e53f8bdc8a739ad514cb2baccf370ec4df95786f79937f98ffddc954f3d8e31e

Analysis

user interaction
yes
max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 13:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
httpspastebin.comrawH3wFXmEi.txt
Size 70B
Sample260916-qmryvsbb24
SHA256 e53f8bdc8a739ad514cb2baccf370ec4df95786f79937f98ffddc954f3d8e31e
MD5 6b0ef488a40a2359273a48fa5e0a178d
SHA1 558f097074628334f5911422e90c41e1bb49f2d0
SHA512 dafb380f98f22aaf6d9c5855d553cf576e45a45d42fad43ac01b43063110c99790b6df68821bf8ecec7bd532f774ca7e38544597795eab769c2ac47db305d0dd
TLSH
T1F4A0029E48C793746FB294D165BAAD9C94134959C5B1D0D1B7B4DB361815163241431C
MD5 SHA1 SHA512 TLSH

Score

6^/10

discovery ransomware

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
26	pastebin.com
27	pastebin.com
28	pastebin.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4976	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134340386195080275"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5340	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5460	chrome.exe
5460	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5836	chrome.exe
Token: SeCreatePagefilePrivilege	5836	chrome.exe
Token: SeShutdownPrivilege	5836	chrome.exe
Token: SeCreatePagefilePrivilege	5836	chrome.exe
Token: SeShutdownPrivilege	5836	chrome.exe
Token: SeCreatePagefilePrivilege	5836	chrome.exe
Token: SeShutdownPrivilege	5836	chrome.exe
Token: SeCreatePagefilePrivilege	5836	chrome.exe
Token: SeShutdownPrivilege	5836	chrome.exe
Token: SeCreatePagefilePrivilege	5836	chrome.exe
Token: SeShutdownPrivilege	5836	chrome.exe
Token: SeCreatePagefilePrivilege	5836	chrome.exe
Token: SeShutdownPrivilege	5836	chrome.exe
Token: SeCreatePagefilePrivilege	5836	chrome.exe
Token: SeShutdownPrivilege	5836	chrome.exe
Token: SeCreatePagefilePrivilege	5836	chrome.exe
Token: SeShutdownPrivilege	5836	chrome.exe
Token: SeCreatePagefilePrivilege	5836	chrome.exe
Token: SeShutdownPrivilege	5836	chrome.exe
Token: SeCreatePagefilePrivilege	5836	chrome.exe
Token: SeShutdownPrivilege	5836	chrome.exe
Token: SeCreatePagefilePrivilege	5836	chrome.exe
Token: SeShutdownPrivilege	5836	chrome.exe
Token: SeCreatePagefilePrivilege	5836	chrome.exe
Token: SeShutdownPrivilege	5836	chrome.exe
Token: SeCreatePagefilePrivilege	5836	chrome.exe
Token: SeShutdownPrivilege	5836	chrome.exe
Token: SeCreatePagefilePrivilege	5836	chrome.exe
Token: SeShutdownPrivilege	5836	chrome.exe
Token: SeCreatePagefilePrivilege	5836	chrome.exe
Token: SeShutdownPrivilege	5836	chrome.exe
Token: SeCreatePagefilePrivilege	5836	chrome.exe
Token: SeShutdownPrivilege	5836	chrome.exe
Token: SeCreatePagefilePrivilege	5836	chrome.exe
Token: SeShutdownPrivilege	5836	chrome.exe
Token: SeCreatePagefilePrivilege	5836	chrome.exe
Token: SeShutdownPrivilege	5836	chrome.exe
Token: SeCreatePagefilePrivilege	5836	chrome.exe
