8d86f5711e73317e3309cd446232d64c519ca893f8f468794b56d5015bd0db33

Resubmissions

28/08/2026, 18:19

260828-wyncpscr6t8

28/08/2026, 17:54

28/08/2026, 17:23

28/08/2026, 16:14

28/08/2026, 14:26

Analysis

user interaction
yes
max time kernel
270s
max time network
273s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/08/2026, 18:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
s.txt
Size 109B
Sample260828-wyncpscr6t
SHA256 8d86f5711e73317e3309cd446232d64c519ca893f8f468794b56d5015bd0db33
MD5 1d5a7029dccf0a5c0f05574bf280a915
SHA1 8cb387906df2f751dce5ba7f22a37fea14b371ca
SHA512 0087c48b0e19b86a0c96fcd49d3df023ea0958ecff94c2164d69014c07ca797ced1d53466aff34422ed6471275e9b1b625f0f5af749ccedede179486297b8ca9
TLSH
T1DFB0127F7D028E20AE44D010119D24DE2C57023B00C3CB024C31976C60D835A45191F3
MD5 SHA1 SHA512 TLSH

Score

8^/10

discovery ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
64	4964	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4964	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134324149216669129"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1848	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
2676	chrome.exe
2676	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 1404	1056	chrome.exe	98
PID 1056 wrote to memory of 4964	1056	chrome.exe	99
PID 1056 wrote to memory of 4540	1056	chrome.exe	100
PID 1056 wrote to memory of 4540	1056	chrome.exe	100
PID 1056 wrote to memory of 2276	1056	chrome.exe	101
PID 1056 wrote to memory of 2276	1056	chrome.exe	101
PID 1056 wrote to memory of 2980	1056	chrome.exe	103
PID 1056 wrote to memory of 2980	1056	chrome.exe	103
PID 1056 wrote to memory of 3276	1056	chrome.exe	104
PID 1056 wrote to memory of 3276	1056	chrome.exe	104
PID 1056 wrote to memory of 1520	1056	chrome.exe	105
PID 1056 wrote to memory of 1520	1056	chrome.exe	105
PID 1056 wrote to memory of 2480	1056	chrome.exe	106
PID 1056 wrote to memory of 2480	1056	chrome.exe	106
PID 1056 wrote to memory of 4212	1056	chrome.exe	108
PID 1056 wrote to memory of 3892	1056	chrome.exe	110
PID 1056 wrote to memory of 3892	1056	chrome.exe	110
PID 1056 wrote to memory of 2392	1056	chrome.exe	111
PID 1056 wrote to memory of 2392	1056	chrome.exe	111
PID 1056 wrote to memory of 4508	1056	chrome.exe	112
PID 1056 wrote to memory of 1764	1056	chrome.exe	113
PID 1056 wrote to memory of 436	1056	chrome.exe	114
PID 1056 wrote to memory of 1420	1056	chrome.exe	120
PID 1056 wrote to memory of 1420	1056	chrome.exe	120
PID 1056 wrote to memory of 2676	1056	chrome.exe	128
PID 1056 wrote to memory of 1188	1056	chrome.exe	129
PID 1056 wrote to memory of 1188	1056	chrome.exe	129

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\s.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:1848

