6ef0a5fac4ccb9d8146917a29893fe8ce6ebaa3eb7f6189402462e288a8736c9

Analysis

user interaction
yes
max time kernel
150s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/05/2026, 16:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CrapInstaller.dll
Size 443KB
Sample260508-tx9s7set2r
SHA256 6ef0a5fac4ccb9d8146917a29893fe8ce6ebaa3eb7f6189402462e288a8736c9
MD5 82e12e6e66e6711106b27012d1dbeef1
SHA1 3d06ab461d370385815c292fbe08c601a7b69d15
SHA512 41916edcf834f810c16defa41bbe10cae554e2eb9c3c3d9f45684b0c93ff9c96025bcd783606df9fe05825fefc368e5b29f016b1385d52cf1c27eb5c1c0640f5
SSDEEP 12288:mUUtBBK7QgaSkrH8i1A4oY+ljM52YmHeOz:mzUQgCci1A4oY+VM52tHeO
TLSH
T1B4A479C3C0E314E9DF666A3923F46224069EEE051CAFDE351E0C466C4469B87996BFCD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WiiGSC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dw20.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CrazyInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WiiGSC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2900	chrome.exe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134227312707951056"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings	chrome.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\WiiGSC.zip:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
6088	chrome.exe
6088	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 4224	1712	rundll32.exe	79
PID 4700 wrote to memory of 4500	4700	chrome.exe	81
PID 4700 wrote to memory of 1100	4700	chrome.exe	82
PID 4700 wrote to memory of 1100	4700	chrome.exe	82
PID 4700 wrote to memory of 2900	4700	chrome.exe	83
PID 4700 wrote to memory of 396	4700	chrome.exe	84
PID 4700 wrote to memory of 396	4700	chrome.exe	84
PID 4700 wrote to memory of 5340	4700	chrome.exe	85
PID 4700 wrote to memory of 5392	4700	chrome.exe	86
PID 4700 wrote to memory of 5340	4700	chrome.exe	85
PID 4700 wrote to memory of 5392	4700	chrome.exe	86
PID 4700 wrote to memory of 5504	4700	chrome.exe	87
PID 4700 wrote to memory of 5504	4700	chrome.exe	87
PID 4700 wrote to memory of 4324	4700	chrome.exe	90
PID 4700 wrote to memory of 4324	4700	chrome.exe	90
PID 4700 wrote to memory of 5880	4700	chrome.exe	91
PID 4700 wrote to memory of 4412	4700	chrome.exe	93
PID 4700 wrote to memory of 4412	4700	chrome.exe	93
PID 4700 wrote to memory of 5856	4700	chrome.exe	94
PID 4700 wrote to memory of 5856	4700	chrome.exe	94
PID 4700 wrote to memory of 1932	4700	chrome.exe	95
PID 4700 wrote to memory of 2120	4700	chrome.exe	96
PID 4700 wrote to memory of 5320	4700	chrome.exe	97
PID 4700 wrote to memory of 5620	4700	chrome.exe	98
PID 5444 wrote to memory of 1696	5444	WiiGSC.exe	103
PID 4700 wrote to memory of 6088	4700	chrome.exe	107

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CrapInstaller.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\CrapInstaller.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4224