Token: SeShutdownPrivilege	5836	chrome.exe
Token: SeCreatePagefilePrivilege	5836	chrome.exe
Token: SeShutdownPrivilege	5836	chrome.exe
Token: SeCreatePagefilePrivilege	5836	chrome.exe
Token: SeShutdownPrivilege	5836	chrome.exe
Token: SeCreatePagefilePrivilege	5836	chrome.exe
Token: SeShutdownPrivilege	5836	chrome.exe
Token: SeCreatePagefilePrivilege	5836	chrome.exe
Token: SeShutdownPrivilege	5836	chrome.exe
Token: SeCreatePagefilePrivilege	5836	chrome.exe
Token: SeShutdownPrivilege	5836	chrome.exe
Token: SeCreatePagefilePrivilege	5836	chrome.exe
Token: SeShutdownPrivilege	5836	chrome.exe
Token: SeCreatePagefilePrivilege	5836	chrome.exe
Token: SeShutdownPrivilege	5836	chrome.exe
Token: SeCreatePagefilePrivilege	5836	chrome.exe
Token: SeShutdownPrivilege	5836	chrome.exe
Token: SeCreatePagefilePrivilege	5836	chrome.exe
Token: SeShutdownPrivilege	5836	chrome.exe
Token: SeCreatePagefilePrivilege	5836	chrome.exe
Token: SeShutdownPrivilege	5836	chrome.exe
Token: SeCreatePagefilePrivilege	5836	chrome.exe
Token: SeShutdownPrivilege	5836	chrome.exe
Token: SeCreatePagefilePrivilege	5836	chrome.exe
Token: SeShutdownPrivilege	5836	chrome.exe
Token: SeCreatePagefilePrivilege	5836	chrome.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe
5836	chrome.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 5836 wrote to memory of 400	5836	chrome.exe	89
PID 5836 wrote to memory of 1136	5836	chrome.exe	90
PID 5836 wrote to memory of 4976	5836	chrome.exe	91
PID 5836 wrote to memory of 1136	5836	chrome.exe	90
PID 5836 wrote to memory of 5056	5836	chrome.exe	92
PID 5836 wrote to memory of 5056	5836	chrome.exe	92
PID 5836 wrote to memory of 4744	5836	chrome.exe	94
PID 5836 wrote to memory of 5784	5836	chrome.exe	95
PID 5836 wrote to memory of 4744	5836	chrome.exe	94
PID 5836 wrote to memory of 5784	5836	chrome.exe	95
PID 5836 wrote to memory of 3720	5836	chrome.exe	96
PID 5836 wrote to memory of 3720	5836	chrome.exe	96
PID 5836 wrote to memory of 4980	5836	chrome.exe	98
PID 5836 wrote to memory of 4980	5836	chrome.exe	98
PID 5836 wrote to memory of 3184	5836	chrome.exe	99
PID 5836 wrote to memory of 3184	5836	chrome.exe	99
PID 5836 wrote to memory of 5260	5836	chrome.exe	100
PID 5836 wrote to memory of 4036	5836	chrome.exe	103
PID 5836 wrote to memory of 4036	5836	chrome.exe	103
PID 5836 wrote to memory of 5072	5836	chrome.exe	104
PID 5836 wrote to memory of 5072	5836	chrome.exe	104
PID 5836 wrote to memory of 6016	5836	chrome.exe	105
PID 5836 wrote to memory of 6016	5836	chrome.exe	105
PID 5836 wrote to memory of 3492	5836	chrome.exe	106
PID 5836 wrote to memory of 3492	5836	chrome.exe	106
PID 5836 wrote to memory of 3856	5836	chrome.exe	113
PID 5836 wrote to memory of 4112	5836	chrome.exe	114
PID 5836 wrote to memory of 4244	5836	chrome.exe	115
PID 5836 wrote to memory of 5460	5836	chrome.exe	118