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffd229fc728,0x7ffd229fc734,0x7ffd229fc740
  2⤵
  PID:1404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1972,i,7888921413581771586,9438782264971845460,524288 --field-trial-handle=1964,i,2576961075587052157,9892608303325914685,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2056 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1744,i,4456121089572113676,2955401392872962910,262144 --field-trial-handle=1964,i,2576961075587052157,9892608303325914685,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1932 /prefetch:2
  2⤵
  PID:4540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2476,i,1840265538561184471,6848128053218624804,524288 --field-trial-handle=1964,i,2576961075587052157,9892608303325914685,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2432 /prefetch:8
  2⤵
  PID:2276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,80688894139253365,5194567246729492557,2097152 --field-trial-handle=1964,i,2576961075587052157,9892608303325914685,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3280,i,14108003868808545302,1121134306306695598,2097152 --field-trial-handle=1964,i,2576961075587052157,9892608303325914685,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:3276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4464,i,14084471355991715556,4995536827081543506,2097152 --field-trial-handle=1964,i,2576961075587052157,9892608303325914685,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4480 /prefetch:2
  2⤵
  PID:1520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4732,i,3404460268546776740,11334700017639411971,2097152 --field-trial-handle=1964,i,2576961075587052157,9892608303325914685,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:2480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5520,i,10515862698373400237,12347320461335749274,524288 --field-trial-handle=1964,i,2576961075587052157,9892608303325914685,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5524 /prefetch:8
  2⤵
  PID:4212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5784,i,15288426877134904905,2622787273321349147,2097152 --field-trial-handle=1964,i,2576961075587052157,9892608303325914685,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:3892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5948,i,17041265009453149965,2995035006216649898,2097152 --field-trial-handle=1964,i,2576961075587052157,9892608303325914685,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6056,i,15570679168257091288,3519585128042261160,524288 --field-trial-handle=1964,i,2576961075587052157,9892608303325914685,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6096 /prefetch:8
  2⤵
  PID:4508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4716,i,17180813723970846509,16724360441903316882,524288 --field-trial-handle=1964,i,2576961075587052157,9892608303325914685,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=240 /prefetch:8
  2⤵
  PID:1764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3948,i,2919699169755266050,657156190544798586,524288 --field-trial-handle=1964,i,2576961075587052157,9892608303325914685,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4624 /prefetch:8
  2⤵
  PID:436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4752,i,9708429224905981771,7543054818039683946,2097152 --field-trial-handle=1964,i,2576961075587052157,9892608303325914685,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4872 /prefetch:1
  2⤵
  PID:1420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5948,i,10286221038458482765,4386452587846643515,262144 --field-trial-handle=1964,i,2576961075587052157,9892608303325914685,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6004 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5008,i,2314486404610117277,3179268628422648527,524288 --field-trial-handle=1964,i,2576961075587052157,9892608303325914685,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:1188

