e2701c0554ab61535e4f81ca177b83117d3e320ea4309148d1e1e49540b80cb8

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/06/2026, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_e2701c0554ab61535e4f81ca177b83117d3e320ea4309148d1e1e49540b80cb8.exe
Size 1.6MB
Sample260621-e4bgnacv2t
SHA256 e2701c0554ab61535e4f81ca177b83117d3e320ea4309148d1e1e49540b80cb8
MD5 8a59335890c57e4044b32810b8d48c81
SHA1 5dd58e5e940647f3210ef7814f4d7231397cb798
SHA512 a1b7b8bbe9fba15a4a9c8b3be033bd41da29c28ba5fbe53458c305f84ae9ef9de972f4a746255a046c20b1b7fe2ddbb1cf01ba8df7b5ab06903237b1efb3f259
SSDEEP 24576:Kt5OaCy5sGQihRIDde2KYBPJuD8hn0WROhGthLdhsX9MRmIE+76jFN4z1f9iufa0:KnOSP92NBxuU0BhWIMRae6jFNe1Vda
TLSH
T1F485CF58E95C8C68FA3AC075896E24D7EA232987FF3019D3035B22960F67FDE5974E10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence privilege_escalation spyware stealer

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	2136	rundll32.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	_e2701c0554ab61535e4f81ca177b83117d3e320ea4309148d1e1e49540b80cb8.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Loads dropped DLL 1 IoCs

pid	Process
2136	rundll32.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\K9aLsW7JZTvCS = "rundll32.exe \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\MY8XF8wwVxFgP\\MuLgzs9yWInIu.dll\",DllRegisterServer"	rundll32.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2076	PING.EXE

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4296	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134264897692288936"	chrome.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{E5B4D2A0-C9D8-4E3B-B6D4-7F2E9C5D8B0D}	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{E5B4D2A0-C9D8-4E3B-B6D4-7F2E9C5D8B0D}\InprocServer32\ThreadingModel = "Both"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{BEB098D6-F8C2-4E3F-A1B4-3C0B8E2F7A1D}\InprocServer32	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{BEB098D6-F8C2-4E3F-A1B4-3C0B8E2F7A1D}	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{BEB098D6-F8C2-4E3F-A1B4-3C0B8E2F7A1D}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\MY8XF8wwVxFgP\\MuLgzs9yWInIu.dll"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{D4A3C1F9-8B7E-4D2A-A5C3-6F1E8B4D7A9C}\InprocServer32	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{D4A3C1F9-8B7E-4D2A-A5C3-6F1E8B4D7A9C}	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{D4A3C1F9-8B7E-4D2A-A5C3-6F1E8B4D7A9C}\InprocServer32\ThreadingModel = "Both"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{E5B4D2A0-C9D8-4E3B-B6D4-7F2E9C5D8B0D}\InprocServer32	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{E5B4D2A0-C9D8-4E3B-B6D4-7F2E9C5D8B0D}\InprocServer32\ = "C:\\ProgramData\\Microsoft\\MnaQ0BkXujbnc\\MtqS7840Peuf9.dll"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{BEB098D6-F8C2-4E3F-A1B4-3C0B8E2F7A1D}\InprocServer32\ThreadingModel = "Both"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{D4A3C1F9-8B7E-4D2A-A5C3-6F1E8B4D7A9C}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\MUggBfNCBQ7MJ\\MkoCm264J0ZU0.dll"	rundll32.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2076	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2136	rundll32.exe
2136	rundll32.exe
952	chrome.exe
952	chrome.exe
2136	rundll32.exe
2136	rundll32.exe
2136	rundll32.exe
2136	rundll32.exe
2136	rundll32.exe
2136	rundll32.exe
2136	rundll32.exe
2136	rundll32.exe
2136	rundll32.exe
2136	rundll32.exe
2136	rundll32.exe
2136	rundll32.exe
2136	rundll32.exe
2136	rundll32.exe
2136	rundll32.exe
2136	rundll32.exe
2136	rundll32.exe
2136	rundll32.exe
2136	rundll32.exe
2136	rundll32.exe
2136	rundll32.exe
2136	rundll32.exe
2136	rundll32.exe
2136	rundll32.exe
2136	rundll32.exe
2136	rundll32.exe
2136	rundll32.exe
2136	rundll32.exe
2136	rundll32.exe
2136	rundll32.exe
2136	rundll32.exe
2136	rundll32.exe
2136	rundll32.exe
2136	rundll32.exe
2136	rundll32.exe
2136	rundll32.exe
2136	rundll32.exe
2136	rundll32.exe
2136	rundll32.exe
2136	rundll32.exe
2136	rundll32.exe
2136	rundll32.exe
2136	rundll32.exe
2136	rundll32.exe
2136	rundll32.exe
2136	rundll32.exe
2136	rundll32.exe