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb5cfdc728,0x7ffb5cfdc734,0x7ffb5cfdc740
  2⤵
  PID:4500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,7042205998001658183,9472716992166786277,262144 --field-trial-handle=1936,i,686801082245094932,7154558603192837313,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1932 /prefetch:2
  2⤵
  PID:1100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1508,i,7449185675631693407,3207203367712277390,524288 --field-trial-handle=1936,i,686801082245094932,7154558603192837313,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2300 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2400,i,16627995229709463062,9072690076224060200,524288 --field-trial-handle=1936,i,686801082245094932,7154558603192837313,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2568 /prefetch:13
  2⤵
  PID:396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,10829379080892206509,1412095657390655597,2097152 --field-trial-handle=1936,i,686801082245094932,7154558603192837313,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:5340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3288,i,11479453627677416209,14695257375250671295,2097152 --field-trial-handle=1936,i,686801082245094932,7154558603192837313,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:5392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4220,i,10308487032847207598,17413702475028880589,2097152 --field-trial-handle=1936,i,686801082245094932,7154558603192837313,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4228 /prefetch:9
  2⤵
  PID:5504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4632,i,5984731972642623920,18044100444999411036,2097152 --field-trial-handle=1936,i,686801082245094932,7154558603192837313,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4640 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5368,i,14155105629853844451,15637891031883850523,524288 --field-trial-handle=1936,i,686801082245094932,7154558603192837313,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5284 /prefetch:14
  2⤵
  PID:5880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5364,i,8110963611756814692,14533482830264849677,2097152 --field-trial-handle=1936,i,686801082245094932,7154558603192837313,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3460,i,16418142752277603161,3898964796547225244,2097152 --field-trial-handle=1936,i,686801082245094932,7154558603192837313,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:5856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3712,i,17723378117887238149,5787925533922483710,524288 --field-trial-handle=1936,i,686801082245094932,7154558603192837313,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3088 /prefetch:14
  2⤵
  PID:1932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4572,i,7340148852266420405,2386354198031524407,524288 --field-trial-handle=1936,i,686801082245094932,7154558603192837313,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4496 /prefetch:14
  2⤵
  PID:2120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4672,i,15230704467835085481,10833266800796450313,524288 --field-trial-handle=1936,i,686801082245094932,7154558603192837313,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3320 /prefetch:14
  2⤵
  PID:5320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5816,i,9221981817941607495,6190903698740982835,524288 --field-trial-handle=1936,i,686801082245094932,7154558603192837313,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4776 /prefetch:14
  2⤵
  - NTFS ADS
  PID:5620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5572,i,5351404340122751068,10380610788931242720,262144 --field-trial-handle=1936,i,686801082245094932,7154558603192837313,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1180 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6088

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5652

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2708

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:952

C:\Users\Admin\AppData\Local\Temp\Temp1_WiiGSC.zip\WiiGSC.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_WiiGSC.zip\WiiGSC.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5444
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 916
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Enumerates system info in registry
  PID:1696

C:\Users\Admin\Downloads\WiiGSC\CrazyInstaller.exe
"C:\Users\Admin\Downloads\WiiGSC\CrazyInstaller.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4692