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1564

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 f013a8d38d2ea1b5cdb77a437c48385522574696a2b0af89f35370cce6c47f42
MD5 6e7cf2fa6743d77a34a1973d4e41e489
SHA1 e946ca90a136f8af21f9af5efeac6f12155a196a
SHA512 fdac1a76f3ad701e6494140c410fe96e44a79f3495acf30a658360cbaa79375a98d280e899073e92fc2e01ae1e8b78a4d0a5c3c1786c0633049fcc871575075e
TLSH
T172E02BB9C961EC2714F90B18A0105742E755139B2A50894B7A3DC11D8FB2B37499AD5C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 3ec252aff810cef666280e20cb8939836e58ddad6f4f0491bdf03a83ccb9406b
MD5 f47ff4fbd7ac8c60c27c29060bf2108d
SHA1 850e5e9bcd3782196f14fab499aab351a8a1b7ef
SHA512 76920fa0eaa45113a36583bdc6cb0ea92e1138bda92757882fabfed11a976dddcc45802c7ae94e0bee3bfce2669034ff860347e05555afc715922f1bc8c34f5e
TLSH
T1EE718DB3D3E48A7DC91156F49B257E1FCE690A24121C3C6688D4AE6F53F2872D21138E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 27c85445584c10f3def96bfd69aced24f890f1f188c9ddc4414823fee77138fc
MD5 92358bdd3136b9b181551a7aa59bd6cd
SHA1 eec792e88abc16e1c37c6190562499ac806eeb17
SHA512 a3855f5f9575ee28f34cc7ffdf22a059ba098f6b44da0c14a11ec58d7461b4f959e0a4ca3acd80b0996c4c172f678afc8426d553c2ceb7c54f43b191f9a5480a
TLSH
T10E519BF3D3E89A7D891156F49B256E1FCE790A24032C3D6688D4AE5F53E2872D21138E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 a44a7de70798aec3ca8896a9c485e34510ad6322d18b6b98080beb0f467bdb20
MD5 f1a2cb12e72a06e0547f8e13bbd327a5
SHA1 05bc71afae407cfa22675788ee52d3e454f02059
SHA512 e8294f21dac75b0615c6409fba8b0174453e9974c836ee5e9855091d2a80bfb6cedb140a293db89fdc2e6f4aba48ddebaee3331d8b657637e5976832526ac611
SSDEEP 192:ZRFnsVKbpZv70pm0PRpLPdf3Z9+Hsb+WNnZGnu1eVi2ejsjw7vkwcaZVyIsnAUge:ZRFnie5gJX38wkEe82ej0E8a/e
TLSH
T1B752D82EBA107D3BADDEC229F9517B57D3F6102125912E44E6FCCA2C09E76CD2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 4fdef73e8c5ae7d2f2f37ce65da9b0b53ac862f9d5b5a899de05e2162e910488
MD5 626e0bd66bbabdbedd9cd66d03c42759
SHA1 742d8d6371e132500b9e3b39133db67f44323c78
SHA512 4b1716365659309ce2ad5a7d4b7699ed37b7c9d5f3f4a6b28c6b6eb07eef718f1098f2a68277a7a848e92b4260a79ea0d3728547242c648a6587cf8d5598b504
SSDEEP 192:ZRFrsVKbp6v70pAPRp2df3Z9+Hsb+WNnZGnqR20i2ejsjw7vkwcaYVyIsnAUgtaJ:ZRFrieWgUXI8wkE2r2ej0E8a88
TLSH
T11752D72EBB10793BADDEC229F9517757D3F6112125952E84E6FCCA2C09D76CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 25b5599d265a53c82860e2dc19badab53fece9654293fcde2177b0a852f4f01b
MD5 576df70857a04899485ff559899a5909
SHA1 ec71870fe71903988024ac527a5f5a391ea55f6b
SHA512 c2fc0136ec269cca42d98a29fc551463bf78c1d3172029146c8e121a635ba9a24a05530ab120bbef9ef99f333cefb300be3df5fa47bc62839a346a4a7598c1b6
SSDEEP 192:ZRFnsVKbpev70pm0PRpLPdf3Z9+Hsb+WNnZGnu1eVi2ejsjw7vkwcaZVyIsnAUge:ZRFnieagJX38wkEe82ej0E8a/e
TLSH
T12652D82EBA10793BADDAC229F9517B57D3F6102125A12E44E6FCCA2C09E76CD2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 cd064a745524c3451abf4c2131cfc2f278f06dde1b6ab1264461b485fdb1e11a
MD5 1f520d284ea571032f062995fc82697b
SHA1 3804ebb8a55373027900d5c7e7f6c72dd786eeb8
SHA512 7f64267821387f9f4a8576051499b0f41df4a22ba3016bedf09e2f5b1ccf796afcb0e4c6ef7268a97bf7d6dffb3e34e467e69050e9e29091f4878fb06b5a724e
SSDEEP 192:ZRFrsVKbpev70pAPRp2df3Z9+Hsb+WNnZGnqR27i2ejsjw7vkwcaHVyIsnAUgraJ:ZRFrieagUXI8wkE2W2ej0E8ahe
TLSH
T14652E82EBA10793BADDEC229F9517757E3F6112124912E44E6FCCA2C19E76CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 9a63a02af86b793bc7723ea8579017000fbde21723150ca89cdaa0102d54150d
MD5 3db4d2ed90c53237037f403d9b6c10cf
SHA1 91febd0c861f52fac9b9c081f7e738838423da4a
SHA512 20a5acab3273b075187518ff1d84bdfb24fb19e0881b09c9805647d3b805dc5e2037a9ee22124705cac465e1ac8b91972117ed00cd2d49a563818ec658fd5de0
