e19bd76255f84ca09486528b871f0e987d05e31a56ced2b2392ba87fd120e989

Analysis

user interaction
yes
max time kernel
58s
max time network
61s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/09/2026, 15:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Paradoxfreewoofer.exe
Size 303KB
Sample260907-sp1d5axyav
SHA256 e19bd76255f84ca09486528b871f0e987d05e31a56ced2b2392ba87fd120e989
MD5 0235db3c70faaec473e92d52687b1081
SHA1 cee5462d2ff67c16d321ccd3488343e6a73e4178
SHA512 4965261c1efe2170d679a656e3c7bd3439bdd89e8d87c5c7474c341ca971355341c54d2285f2432cf04d11ea22b23b21c2344b067071fc17cb79df74309c60ba
SSDEEP 6144:dnO49dsMYSo/bBH2sClm/id5CJkHblmW6vTlA5fdzpaljhSEqG6CGaYv4:xO49xYSoFWD00AkpmXTO5frihSEK
TLSH
T1D064DF1FE7F230E9D633857D8A425748E776787017A1A9EB03604222BF232D99C7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence ransomware

Malware Config

Signatures

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wdmwdlmon\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\wdmwdlmon"	pxmap_240715093.exe

Executes dropped EXE 1 IoCs

pid	Process
4080	pxmap_240715093.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4060	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2432	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134332679446649581"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2916	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4660	chrome.exe
4660	chrome.exe
4080	pxmap_240715093.exe
4080	pxmap_240715093.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
4080	pxmap_240715093.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4660	chrome.exe
Token: SeCreatePagefilePrivilege	4660	chrome.exe
Token: SeShutdownPrivilege	4660	chrome.exe
Token: SeCreatePagefilePrivilege	4660	chrome.exe
Token: SeShutdownPrivilege	4660	chrome.exe
Token: SeCreatePagefilePrivilege	4660	chrome.exe
Token: SeShutdownPrivilege	4660	chrome.exe
Token: SeCreatePagefilePrivilege	4660	chrome.exe
Token: SeShutdownPrivilege	4660	chrome.exe
Token: SeCreatePagefilePrivilege	4660	chrome.exe
Token: SeShutdownPrivilege	4660	chrome.exe
Token: SeCreatePagefilePrivilege	4660	chrome.exe
Token: SeShutdownPrivilege	4660	chrome.exe
Token: SeCreatePagefilePrivilege	4660	chrome.exe
Token: SeShutdownPrivilege	4660	chrome.exe
Token: SeCreatePagefilePrivilege	4660	chrome.exe
Token: SeShutdownPrivilege	4660	chrome.exe
Token: SeCreatePagefilePrivilege	4660	chrome.exe
Token: SeShutdownPrivilege	4660	chrome.exe
Token: SeCreatePagefilePrivilege	4660	chrome.exe
Token: SeShutdownPrivilege	4660	chrome.exe
Token: SeCreatePagefilePrivilege	4660	chrome.exe
Token: SeShutdownPrivilege	4660	chrome.exe
Token: SeCreatePagefilePrivilege	4660	chrome.exe
Token: SeShutdownPrivilege	4660	chrome.exe
Token: SeCreatePagefilePrivilege	4660	chrome.exe
Token: SeShutdownPrivilege	4660	chrome.exe
Token: SeCreatePagefilePrivilege	4660	chrome.exe
Token: SeShutdownPrivilege	4660	chrome.exe
Token: SeCreatePagefilePrivilege	4660	chrome.exe
Token: SeShutdownPrivilege	4660	chrome.exe
Token: SeCreatePagefilePrivilege	4660	chrome.exe
Token: SeShutdownPrivilege	4660	chrome.exe
Token: SeCreatePagefilePrivilege	4660	chrome.exe
Token: SeShutdownPrivilege	4660	chrome.exe
Token: SeCreatePagefilePrivilege	4660	chrome.exe
Token: SeShutdownPrivilege	4660	chrome.exe
Token: SeCreatePagefilePrivilege	4660	chrome.exe
Token: SeShutdownPrivilege	4660	chrome.exe
Token: SeCreatePagefilePrivilege	4660	chrome.exe
Token: SeShutdownPrivilege	4660	chrome.exe
Token: SeCreatePagefilePrivilege	4660	chrome.exe
Token: SeShutdownPrivilege	4660	chrome.exe
Token: SeCreatePagefilePrivilege	4660	chrome.exe