C:\Users\Admin\Downloads\WiiGSC\WiiGSC.exe
"C:\Users\Admin\Downloads\WiiGSC\WiiGSC.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 6f8abcbd90c1ed4936f9cf3ba1c77e481ca5eff207a4942974da34690d197fe9
MD5 889890e1835c7be14c2186a6e1707c4e
SHA1 2ea582433a3db4da34a90191e12514d2a6c0656e
SHA512 8c4e6e5d03a46457163818ea58902dfc31345c9336cebf7fbbab76f738439aeaef9e465ab0bc99acd69552fcc01c3933d32cd5852782565dfe17b44d9f97651e
TLSH
T1A8E02BE6C865D8374CFE071864904766F741139B2740892B7A3D820D8F7063F5185C1C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 afd5820e1bb23292363356f9642e9e41c7d00c21b8836f427f2d084aaca4b522
MD5 ad7b057124e08e9e3184882fb4de350c
SHA1 f0eb952cc44931fd3cbf17a1211682cd14f56d7a
SHA512 de00aa1101e5decd31b8901ff4eda7814cf898d2628c05246ab0773624b9340bb929992c6f5a78cebf7570613acb28880fd15094268338163631371faecf536c
TLSH
T14B51FC2505CD966BEF76C87E68E40CD67731039A066B2F0702ED75F7216F7E1141C0A8
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 2e022cc9511980589cba434c40d682494d6d223db262dc7714e499a2c42e692a
MD5 9e9f78a4634a1bc3205616f4fdee25f8
SHA1 1e68bce93726d4568a19ab9b030339a08116ddff
SHA512 c7564d10a835ce10de5b92468340558fc46b15efe26649f32069a19d8fce209e439862d06efca20d4b8310b90cc552b845ba735f1b2b91950f3185ac4f053925
SSDEEP 192:DffbZZGAmd6aIakFqx3IMLIm8TNmtGmmmYmDmtmgPT:DffbZZGAmd6aIakFqx3IMLIm8TNmtGmO
TLSH
T1D8E1BCF3C7E9856DC91156F4EB15AE1FCE2D0614431C3C6AC8E4AE0B93E2872E25179E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 5632117e083d0238594daffdea65e8564ebf3b197801bf2817e25239e5856ad5
MD5 ae7af82c80a18955d1da3dde1ad73c28
SHA1 df56d4f9d9b57ad1ede3301ac6518f21b36211d9
SHA512 21dbbd398423f33dd243ac80c53a3c4a25d35aaebd607ec43a398f2c3e06d1341830f92280899d4d544a4e96b1e0c98515d8630461759528f28050bca5b18f46
SSDEEP 384:cIR+AKmzbSnmhCzzDyX6FUXrbwWuLX2u6F/W/8z0ai398:omzwmC/Ibw6HhM8PiK
TLSH
T11C52D62BF914253B5DEBD229FA11772BE7F2102165941E88EAFCCE1C25D79CD222340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 adedfe6a482f4838a2327b2dd4bc3e01a9e228cc57d621e7c4e0e8d0f9cd0c58
MD5 7608992e0515fc3db7431f49c7fce65c
SHA1 c5205aebb448f080675ca55c551cfc020d19f0a5
SHA512 8b5c99367b6ec03a8e68e879ba44989a7cb4280926631ff9479c29d23d367d4b29490dd9e0e3cd2251425aa6ec532c8b4dcbfad9ad0f2645dd574223eae0ad1f
SSDEEP 384:cIR+AKbSnmhCzzDyX6FUXQbw+uLd1j6F/W/8z0ai398:AwmC/Jbw5chM8PiK
TLSH
T18042D62EF914653B5CEBD219FA517727E7F6102121942E88F6FCCA1C25DB9CD222740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 9a9dfdd800690f45287c2fe71fe2f99c96bbf3b0abd372c108f67c0366fa624c
MD5 5b5747a1a6f99bc6566fcd5d794f6e37
SHA1 7f22c365ce0c5aa870d7130ce9a61511bead8157
SHA512 500d321e76ba7778b35d969d4314adbfb52ff01c4f4bd74b939b421015cbd0891dfde65a224a439e34bebb6d58f69ac894feb66fa83464e4d9540233489cdf6d
SSDEEP 384:cIR+AKmzbS5mhCzzDyX6FUXrbwWuLcG2b6F/W/8z0air9e:omz8mC/Ibw8mhM8Pi0
TLSH
T14A52C66BF954293B5DEBD219FA11772BE7F2202165C01E88A6FCCE1C25D79CD222340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 82f19bdaa200c3a3056c6486f8d9171c832143077338572b10c4c0ee03580c4b
MD5 80e775e497e26256725722f158c1a7e7
SHA1 24ed3e37ba5a437a46beacb73c33c43eae3aec98
SHA512 09ac01744410777e518bc948ab2c8649e18de947108d5d4afd77f70e32dbc68ce133ca9306edde725939c3c02ac6e14f160c2e4f358579e678e152b19c349bfd
SSDEEP 384:oSj0X7KxkXqKf/pUZNCgVLH2HfgslrL7pLuLcifyTXOD0b+ErU3wRHGU/QT:oy0X7KxkXqKf/pUZNCgVLH2Hfgs1L7pY
TLSH
T1E77219676C4C9E3B0FA4CACCDC16BE4FADB5024B65D9886843FA582903D5ACF11061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 e7aa9ee97a12a058a98b64e08176bb4d8af9bd9519f4fe0392105b5186ddb8b4
MD5 9315abb6451da726c50bae0d954be6eb
SHA1 062678409f57101f56513fde1d3c2a2265742582
SHA512 43c74eda3cacff4923c5e6044776018dbd5fcc97ea81fb882080125bcb9bf268642e7b3e93e90131cfebc4485f91bad2ed33d5f1a0c0c7b8355b2c4a3e2e14b9
TLSH
T100B01210C0015551C44303F41192888831145F109705130293F4BD71DC271B1A014170
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587903.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe587903.TMP
Size 96B
SHA256 d973c7fb8da2e4cbbf42b01b1fc7321cd50a4afb5a605071da0ba64c3d685be9
MD5 dcd5f52e641a60fbb2e8111a016a7521
SHA1 2d90f19a73e290771bb9212f794979ccf10de639
SHA512 bcf95ad0afb154746e86aef9c9cb1136d7bd41847f81ccc7504b81a729caf4604fee2f500bf40516ef94007da7c03c7d7809c7493a56bd3d8a750d8cb752e9a9
TLSH
T16EB00255C113F212C04203B125AAE5DE7164DF65E653223292F02E66DD266714925370
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 5607b9711b79fb12e82882f9685126c6b78d6d719f063e897eba3e6e9897b000
MD5 93663e9e2272715fc3570d1e1ea2c1b2
SHA1 fa4ad05ed6e9124a78a0358755496ef32305f585
SHA512 f12105e2cbcd4fd27402a7f6cc7a8b430f2ecba938aa9e733b68df1c0773ef179a60a69eca7a3cf2f75ffa2f5a53df9da6b94911ba5f87a51c6521e97a218b97
TLSH
T1D7A002108B4541CED492767294E2474137205C1125110747E2904348FFB01D04962C84
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 1a9ee8100026296a2cad415277aa25969c470ad3a8fc0ee18a1e0658d1352a52
MD5 2e2c32931e3338832eb4255f4689ef48
SHA1 a71066739ace868cb8e77c86629fce6dc165cbb6
SHA512 da17d1cb28396adfd9ddfc31b6c4da6ab40d034844ae7b71db3e07d70b7d024f2bece3f15b93927d6c3a9be96e87d6291d44fbe5e73f8c20436c434a29b9ac46
SSDEEP 1536:eG3IjP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNM:c7++J3qUQm08KMWF0bFTcVHr6zD
TLSH
T1919302B9991E7D75636AC6D690079CAC8CE3DCCE1514117C30C7AB1E28BE393A31B8E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 201KB
SHA256 bbca9fd3f6f165a97f70fee9a4bc3ae4fd9c3cd2a2d755d16a068165946aed2d
MD5 e05f0848a8b0f4973b6ea37d897a84c0
SHA1 cd1587d0d5d87b8f18429e99ac4ba8508481e612
SHA512 fcb6b45797b751d8e02b8816870124412fea11c7a8c70301062331f276f4660c3804b4e56d00d05196b137dc36f1b4a63d4ec891709bd8ded5c93eab91369fc7
SSDEEP 6144:5ppwTqcG8BYI1OC25ncdWGcr1Tb++JjcMW2VcVLW:5fw2mQC25ncdWN3OMWs
TLSH
T1E014232F7D1E7DB693AD52766002DC3DC4A7A8CC1144A43C316B170E2DA6353EA1F6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 202KB
SHA256 82c731fe01bf109e7b8d2207b11862c673bc149f2e547cce74a2b611202f685f
MD5 4b4b75b92063c7ed9f0b1fb935dfbb96
SHA1 2d2a9b4fc9e649d7adea1451d523061356cf53fc
SHA512 01fdfb2766c5bc131fb6b1f3ccc07b441ca748747febb13f65d07f5071e2f7aa5690d6deacddeff3df0f01622a4f81cd65924145fdfa3c9a013d3fb3e48eaacf
SSDEEP 6144:XvVpwTqcG8BYI1OC25ncdWGcr1Tb++JjcMW2VcVLW:Xzw2mQC25ncdWN3OMWs
TLSH
T19D14123F7C1E7CA6537D55755002EC3D8C96A4CE1248B83C316A170E2DA6393EA1F6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 201KB
SHA256 3ac5bd24c8c37ec6e3eae516f3737849eedbefffe6af27035078ed986bc04d02
MD5 b8f34d197d71699ca0cb7b2a2e7f2d56
SHA1 26a57ba0fcae64fb1ce412bc21a824fff47d3ffb
SHA512 0c801f153b5d784c97ed0a380a30e5e7e44832636e00d4144a5f3e1d848c0f41e29bf3245eefaeb0c16fb554b339af3e5cb3bd109fb44851c7b2b1f01f0ea6bf
SSDEEP 6144:CppwTqcG8BYI1OC25ncdWGcr1Tb++JjcMW2VcVLW:Cfw2mQC25ncdWN3OMWs
TLSH
T15514232F7D1E7DB693AD52766002DC3DC4A7A8CC1144A43C316B170E2DA6393EA1F6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WiiGSC.zip