SSDEEP 384:W4jyR7KxkXqKf/pUZNCgVLH2Hfgsl/97pLuLcSjIpXODyJ+ErU3MrHGRxVJZU:WMyR7KxkXqKf/pUZNCgVLH2HfgsR97p9
TLSH
T183720A676C488E7B0F98CACCD8267B4FADF5024B65E9886453FA582903D5BCF11091FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 7ad2d8dd0989de367b60e27c8de26c75fc839936e44dc25d81a5e5fa82582506
MD5 7eed7eb2a10e5c3b92d6fb93da5df3e8
SHA1 c8e97a0e625f99fe5da649a32e57ee256d4436cf
SHA512 0b26192e74d600d7ffc8a74e74aca2d108153d2021322c4d8bef31da2fa21838205e1be5feaba8c37b334d0edd0a0c87f9150f30139c551ca8b3fa9efcecc3e9
TLSH
T1E8B0124080435101C40312F81346249873149F109A1A170153F469B2C8251A18118050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59748a.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59748a.TMP
Size 96B
SHA256 b18a9b87b399b85fc01dc5b6500d99cc8ca9299acf6b9ce81c6c7ac9f6b48ba5
MD5 947dca7872f59ad610b8d904523d63d9
SHA1 f8bc32f42b968409a91efee7bfbc558fd2799c9a
SHA512 7a49698bddc5320f8587338819519918a79d879239a84f41cfff5df820f2fb581d83fb7c597062bbe221410a5d3e4285667f282774cf66a6849ecb27fdd6d5bc
TLSH
T1EDB02200C003AA03C80323B028C3CAC83020CF20C203020383F08BA3FC282A008200A0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 242KB
SHA256 b6984d827c79aa5338aaa80452e6ab8534dd72742ee9061cccc4fdfb1ab9a68b
MD5 0dd828b5d1c909925a51d9783bec2a5a
SHA1 039ae7d1af113ddd8ef0bfcee68cd620f96dda8a
SHA512 ac17f2852fd2fc6961e7dce64be3ccb64324bd9c8e5b38923d72a5478ef0bdb65b0e690ae9f56fb420f00ae438181c1a8db0b383a3d528c88e9f0113625f43a7
SSDEEP 6144:V9bxy9s43U0Wcde82TEpExYSFRqZ/ZLW3Exs:420VdGEDuqZ/piQs
TLSH
T10A3412B7EA165C331983DE74B2235E9B9EF645E9C820C6488E447FFB2C838499442DDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 3caefd0a17b44b0d0d94140e54957e4ea803e99e88301376036d5e1f77a0d4c0
MD5 d66ac891b5a8da8fe68462a83a9f435f
SHA1 641126dc43adaabe13dddb1828c03834b59ae974
SHA512 eee0701bf288540111aa0c892968801e8c842431b776452dc62398b19d67587a89b7e04d0b003107a3df54e4d868bcb0c6988a074f56d5f3b60a2d9715b73e34
SSDEEP 6144:2bxy9s43U0Wcde82TEpExYSFRqZ/ZLW3Exs:T20VdGEDuqZ/piQs
TLSH
T11C3412B7EB165D331982DA34B2734E9B9AF605E48434C6488F857FFF6C838495042ADD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 4a1231d2896e9742dd82be4c118ff16d5e3c18033395d53231581d7b4bd595f3
MD5 cb5f79adcae12ad8d883b3762c6d0113
SHA1 5ba0964f561454323951c92c6b9acaa4ed28edbc
SHA512 c8336f02e6d390c0be9614c7faec7f455f3e36f36eb8682a81c88559bf5deb70e728b01ebc11ba9efa468452e86d5b9b1565ba66ed6e8586f77b9ad037c57e84
SSDEEP 6144:jbxy9s43U0Wcde82TEpExYSFRqZ/ZLW3Exs:U20VdGEDuqZ/piQs
TLSH
T15B3412B7EB165D331982DA34B2734E9B9AF605E48424C6488F857FFF6C838895042ADD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 7c3879eb3785bfb98d131c2df9f0140fa36ec0598850b5c984f61390405944f4
MD5 5cec1f795bd6169a9ea9ad9c4aef881e
SHA1 a1a6f681547c9c2909e6bb41cbfa74d66c0cb574
SHA512 da48fe68cc8bd56a79581294750652326cae443559034e455b2719305b95f2244fc5fb47f3cf62aacc2f777eafbe40c2d96abbc31566fa81eca787a6b7cd4ae5
SSDEEP 1536:bGLyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:aqfd7NtZL8cHQRZEQ6Sps3
TLSH
T1ADC30237ABC21F339D92CF64B9130FD6A7B644A99030D301AAAD37EB7C93591684249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 242KB
SHA256 73182c6316909300b8074fee00a62854f4681300b55a871ea42d234f48741c6e
MD5 46c88be7f833249a859dc483e5eacdca
SHA1 07b87101706fd7741e10c4a1b224d0fc1049c825
SHA512 27643248d468691582a7a35b2904ef236ca0a38b4c07b59064878798e54ff9a4f444c629ae2cc834e18cb4846757134616b253e1752799a0108f5c537c7ef604
SSDEEP 6144:h9bxy9s43U0Wcde82TEpExYSFRqZ/ZLW3Exs:U20VdGEDuqZ/piQs
TLSH
T1963412B7EA165C332983DE74B2635E9B9EF645E9C820C6488E443FFB2C838495442DDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download