2136	rundll32.exe
2136	rundll32.exe
2136	rundll32.exe
2136	rundll32.exe
2136	rundll32.exe
2136	rundll32.exe
2136	rundll32.exe
2136	rundll32.exe
2136	rundll32.exe
2136	rundll32.exe
2136	rundll32.exe
2136	rundll32.exe
2136	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2136	rundll32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
952	chrome.exe
2136	rundll32.exe
952	chrome.exe
2136	rundll32.exe
2136	rundll32.exe
2136	rundll32.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 2136	1924	_e2701c0554ab61535e4f81ca177b83117d3e320ea4309148d1e1e49540b80cb8.exe	86
PID 1924 wrote to memory of 3960	1924	_e2701c0554ab61535e4f81ca177b83117d3e320ea4309148d1e1e49540b80cb8.exe	87
PID 3960 wrote to memory of 2076	3960	cmd.exe	89
PID 2136 wrote to memory of 952	2136	rundll32.exe	99
PID 952 wrote to memory of 4060	952	chrome.exe	100
PID 952 wrote to memory of 4296	952	chrome.exe	102
PID 952 wrote to memory of 3664	952	chrome.exe	103
PID 952 wrote to memory of 3664	952	chrome.exe	103
PID 952 wrote to memory of 1716	952	chrome.exe	104
PID 952 wrote to memory of 1716	952	chrome.exe	104
PID 952 wrote to memory of 4756	952	chrome.exe	105
PID 952 wrote to memory of 4756	952	chrome.exe	105
PID 952 wrote to memory of 3868	952	chrome.exe	106
PID 952 wrote to memory of 3868	952	chrome.exe	106
PID 952 wrote to memory of 1660	952	chrome.exe	108
PID 952 wrote to memory of 1660	952	chrome.exe	108
PID 952 wrote to memory of 648	952	chrome.exe	110
PID 952 wrote to memory of 648	952	chrome.exe	110
PID 952 wrote to memory of 4352	952	chrome.exe	114
PID 952 wrote to memory of 4272	952	chrome.exe	119
PID 952 wrote to memory of 4724	952	chrome.exe	120
PID 952 wrote to memory of 848	952	chrome.exe	121
PID 952 wrote to memory of 1392	952	chrome.exe	123

C:\Users\Admin\AppData\Local\Temp\_e2701c0554ab61535e4f81ca177b83117d3e320ea4309148d1e1e49540b80cb8.exe
"C:\Users\Admin\AppData\Local\Temp\_e2701c0554ab61535e4f81ca177b83117d3e320ea4309148d1e1e49540b80cb8.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\SYSTEM32\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Microsoft\MY8XF8wwVxFgP\MuLgzs9yWInIu.dll",DllRegisterServer
  2⤵
  - Badlisted process makes network request
  - Loads dropped DLL
  - Adds Run key to start application
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2136
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --app="file:///C:/Users/Admin/AppData/Local/Temp/svc_bounce_240703500.html" --disable-backgrounding-occluded-windows --disable-renderer-backgrounding --disable-occlusion-tracking --mute-audio
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:952
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffaa768c728,0x7ffaa768c734,0x7ffaa768c740
      4⤵
      PID:4060
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mute-audio --force-high-res-timeticks=disabled --metrics-shmem-handle=1568,i,3955696752577884350,13951914057925049310,524288 --field-trial-handle=2020,i,6371310446900981955,14326327472322318403,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2076 /prefetch:3
      4⤵
      System Time Discovery
      PID:4296
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1664,i,7764865785217672098,2923878738000341987,262144 --field-trial-handle=2020,i,6371310446900981955,14326327472322318403,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2016 /prefetch:2
      4⤵
      PID:3664
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mute-audio --force-high-res-timeticks=disabled --metrics-shmem-handle=2392,i,16258355228855954569,17336124656672998702,524288 --field-trial-handle=2020,i,6371310446900981955,14326327472322318403,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2452 /prefetch:8
      4⤵
      PID:1716
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3136,i,1266420639824789611,15352892761850704525,2097152 --field-trial-handle=2020,i,6371310446900981955,14326327472322318403,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3188 /prefetch:1
      4⤵
      PID:4756