Token: SeShutdownPrivilege	4660	chrome.exe
Token: SeCreatePagefilePrivilege	4660	chrome.exe
Token: SeShutdownPrivilege	4660	chrome.exe
Token: SeCreatePagefilePrivilege	4660	chrome.exe
Token: SeShutdownPrivilege	4660	chrome.exe
Token: SeCreatePagefilePrivilege	4660	chrome.exe
Token: SeShutdownPrivilege	4660	chrome.exe
Token: SeCreatePagefilePrivilege	4660	chrome.exe
Token: SeShutdownPrivilege	4660	chrome.exe
Token: SeCreatePagefilePrivilege	4660	chrome.exe
Token: SeShutdownPrivilege	4660	chrome.exe
Token: SeCreatePagefilePrivilege	4660	chrome.exe
Token: SeShutdownPrivilege	4660	chrome.exe
Token: SeCreatePagefilePrivilege	4660	chrome.exe
Token: SeShutdownPrivilege	4660	chrome.exe
Token: SeCreatePagefilePrivilege	4660	chrome.exe
Token: SeShutdownPrivilege	4660	chrome.exe
Token: SeCreatePagefilePrivilege	4660	chrome.exe
Token: SeShutdownPrivilege	4660	chrome.exe
Token: SeCreatePagefilePrivilege	4660	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
1032	Paradoxfreewoofer.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 4660 wrote to memory of 4116	4660	chrome.exe	88
PID 4660 wrote to memory of 2432	4660	chrome.exe	90
PID 4660 wrote to memory of 552	4660	chrome.exe	91
PID 4660 wrote to memory of 552	4660	chrome.exe	91
PID 4660 wrote to memory of 3308	4660	chrome.exe	92
PID 4660 wrote to memory of 3308	4660	chrome.exe	92
PID 4660 wrote to memory of 5096	4660	chrome.exe	93
PID 4660 wrote to memory of 4592	4660	chrome.exe	94
PID 4660 wrote to memory of 5096	4660	chrome.exe	93
PID 4660 wrote to memory of 4592	4660	chrome.exe	94
PID 4660 wrote to memory of 4440	4660	chrome.exe	95
PID 4660 wrote to memory of 4440	4660	chrome.exe	95
PID 4660 wrote to memory of 3128	4660	chrome.exe	96
PID 4660 wrote to memory of 3128	4660	chrome.exe	96
PID 4660 wrote to memory of 3408	4660	chrome.exe	97
PID 4660 wrote to memory of 1508	4660	chrome.exe	100
PID 4660 wrote to memory of 1508	4660	chrome.exe	100
PID 4660 wrote to memory of 452	4660	chrome.exe	101
PID 4660 wrote to memory of 452	4660	chrome.exe	101
PID 4660 wrote to memory of 808	4660	chrome.exe	102
PID 4660 wrote to memory of 808	4660	chrome.exe	102
PID 4660 wrote to memory of 1668	4660	chrome.exe	106
PID 4660 wrote to memory of 4252	4660	chrome.exe	107
PID 4660 wrote to memory of 2500	4660	chrome.exe	108
PID 4060 wrote to memory of 4180	4060	cmd.exe	112
PID 4060 wrote to memory of 2800	4060	cmd.exe	113
PID 4060 wrote to memory of 2256	4060	cmd.exe	114
PID 4060 wrote to memory of 3972	4060	cmd.exe	115
PID 4060 wrote to memory of 4884	4060	cmd.exe	116
PID 4060 wrote to memory of 4348	4060	cmd.exe	117
PID 1032 wrote to memory of 4080	1032	Paradoxfreewoofer.exe	119
PID 4060 wrote to memory of 2496	4060	cmd.exe	121
PID 4060 wrote to memory of 1120	4060	cmd.exe	122
PID 4060 wrote to memory of 1696	4060	cmd.exe	123
PID 4060 wrote to memory of 5052	4060	cmd.exe	124
PID 4060 wrote to memory of 4256	4060	cmd.exe	125
PID 4060 wrote to memory of 4576	4060	cmd.exe	126
PID 4060 wrote to memory of 2816	4060	cmd.exe	127
PID 4060 wrote to memory of 4216	4060	cmd.exe	128
PID 4060 wrote to memory of 8	4060	cmd.exe	129
PID 4060 wrote to memory of 2292	4060	cmd.exe	130
PID 4060 wrote to memory of 1684	4060	cmd.exe	131
PID 4060 wrote to memory of 4012	4060	cmd.exe	132
PID 4060 wrote to memory of 2928	4060	cmd.exe	133
PID 4060 wrote to memory of 2588	4060	cmd.exe	134
PID 4060 wrote to memory of 2492	4060	cmd.exe	135
PID 4060 wrote to memory of 2096	4060	cmd.exe	136
PID 4060 wrote to memory of 3844	4060	cmd.exe	137
PID 4060 wrote to memory of 2804	4060	cmd.exe	138

