F01BA6FD2967159652A1
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 9b3639ea65612328d14cba681fff91fde0c1a54cd9f8bcb4b3cc7dc124bed5dc
MD5 0c82310908b7626b1dde02dcc71da3b5
SHA1 fd20e11b82c0d6e0f5785b1e40dbfe988cafd96a
SHA512 f743a81ae06ca8540c6df715d4544dca7265c47ffa99ab5d1751fdfa92eb022afb4e325f19285c73277b4f632e84a36ea6f1c6e4e311943d7877910c6b8dcb52
SSDEEP 3072:kGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM1:Hm7Rkm1tYpBeh2BAo1
TLSH
T110C312275D74E9365DB9BB1EB04E0B1F1EF24AB7C920DE52C8D85B0423EA7CC1A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 e926140bb7d9e63ee608f8265fee5692553aa81e6d60a768b0b1b28292d048f2
MD5 81704406e36f9f65c3d17bc5a998358e
SHA1 f52215e26a79f41d2e1d25f1239ef7a57ac1a487
SHA512 5f5dbec0072f20b6ac0feffa4181fab9bbb16ddd5de1e1e5e82be2b4d86766911ca1754be6508944885783de126d04f6e8b7e7659173e1706513c2ea57c16d0f
SSDEEP 3072:qGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM1:tm7Rkm1tYpBeh2BAo1
TLSH
T1D6C312379D75A93B4CB9BB4E708E0F1F1EF149A7D924EE52C8D85E0823E96CC0A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 84d7d940fb3528272866a37faa3f30d39a88d9fd2b781585d4045907c1f5d3f2
MD5 403206136da0aa5b41f6472c90226b1c
SHA1 36a3ec12b2fbbcf65cb37ca8fee163065a158d54
SHA512 ee4f5f1afbaa9b657552958f016b516348b418e051e82d5956ff037d664b535ab54bf5656e60d0ef0068a3cfca51969d37ec3dc988e1418e11cf4a71b02ec093
SSDEEP 3072:pTGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM1:pqm7Rkm1tYpBeh2BAo1
TLSH
T1A3C312275E71E9375D79AB4EB08E0B1F1EF149A3C920DE8288D85B0477FA7CD1A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 64f87b5b6d15b7ddb31f2b9f0748765ccfcf2768db5812cca60aa15d8ad11fe9
MD5 964945a650261db86804586140a0e1b2
SHA1 04728e0d9268949e547bc0ed4a083fe4acbe71b4
SHA512 4e595d385c9b98eee75d806fcbe94dbcc5e18dc1fa86d10b10faf0935ef7ed92b715f3c0e0f501f2a3c1be85abed9c6213cb7083038ebf6c58572c68b7dc7ff7
SSDEEP 3072:1Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrM1:cm7Rkm1tYpBeh2BAo1
TLSH
T1C4C312275D74E9365CB9BB1EB04E0B1F1EF24AA7C920DE52C8D85B0423EA7CC1A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 f67aa2a1181f0d5cc4f747e2ea1d9eefc87123b055d555c4341f4eb1496e8248
MD5 16606b6870c3d35e715366340743966b
SHA1 47ab428568b331c2d296c5ba3b02aef71b7cb446
SHA512 6874b6f17f71612c0bb6defecaaa23d5bddfcb5083319443d56b2136ecd4e7276cb39c84cb3bc5fff95bd78fae47fe77e66d8d2c95dad1215abdae6552c3065c
SSDEEP 3072:TGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM1:qm7Rkm1tYpBeh2BAo1
TLSH
T13AC312379D75A93B4CB9BB4E708E0F1F1EF149A7D924EE52C8D85E0823E96CC0A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 9eb8ffe4093944e5ac69c3be8bb3aa6634ca8e0879abbce7528484ecb23177f2
MD5 be1e73158b00db69344bc402ba0a9c4a
SHA1 427532d2cdbf1779b8bf619a659b4d94805794f7
SHA512 80ed32560787f06e29299d402ee8a7e33cdda90f25ec7b58581c0c7f1256f8366dab9f5ff90664273a3d4f8d02afb700a95b8c52abf3c0a1dbae730f61bcd7a3
SSDEEP 3072:LGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM1:Sm7Rkm1tYpBeh2BAo1
TLSH
T1FFC312379D75A93B4CB9BB4EB04E0F1F1EF149A3D924EE52C8D85E0823E96CC0A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.log

Path C:\Users\Admin\Downloads\Graal2001\setup.log
Size 223B
SHA256 957335692bb4af7b9221decef2fc4d9669bf2e3886a259aa1017d0f95259c8bd
MD5 1b111beaef1c5764e757a583d818f89a
SHA1 31ef5acf9e775ee884b5cb30ba7d508f2f389a46
SHA512 20cc27ce9dc567cbc70cbb85937f01a4d25a4ab8add7d2720eda97410cc43007aab7361d6bec6000ebddaaf0522bc328ea7cbe9d570d434d4bb6cde461f5566f
TLSH
T181D0A75908D999399ED00793013B224D8A00660B2B05F74426DA29016132336E6C3083
MD5 SHA1 SHA512 TLSH

Submit Download

graallevels.zip.crdownload

Path C:\Users\Admin\Downloads\graallevels.zip.crdownload
Size 4.6MB
SHA256 d665587bbe3fbe8278c25a9aef60b26428f45086feeb478951c62dd400a3be24
MD5 f839b22f906fdcd8f4e69be0778898ca
SHA1 698bbca509e40c4fd53030b586b8a9ca077a23a1
SHA512 8f647b4b19795eed1eb7a9136b0df7bf156862a953637a539e65333875185a8d01b4a3484db6d2935bbe11269924a45d7f2bdc4e289a7c6a9442f8808c5777fe
SSDEEP 98304:/Ku0Wo+L4xfZdDLrYCeoVmFT/QGxwg97jkfvfdRN88Q4ZbvA:/50WoPf3rYCeoVSDQM9/uR+f24
TLSH
T18F261235CE2A000AE0D7F335C132195B8ACDDD5B8285EE4F591A59E10C73AE52B36A7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1276-110-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/1276-168-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/1276-164-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/1276-154-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/1276-149-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/1276-144-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/1276-121-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/1276-111-0x0000000000435000-0x0000000000436000-memory.dmp

Download