Path C:\Users\Admin\Downloads\WiiGSC.zip
Size 2.5MB
SHA256 1da88f26ae48afad0815c4399190d92a2941d44cada3566dd026749d76672e82
MD5 02841e25c817528fb1a9980649f2154b
SHA1 516f44c0717670383c61fe296958849c7d6106cf
SHA512 a6eea8d058c897d7fbea72858ae76a453bf17c0aca84605b7975fe38498a4eeacf6b3b1b43a55aa9268e1fb8c94b9d3e9b672ce688b8437e103b6e46e69b4070
SSDEEP 49152:f42VS84/haMqeJ3Knw4l/QjO8msPPzckc+6nOF92cbP3XHRy7n2vYBVy/s4hPfk+:LVBqhIeJd0/QjgsPs+yOFccz3By7uYrg
TLSH
T12BC533D8D28981C8D68A757AD522FD47EA75D2E7A5331117E0542B2A3EE063C0F3A31F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WiiGSC.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\WiiGSC.zip:Zone.Identifier
Size 993B
SHA256 e0c57adbee5d881e8162441ad3753555cd39b73c98f2b623f07d183c6a44a197
MD5 fdd8fb1f004746b744f40b4a6f9c0676
SHA1 6fab853d0d7046d86336dfcd68523d90449d2839
SHA512 48b9be1dbadf285f4904017aa1f388d7b6c8e0b31ced33a5a7d6b095e62c16e10d1e49b6b2b0df1590c46aa85c952677e9905a34d080d40d8f092952421d2061
TLSH
T12D1121F6E028D62F1B0371829A5D8C6D7816E6AA8981425E5069C149D4804BBA4EB42F
MD5 SHA1 SHA512 TLSH