C:\Users\Admin\AppData\Local\Temp\Paradoxfreewoofer.exe
"C:\Users\Admin\AppData\Local\Temp\Paradoxfreewoofer.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Users\Admin\AppData\Local\Temp\pxmap_240715093.exe
  "C:\Users\Admin\AppData\Local\Temp\pxmap_240715093.exe" "C:\Users\Admin\AppData\Local\Temp\pxdrv_240715093.sys"
  2⤵
  - Sets service image path in registry
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: LoadsDriver
  PID:4080

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff8026ec728,0x7ff8026ec734,0x7ff8026ec740
  2⤵
  PID:4116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1616,i,7417293722801494283,15793583516971615830,524288 --field-trial-handle=2080,i,11782746175501321907,1016893694641470741,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1756,i,15112285732977067459,6620349425638393373,262144 --field-trial-handle=2080,i,11782746175501321907,1016893694641470741,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2428,i,4000343692416438,17947556978936276667,524288 --field-trial-handle=2080,i,11782746175501321907,1016893694641470741,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2596 /prefetch:8
  2⤵
  PID:3308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3264,i,12307425369676918280,15173610877280460325,2097152 --field-trial-handle=2080,i,11782746175501321907,1016893694641470741,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3288,i,8017700304453150756,11245999480728685029,2097152 --field-trial-handle=2080,i,11782746175501321907,1016893694641470741,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4336,i,8409800839171992946,13386072112876730130,2097152 --field-trial-handle=2080,i,11782746175501321907,1016893694641470741,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4356 /prefetch:2
  2⤵
  PID:4440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4764,i,11435509921141152222,14725601786751948690,2097152 --field-trial-handle=2080,i,11782746175501321907,1016893694641470741,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5580,i,4784179862180192479,12888283320298783759,524288 --field-trial-handle=2080,i,11782746175501321907,1016893694641470741,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  PID:3408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5700,i,1968114586811614349,14888326052631802363,2097152 --field-trial-handle=2080,i,11782746175501321907,1016893694641470741,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:1508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3492,i,9256284275619646181,14867818194696685782,2097152 --field-trial-handle=2080,i,11782746175501321907,1016893694641470741,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5996,i,14175507785474939786,15270890285840950045,2097152 --field-trial-handle=2080,i,11782746175501321907,1016893694641470741,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6028 /prefetch:1
  2⤵
  PID:808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3328,i,278213259717775352,2807085276354165152,524288 --field-trial-handle=2080,i,11782746175501321907,1016893694641470741,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  PID:1668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6076,i,1937446825364891307,1603712946768319759,524288 --field-trial-handle=2080,i,11782746175501321907,1016893694641470741,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3520 /prefetch:8
  2⤵
  PID:4252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3332,i,10590032034710779848,6696833903717339781,524288 --field-trial-handle=2080,i,11782746175501321907,1016893694641470741,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3548 /prefetch:8
  2⤵
  PID:2500