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3140,i,14114089791467837702,10981842814605692439,2097152 --field-trial-handle=2020,i,6371310446900981955,14326327472322318403,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3208 /prefetch:1
      4⤵
      PID:3868
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4516,i,9506884816251140998,17779540026115904793,2097152 --field-trial-handle=2020,i,6371310446900981955,14326327472322318403,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4532 /prefetch:2
      4⤵
      PID:1660
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4712,i,1857063748693539727,11958802196165034841,2097152 --field-trial-handle=2020,i,6371310446900981955,14326327472322318403,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4720 /prefetch:1
      4⤵
      PID:648
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mute-audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5572,i,10028759258075880916,10259905277382489643,524288 --field-trial-handle=2020,i,6371310446900981955,14326327472322318403,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5568 /prefetch:8
      4⤵
      PID:4352
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mute-audio --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5572,i,8219750806986226262,7604818891497680241,524288 --field-trial-handle=2020,i,6371310446900981955,14326327472322318403,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4956 /prefetch:8
      4⤵
      PID:4272
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mute-audio --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5580,i,10745416900813480972,4130480071566846842,524288 --field-trial-handle=2020,i,6371310446900981955,14326327472322318403,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3388 /prefetch:8
      4⤵
      PID:4724
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mute-audio --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5660,i,12151397822618688638,1475363825097649851,524288 --field-trial-handle=2020,i,6371310446900981955,14326327472322318403,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3416 /prefetch:8
      4⤵
      PID:848
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=736,i,10337731349045793345,7931970903561731461,262144 --field-trial-handle=2020,i,6371310446900981955,14326327472322318403,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4548 /prefetch:8
      4⤵
      PID:1392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp\cln_240697656.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3960
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 30
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2076

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 52edaec796478f2ceabe6abc37bf9587a3e4a4244671b12dd879d5cb84c55f2d
MD5 a25e475019d6c25d20446732f15528c6
SHA1 26ceca7f7b64efceb0a66545fc34b0f8fcb4d980
SHA512 6efbe41f05d58f12fcb33491593a09041e6280685ec0eaa9f4142d441eee3c285b82af128501c4b6e62a08cecf5cb5cebd39b3cbb5d136e93e5e4431d4f64053
TLSH
T158E02B9AC931EC375CFE579D50580A45EA1123572B60845F373C82088FB16B7058595C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 288B
SHA256 8526adf0f9076e53472abadc275baee9acfb141550ece3481e0983e3e9c970a1
MD5 edd86e4d56646b477ffd90d05e9572e9
SHA1 c6b93f1affc85d4af4582b55c07abd2cd33241f3
SHA512 5976a0cc897bc407dc6dc2bf134cc38147bf784a53b39254ee55c2a5afe6cace48f66f23af95626507bc4bcd6f01585f18ccb2c0dc440cd09436274890ee9b20
TLSH
T164D0A70469D54027D78406713A73058327392E0D4D06161E899C08697C6276DF7212D1
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 88a583db9e4b569afeecac32f11271cf34fc3b08e092a415c8611f7d5549a62d
MD5 f119be5096d39f387f46e87f052e6117
SHA1 1503e2058828e22a74acade8b1bc6dc686b3965e
SHA512 83532bee201c4d01d4f999e2d348dc5d23154bb5c3910cfd0fe688f32413f29cf349b55dd5e19acd49e3679932d32301ef9510be31d324b67d733aaa52cb1761
SSDEEP 48:YALlhsfhH+hHRhHrhHdgaXYfo7EdKsbgmzs9Trs9/tsq1csEqzsUBsN4s7Fs8R3a:DIYf1waIaEdNmo/1A0e77K
TLSH
T1DF8199F7D3E8852E894156F4AB156F1FCE2A0A24432C3C66C8D4AF1B93E2972D21535E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 78b071a60b503a9377f1396398e3426831ea73da809b6a47f6728fc3a7ed7428
MD5 08a201b197cf70041fa05e60bb28db6a
SHA1 5e10318c7fb8ed09a00f985a50fcd50696a03740