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\httpspastebin.comrawH3wFXmEi.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:5340

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff3d13c728,0x7fff3d13c734,0x7fff3d13c740
  2⤵
  PID:400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,15770311924665698861,16866808006769724780,262144 --field-trial-handle=1952,i,12847641103461113270,17273201746884182898,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1948 /prefetch:2
  2⤵
  PID:1136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2136,i,8296730748090715184,489228139131156820,524288 --field-trial-handle=1952,i,12847641103461113270,17273201746884182898,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2428,i,6227734235589702621,8265453957622958244,524288 --field-trial-handle=1952,i,12847641103461113270,17273201746884182898,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2600 /prefetch:8
  2⤵
  PID:5056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3220,i,16306189844560366693,14112011019216508270,2097152 --field-trial-handle=1952,i,12847641103461113270,17273201746884182898,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:4744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3236,i,12075358615209904483,14198260693666725199,2097152 --field-trial-handle=1952,i,12847641103461113270,17273201746884182898,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:5784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4368,i,1047631193966735672,4427267981751120178,2097152 --field-trial-handle=1952,i,12847641103461113270,17273201746884182898,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4388 /prefetch:2
  2⤵
  PID:3720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4728,i,6671428581224745406,16696175381462275554,2097152 --field-trial-handle=1952,i,12847641103461113270,17273201746884182898,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5516,i,4861836394842925345,6319637821863785267,2097152 --field-trial-handle=1952,i,12847641103461113270,17273201746884182898,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:3184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5736,i,11300052775837980533,4998744848442945175,524288 --field-trial-handle=1952,i,12847641103461113270,17273201746884182898,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5728 /prefetch:8
  2⤵
  PID:5260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5996,i,1426688964690929346,4312826923021947742,2097152 --field-trial-handle=1952,i,12847641103461113270,17273201746884182898,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:4036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4892,i,2224081177975227045,18207727483153779750,2097152 --field-trial-handle=1952,i,12847641103461113270,17273201746884182898,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3360,i,13766968008742286823,2422414600030696157,2097152 --field-trial-handle=1952,i,12847641103461113270,17273201746884182898,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3960 /prefetch:1
  2⤵
  PID:6016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3436,i,9390062914588550499,15669139487818291238,2097152 --field-trial-handle=1952,i,12847641103461113270,17273201746884182898,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:3492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6112,i,12768030463595671056,5942158237581453020,524288 --field-trial-handle=1952,i,12847641103461113270,17273201746884182898,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6092 /prefetch:8
  2⤵
  PID:3856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6076,i,8132447297608182356,11271266743680850852,524288 --field-trial-handle=1952,i,12847641103461113270,17273201746884182898,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3240 /prefetch:8
  2⤵
  PID:4112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6028,i,14961505699860811454,15006736955192839981,524288 --field-trial-handle=1952,i,12847641103461113270,17273201746884182898,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  PID:4244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5916,i,10876968899913583371,6189911260719130772,262144 --field-trial-handle=1952,i,12847641103461113270,17273201746884182898,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4556 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5460