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3812

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\check.bat
1⤵
- Opens file in notepad (likely ransom note)
PID:2916

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\check.bat" "
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4060
- C:\Windows\System32\Wbem\WMIC.exe
  wmic diskdrive get model, serialnumber
  2⤵
  PID:4180
- C:\Windows\System32\Wbem\WMIC.exe
  wmic cpu get serialnumber
  2⤵
  PID:2800
- C:\Windows\System32\Wbem\WMIC.exe
  wmic bios get serialnumber
  2⤵
  PID:2256
- C:\Windows\System32\Wbem\WMIC.exe
  wmic baseboard get serialnumber
  2⤵
  PID:3972
- C:\Windows\System32\Wbem\WMIC.exe
  wmic path win32_computersystemproduct get uuid
  2⤵
  PID:4884
- C:\Windows\system32\getmac.exe
  getmac
  2⤵
  PID:4348
- C:\Windows\System32\Wbem\WMIC.exe
  wmic diskdrive get model, serialnumber
  2⤵
  PID:2496
- C:\Windows\System32\Wbem\WMIC.exe
  wmic cpu get serialnumber
  2⤵
  PID:1120
- C:\Windows\System32\Wbem\WMIC.exe
  wmic bios get serialnumber
  2⤵
  PID:1696
- C:\Windows\System32\Wbem\WMIC.exe
  wmic baseboard get serialnumber
  2⤵
  PID:5052
- C:\Windows\System32\Wbem\WMIC.exe
  wmic path win32_computersystemproduct get uuid
  2⤵
  PID:4256
- C:\Windows\system32\getmac.exe
  getmac
  2⤵
  PID:4576
- C:\Windows\System32\Wbem\WMIC.exe
  wmic diskdrive get model, serialnumber
  2⤵
  PID:2816
- C:\Windows\System32\Wbem\WMIC.exe
  wmic cpu get serialnumber
  2⤵
  PID:4216
- C:\Windows\System32\Wbem\WMIC.exe
  wmic bios get serialnumber
  2⤵
  PID:8
- C:\Windows\System32\Wbem\WMIC.exe
  wmic baseboard get serialnumber
  2⤵
  PID:2292
- C:\Windows\System32\Wbem\WMIC.exe
  wmic path win32_computersystemproduct get uuid
  2⤵
  PID:1684
- C:\Windows\system32\getmac.exe
  getmac
  2⤵
  PID:4012
- C:\Windows\System32\Wbem\WMIC.exe
  wmic diskdrive get model, serialnumber
  2⤵
  PID:2928
- C:\Windows\System32\Wbem\WMIC.exe
  wmic cpu get serialnumber
  2⤵
  PID:2588
- C:\Windows\System32\Wbem\WMIC.exe
  wmic bios get serialnumber
  2⤵
  PID:2492
- C:\Windows\System32\Wbem\WMIC.exe
  wmic baseboard get serialnumber
  2⤵
  PID:2096
- C:\Windows\System32\Wbem\WMIC.exe
  wmic path win32_computersystemproduct get uuid
  2⤵
  PID:3844
- C:\Windows\system32\getmac.exe
  getmac
  2⤵
  PID:2804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 1a93a08c7e08d626d98c5c74761d23637cc62a700d3b8199cceb42058c4dd23d
MD5 66fe86e7664a6ebee07cc7598d4ab341
SHA1 8f52c52d686507ce320d20ae91a1dece70f01a7c
SHA512 1357760e71c90841a4fddcf7f633bb2b0fcf980889f0086d366996e4d826773c112d8d22b288b5b299240644a1eb8d3e142899eea4cef4c9c1043d9fa35b34a1
TLSH
T13FE02BB9C920AD2B08FD072925590B46E768231B6B40455B3B3CC2098FB9636059AC1C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 572aa36eed30aa2e53ff864720b39724f1c986a96ced3c3c5dba95b76548c54a
MD5 10044e1d3bd30057f1ca821e13e2f6cd
SHA1 eb1701132b0aefbf1b4fe43042bacdb6940a4bce
SHA512 46309af4209672464d35ff501fc5c63e4c97d55bb1452ccc90cf87fc10f1928d9eab41d6d4cd8fc60edf67da4e8ba191ff2c6c874693aae783ceeb6f781b8d13
TLSH
T1FB51CCBE239B2841EF855B741DC91803BCFBAD17401B1E5E1160F971F1913745C3A9D1
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 32b5b40dc2aa6aaa8fb2f01ebf520be47bce8295178e57b47222c2713e9747de
MD5 ab83dedac82a8662b0379268212a8d1c
SHA1 2dc396358238e860da20ea3c4e258c2613b02927
SHA512 b90bfa4fc3b787fba242be149d7e85ddef4459f043bddfe986f8a1b9af835a568efe8f26917410286670345b00568c4d0cdc44c5e8fa3f6c74629c88148b542c
SSDEEP 192:4RIcBhgdJ0lNfuv72ympAPRp2M8OfVD95Hsb+WN4c1hf4rh2jZeIp7saFVyIsnA4:4RImhgdMKQUXRV7w/K2Dwaz8