Submit Download

WiiGSC.exe.Config

Path C:\Users\Admin\Downloads\WiiGSC\WiiGSC.exe.Config
Size 1KB
SHA256 ad05b007301181d122c52b11fd5449d8a072c0c7901ece22b173a24572a939b5
MD5 02f2ba147f407620f75e6c4538a9fe2e
SHA1 e115baced3544147ef9193bebea26e58ffca7f49
SHA512 1a4e139bdd9b8a19933a3f3deb9673901814772cec32fcfed7fde216e9f48c4b41c8982a1bd08cf318fddb74072bd6bbe849f13b2f9537e92f91604732c451e8
TLSH
T11C21C11A2F42C863EE35459E64774E48ED3E64CF220504CCF469DA974EF68D461637C2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/952-432-0x000002604DEA0000-0x000002604DED1000-memory.dmp

Download

memory/1352-501-0x00000000063B0000-0x000000000648A000-memory.dmp

Download

memory/4224-0-0x0000000001520000-0x00000000016CC000-memory.dmp

Download

memory/5444-468-0x0000000075331000-0x0000000075332000-memory.dmp

Download

memory/5444-469-0x0000000075330000-0x00000000758E1000-memory.dmp

Download

memory/5444-474-0x0000000075330000-0x00000000758E1000-memory.dmp

Download