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 a8b4a2dd309e6f22cacb4523f7af0fb1635392bed62a0d54ebefed1e9c2dbcc5
MD5 85193ffe27e36605dd16472bde162b3c
SHA1 ff9f6a53bf83ee787cbc0218b2fee5908c9265d8
SHA512 173c5dfa8c3ceabb933e8de6e9b052a83dd31529fc00c86589db0638115076c1a8ebbd90ff90a163e9a321e0f215943271e0353cbf5c26f6df6bdfcd2fdc92b8
TLSH
T13EE02BB6C921F83B19FD1B2D50108B87EB4513573681841F3A3D824DCFB8A3646CA81C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 37cba325d1e0c5a7ed68b619e5d0b0039cb97c5e21e2d9d18c91c64e033224ea
MD5 6886d7c59fbaff8ff3b0ea413128a666
SHA1 6a3921ab85194dc8f3dfd746d21504b35476dd44
SHA512 4fdec82b7071d5c27167e15cbf6046dc1ec70643837c19bf7de09432ef28caa9a156ec7645241ce30e25f348bd909f4812ea65b782da1a18c1257b78ee6e5240
TLSH
T14271BEF7D7D8863DC81156F49B217E1FCE2D0A24521C3C66C8D8AE5B53E28B2D21034E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 c240fbcf8b1a09f2e0f4be2bf7002d3d49f7b5d5462f634175bdd8f4abd900c8
MD5 9fec415c9f58a297193e36ec8b16c3d9
SHA1 4f61ccbb3f5eb94bdfe614b9c5520376dad34b83
SHA512 8311d967c1a9e11f88ce02411a08f03181ca2c490bccdda4fa92353155a854d50835a586caf0b95fcefe2a53fd4e20b1e67f560043652205c63947197b8473ed
SSDEEP 192:kR0BHOyg2++v7GpAPRp2/My96Hsb+WNnQIxjMI129seIVyIsnAUgtaJ:kR0BHxG6CUXZyswQOQa2w8
TLSH
T17042832EBD10653B5CD7C329F9657B97D7F6102624942E84EAF8893C11EB5CC321781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 893e46fa2e042ebbd810fa94a3b7597c8c561d8a0847be8d56a56e15d57cf3aa
MD5 7801ceea3fe1b451571ea39185f2ea5d
SHA1 2d3606744b219a755d3f253b5159313ef7d47300
SHA512 72540feccb7d44bf03e864fbb4b46e206889ce93fdcee8a97b27dfd94ca88a453caea6236881470068384e96e52bad0980754b198536fd6b5cd00959b68cdbde
SSDEEP 192:1R0BHOyg2+OlSv7GpePRp0T/MEYWy96Hsb+WNnII5eMI1mY/Isc29HseGVyIsnAq:1R0BHxGI+CKX3iyswIGraZs2ee
TLSH
T1FB52A32EBD106A3B5CD7D229F9657FA6D7F5102624902E88E6FC8A3C11EB5CC3217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 052b91746e915a0d53d1c4f49477dc44249382604fbb54f4cb997cbf22732e65
MD5 b59596e2d047a501f546249365db2642
SHA1 e80cdc3ed3c1c003dcb4be923b90e659ce454616
SHA512 e84ad007eedb1b2c4b338fbe61a2931f8f4959ab98348e0bd186eccd1afd32be5e39a18e1ce133c34ff85b59ff92c8c4ae6d83a3d393a2a8a432341aee80d448
SSDEEP 192:1R0BHOyg2+4Sv7GpAPRp2/MEYWy96Hsb+WNnII5eMI1mY/Isc29Cse0VyIsnAUge:1R0BHxG4+CUXZiyswIGraZs2de
TLSH
T12842A32EBD10697B5CDBC229F9657B97D7F2102624942E84E6F88A3C11EB5CC3217817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 291920720fef7c06e00899777ea604b34be97bd633209234fcaa416bae3f31c9
MD5 ae9aba6e17f72d61879b1ef9b9ae7179
SHA1 897368e2f473342a3db410985a480710b9d1bdf9
SHA512 e4c79935191005a554fafbe1ea78655d01155845d8a3e89e30eb9e425b8d483a937dd2abd51b2cfabe4ec20633b03f8307cd331fa67ce49dd1cd91717b181b02
SSDEEP 192:1R0BHOyg2+XSv7GpAPRp2/MEYWy96Hsb+WNnII5eMI1mY/Isc29RseIVyIsnAUg8:1R0BHxGX+CUXZiyswIGraZs2C8
TLSH
T13E42932EBD106A3B5CDBC229F9657B97D7F6102624942E84EAFC893C11EB5CC3217817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 2402969cd2ec72ea72b513389c43205a9ee2bceca1c456ef576613e3544e19a0
MD5 ef2f6beced6ed991eb5f4b124485b70c
SHA1 13ae98461b417e18835295fc68f98db326a5bad0
SHA512 5adbe06b2aba408c8975b2dfc7f1c8c160dc3367ebb5f8a049421cc510b871c0310b3c4cd24506c3615f6972ff559c98cb7cd22bc47816248c6501f19779082b
SSDEEP 384:tyjCjRyjH7KxkXqKf/pUZNCgVLH2Hfgslqq7pLuLceSzyjDXODRyjr+ErU3J6HG2:Ie0r7KxkXqKf/pUZNCgVLH2HfgsMq7pw
TLSH
T1A0720A77BC0C9A7B0F94C68CD8167E4FEDB5024B65D9886443FA983503D5BDA110A1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 30df21aa0d6520cdc274056462fedf3ea440c93c40d143c26ab2b2a3e1695806