TLSH
T1F952E72BA96029779DDBC31AF9627753E7F5102624D41E40EBFC8E2C08E7ACC221B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 bd7c9b8a51c628f65115e52f7411fce3c24b5bbd3fb6fb6f6ddcdda901f41ede
MD5 cc640a42f51f89da6bf2c0c7c8372098
SHA1 00ba5308e1f2354503259f0c486bc1e5953e3487
SHA512 1c447a394b889b6459b45076183f09a8f344809b2d249ff99c0f037669b84453ad6e7007f45f8806bcd1d5172a171351d4882508a6ef5b9adc337bda314d8420
SSDEEP 192:4RBcBhgdJ0lNfgv72ympAPRp2MIj95Hsb+WNnhf4rh2jZeIp7saFVyIsnAUgtaJ:4RBmhgdM8QUXU7wVK2Dwaz8
TLSH
T13052E72EA96435779DDBC31DF9627753EBF5102625941E44EBFC8A2C08E79CC221B02B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 93a969d5494520a313d59c847d3ee10e51ce49e2c8cea4f6ea38850cfab527d0
MD5 65eaa0a57fc2a07c6f5f8e9c22429ba6
SHA1 83b5d3c038efb456e4191e45a08c6c1cf8b7d43f
SHA512 2f69609ebf02ccda7dd197a901863ecdf075cd94dce3ddcaf8f69f28aa522eed4a257c71ee04de563d2d250a18b8f7b4dfd5e90247d3586bee22fe519ccbce35
SSDEEP 384:Q+jM77KxkXqKf/pUZNCgVLH2HfgslAG7pLuLcSjW3XODM3+ErU3oPHGqkkpLtE:QOM77KxkXqKf/pUZNCgVLH2HfgsSG7pu
TLSH
T136720A67684C9A370F94CACCDC16BF4FACB5025B65ED886492FA5C1503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 300d67d1aafa4e716af8e454b2642639813c6e4eb57fff5943797b0810a1ed05
MD5 399c997cbac938ca3efc8ad3914dc1e1
SHA1 26fdf44980c323fc060ec18384b24f7ab0c0784b
SHA512 bb3861073214f353cc7f0c62080d366fd3e6abb22973ed951fa978b2b732dd9248188697a2a8457dccd219c440d354847664a5724da207a65048ce748bd7ec9a
TLSH
T1D5B0124084025202C40203F4114275887158DF10960E1B0983F0B9269C26550C035150
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58bd6f.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58bd6f.TMP
Size 96B
SHA256 6f988a806e8564b2fc1748a21384772e6e1630c9b716a9288703d6cf0808dec8
MD5 7714a6e8298437b78ad85ab2676a44a3
SHA1 393dc8a5a038f8aa16bc8be7f9f6276515c27881
SHA512 70f73bef66f754121f26b4cbf5160caac33cb8697da64625b8df8cfb2bc26975dcb1c5c5dc9b7d656bc8731804d8fe29049ba6392341c6decd01f4bccae37449
TLSH
T161B02200C0022323C0020FB028C0A0C8F320EF20C2830202E2F00E3FCC20220003C020
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 ceb0ba52a0ebbabd4e88b1d27d8c8dc8612d56c939225859b4f57b095daf0757
MD5 4971ec64e000bcb5fb8b032c5f12d868
SHA1 508c6e6e1ba91dfe3083caf670d69c4c84ca5e15
SHA512 6532090aba76d9d98eece0a8682f8f9c19d905439aee034102e7217bec0c7469ac8f37a005ff5664f19803817f1bf7d222caf04fd0748356d643016004b1cb4d
TLSH
T10FB0222000008C23C8088332C2C008E833322C0833830223A0E008F0C022B0303333A8
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 082195e9bbc3f41d61ae507164ec99dbb31d57b5dcf812536843a02a26abd526
MD5 1a6cf864c2df2b981d6b540b62d0d782
SHA1 b12ed9e845d840c55f47bda9a57bd533582040e8
SHA512 4eb1ca63fd63cf0ffe45609a2e63882595edcae2fd606327411a46873fb7ad2b7ff1f2591148ecc3a1cc813597ee097ac6f62821c5ecafc1f02d4e0ea5aefd74
SSDEEP 1536:TQQyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjf:pqfd7NtZL8cHQRZEQ6Spsk
TLSH
T195C30237DBC21F339E92CB64B9530FD697B644A59034D301EA6D77BF6C83891644289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 f5f48ab1d68d89dfa11d01fceed9ffc85832eac76774c0f0dc05677b020c423b
MD5 370f5cc3d0de2de4d6d0933e6d128d3d
SHA1 6ec778e95bd964d4b989e3f744bf44839d62ede9
SHA512 30ce506afc4f3179682fe5cca593c8a69203be12612cb9bb6ee5f137c89e1b650361dc727c0e94d953f6cd7c9066fa308cbb62441a630a8967f1040381a1d7fc
SSDEEP 3072:fHIZxUqgfMBXcK+ggmD0SpflY2z56ovsaDqAaqfd7NtZL8cHQRZEQ6Sps5:fqSVMKKDgmYSpy2F6ozuqZ/ZLW3Ex5
TLSH
T182342373CFDAAE274E66DFB5A5574E2FE3F00A966031C214CB5D6E8F096398604138E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pxmap_240715093.exe