MD5 d4d67c023c54f5aceddc15c4fecc962b
SHA1 ba52cd3e7c5edc2fe4986a4385f5dde6034f8689
SHA512 38523d8a2950dd14546cf941ecdb31bcf4da2738163deded5565820074d4352ac126b444a69f0673e45e004b71fc7bdf4976c56478a4d2d9c15c149bcb07737c
TLSH
T148B01216F0412301C0010370125090583660DF38D32233D941E00E02AC321A0445711D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599e59.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe599e59.TMP
Size 96B
SHA256 5f7391ea5e64ea035c59e9fa0a6af589a10c4bc17be26ba41e4bebdebaa3c3b1
MD5 daa34292ccb4ffa8e0bac17339cd9b01
SHA1 2d3b696b7b755675564e9c83554dd725aaadbabf
SHA512 5442ad4a9a23c78472453338282af6ac90aa94a18d8c0909a957da3fca00c00955bc7b85492b231ae60e05886833aab40a1765157625cc8796fe36b4da2bf1c2
TLSH
T1E6B00296C103A613C94243B0269595D8B169DF6DCA43332292E01A66EC7EA7245272A0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 261KB
SHA256 bb959fc8d095aa84d2da15520af8e3406049e8a598b4b33470b8830036ad4c03
MD5 0992a6dac36264949ba2960fa202d95a
SHA1 338f96d3ab6a0b8bd766b9a94fd166ba3ef5a1e2
SHA512 5b81260088dc1de390605016ee9818ee790d1010cc2cb6c025f1b838f8f2082c7aed48776100bd25cc1d490e47c13a20c02b67b2e3ade2338b7f8b5fedcc5f7b
SSDEEP 6144:Si89qVr8QY5JX234OdiWQKe/5+hFD+7t56OD9ZfSApprK:HrfsY3G/5yFSXD9ZfS4o
TLSH
T106442336EC51ACFB88BE61196417F20CCC97BCF9839A7B69444F1F4B405E96E0762632
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 262KB
SHA256 27e3c41c7f7b65055f36afdf7338c5aa03f7769cfa232926f3c44d04dfc581cf
MD5 5adb16389e94dac0782ad0bdfec9f682
SHA1 1726c83ccd0a841dd20b2ed9fe96f65e0ebab15b
SHA512 1bc9768d7075de3bab5bd17ad391531269bd8d071f7c5c0ef155ff863be869ba0da122467049f8900807283ef1b4a553035139fc7d47259e2ed31748d4bd44bb
SSDEEP 6144:Srn89qVr8QY5JX234OdiWQKe/5+hFD+7t56OD9ZfSApprK:urfsY3G/5yFSXD9ZfS4o
TLSH
T135442336EC51ACFB89BE61196407F309CC97BCEB839A7B5D444B2F47404EA6E0752A31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 7e04fdb2f4a11e0a5b66307939cd74864f42fbcb3660e8113ef9ea505386766f
MD5 34725a730605992250cd92964b444905
SHA1 b59537b38a9607f6889d3636a3872abd0bb06a30
SHA512 c269b765f55299129a142405934a030a08abd196d3eb6fac9012e7bc72f77712ecde51c2b2b872546e984ceae72a72722023ba04446a88e829301aabfe12ca98
SSDEEP 3072:yH+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+g0:yH+hFD+7t56OD9ZfSAppr0
TLSH
T1ACD31232BA95D877C9FC6581B187A300DE666CEE45DE3A09444A5F8ED09F84C07B3A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 c6144f1220e4eb223bcf11434bbce660d493926dfa8b66bf9c6b4d40a3e69468
MD5 c1f5b594380ce6847e03659094186289
SHA1 39869c60aff47a064b0df6728dd4e7675c2981dc
SHA512 064cb4efaa889fe23ef0658d7115ded41dd6587c58c2ecccf2eb2d174779ea752c1d66813b816b775cd1cf0ca167c93e5d46fcad05b8ded18f7bbb5b4c8e9a22
SSDEEP 3072:yp+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gB:yp+hFD+7t56OD9ZfSApprB
TLSH
T1F5D31232AA91D8BBC9BC6141B157A300DE766CED45DE3A09444A5F8EE09FD4C07B3A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 261KB
SHA256 b1e87a1dcc55f25b0bf8ff1273fe4b1926c25d3e88a45836ec6b53a1ed0a883c
MD5 e138ff1e085b6fe74532095960fd640c
SHA1 0ca598f3e4ff77e0d2ef3bcc23f734d30d47b976
SHA512 ce515525589757fbe775a54d5c5aabb805af6c9588b8d21238eacb568e88ca850e18e6f204e24cfae2139d7b2ed12784e9b6194347af9bb1a946239e14ab5162
SSDEEP 6144:Fi89qVr8QY5JX234OdiWQKe/5+hFD+7t56OD9ZfSApprK:QrfsY3G/5yFSXD9ZfS4o
TLSH
T101442336EC51ACFB88BE61196417F20CCC97BCF9839A7769444F1F4B405E96E0762632
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download