Path C:\Users\Admin\AppData\Local\Temp\pxmap_240715093.exe
Size 138KB
SHA256 57832f7a25c5cd0dfca09c54d0019e4f19a0d27a949a92dc68baf35b72be8211
MD5 365fc713b2097470bd269602b5d54eb2
SHA1 4e237fb146ed252246ad81231294f877edbc35c7
SHA512 5033693df40f39a568967b26977603c353d59e538d43da430838875d5955181cc5533a3ae8de4aaf23b8841046e72f970f539879f44c17a633b72df08ead29d3
SSDEEP 3072:ejVYisyVqzOSDMbfVP+qmJTQSaMm5/6Ygnzg+zOG:ebsyVqzOswfUWlBgns+q
TLSH
T112D35B2BE659207ED2A6D9BDCA524912FBB27C850751B7CF136049B60F627D06F3E302
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

check.bat

Path C:\Users\Admin\Desktop\check.bat
Size 454B
SHA256 56e0af9513d41127dd33933116970b3d2560d0586f7a64b6ffdf215d1fc762ab
MD5 fa70cdbb3fc5fc08aff5db9270dd662f
SHA1 87e21ed26ae37cfa14a56ff000f3c29dedfa23bc
SHA512 8e44ad0ac87ce8335377dc2f40d5b3960e727ffd5387e0b1b411e03e9b772dfd21c523fec45327edd04b2ae4226ec4def4cc4783f3484b5f3e80e24c4ae2a826
TLSH
T1FDF06D25D6698F5058B456295B3084C238240007481A36DC5DBDB6059F5E9CE2BF396E
MD5 SHA1 SHA512 TLSH

Submit Download