SHA512 a691b062381b23fa116de146fc7458f2233cd69879a732e64047675dae1c6a60ffccd085597fe02489cc28b907e6eb2aa77387e68c7c59b272eedbd02369492f
SSDEEP 192:IRP5qo98FeqeZ/v7ApAPRp2GYWs9qHsb+WNnwcPZqZNLHVyIsnAUgtaJ:IRP595kUXekwjPM18
TLSH
T1F652B82AFA14697BACDBD22AFE157723D7F5103531942E84E6FC891C28E79CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 13805701603dbbca9403b94e006c712edafb4f98a8e0ae4ce0ad1b025b835f93
MD5 28aca1b912d001e337a9e715a111a353
SHA1 177a8b35a6fa74a15deedffd79dc9066169fc496
SHA512 0e554b40f873ea651a22f9b91cf52ad45cc99b35e2db0e34845d695aa13aaf61497b6646f39f5b0ba26fc4a43100e92a0aff8ad949d0289fb397cfe00b0cede5
SSDEEP 384:V7jxY7KxkXqKf/pUZNCgVLH2HfgsluX7pLuLcSjvKXODx4+ErU31PHG0pdpS8gfp:V3xY7KxkXqKf/pUZNCgVLH2HfgskX7pf
TLSH
T1A4720967AC0C9E374F94D6CCDC277B4FADB5015B61E9886483FA981903D5BCA110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 36c44bc14f40f5daa2594afe0e04dcc201d48d563bd92837188c04fec64d777c
MD5 64cb84473a581c8d5d6ceec8a2b8b7ca
SHA1 35339b365a5593edd8cb17f7f7d198e470de0782
SHA512 894807008fbc50a6140bc7a13a5f18653f496a16eeb5ef4f6110e139c0fe2b149141967830587c49bf7bbffe8103573af09a8e3626a8959116399c06cce8e860
TLSH
T134B0120080019102C08246B0318214C871545F19970E170143E06D33CC652718428191
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592fd0.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe592fd0.TMP
Size 96B
SHA256 9e45c9f2abf678ff600464b7ed598419b0371a4b16aabeedbc547743f2ba10f3
MD5 0511f9cd8745139059f6bb6f302a0e42
SHA1 85af2475e47b242e1d326dcb5d00ed9b6b70f13f
SHA512 e47de73d932074afe0c5ed7ae2c7cd414ea32915a0709c757069fd4720c1c3893864caaf391c3fd246c3f752206996d9174b2b9b731f58ecb43debe666169a17
TLSH
T182B0220CC002B203C00203B03C8080CC32A0CF2CCB03022283E00EA2CC30A300A20228
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 104ee9bcabb64b9db52cb2da5c8d0b8857d6481b853bf632e0c0f010538f4613
MD5 3c9931fd864d628896c6388ef313cbd0
SHA1 109bb2808db8d906c75db8b0930f057c8a9746ba
SHA512 dc429f7c1ec67e4f84f33128b7475d5440b033e5eb3cc399a3a02724cb8af65551b74230f40ec23d9b21909d20167c0cd9361356b3cd157520df1755161907a2
TLSH
T14BA0025513D01866DC40977332AD03416318A823213DCF63B0EB5254EDB718CE90B056
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 3a6f9827f00f0bd21c79a7a8b06a4bee1021e68d544f370f41f50d65b1d943fa
MD5 884812c0ca7cd3dfaba56c2a61338d82
SHA1 16af18eb94a6922d910e164a5e5b1484eae29982
SHA512 bfd5db0500a9a503e721674a1dbc030c68a0a90583e81ac78094abbf437f2ba014c8dc80df394c77beb5c1e338ef3f8a8a6cdf49b413de6e365da6ee9fca69d4
SSDEEP 3072:ANetoSKa6qMwgCh3hodf8U8+RhpN5Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrM6:Ee2wgARsUiR6m7Rkm1tYpBeh2BAo6
TLSH
T10C34123E1D91AC3B4DF6F709B04F6A6A1EB1CEB2D418C95584DC3E0872A99D94943E38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 253e1754ce4fa998b725e1eadbd1ceff1cd471c1b697ba7df85b776b246e83e9
MD5 5a164eae030c28ce03fe4f4657685a8c
SHA1 4a9fdf42a4a69afaaf349631b5c80232a90c3fca
SHA512 12f2d59e68d082741753ab41eddf4dda4dfaf603e73fc88b61d7dbf9f31559aea047a14ff1fb9aee0875a4f9624460bb636cb34b60ab9e4d5388eb195ccf4e11
SSDEEP 3072:AatoSKa6qMwgCh3hodf8U8+RhpN5Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrM6:l2wgARsUiR6m7Rkm1tYpBeh2BAo6
TLSH
T1B334223D1D91AC3B5DF2F649B08F9BAA1EB1CDB2D418C95180E86F0872A5EC94543E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 ea991a4b62e7e8e4d841a68ab11abf0839df1a5b146771751c556a31cdc03bf8
MD5 692362dc5115151971605c4beebcd9b9
SHA1 da3a7d4ad09d9240b420abaa36e5d1c1dec32c9f
SHA512 be5e19129bd1dca3ee52a35b1e92d3b3dc367e6d2a0009d570a92dcd3942a1e720d91f4a9bf1986b475937686712817c09e0325a382b38b484497c819c435c76
SSDEEP 3072:TatoSKa6qMwgCh3hodf8U8+RhpN5Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrM6:22wgARsUiR6m7Rkm1tYpBeh2BAo6
TLSH
T15A34223D1D91AC3B5DF2F649B08F9BAA1EB5CDB2D418C95180E86F0872A5EC94543E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 b63dbb03bb715cc3bb075da486b181cdb943dbd624bc4c76499efdd9b63c6286
MD5 82241f0da6b83cc3594ec3e63d11f1dd
SHA1 bdd93afb7256121bbe170ea034b603f005bc8f66
SHA512 4a7656769053cca724f80a17a1b680568dc3115d065e5db5bd9d87994f10312b7020699a68c70c29ba8dddd245d27e497dbd767d928bf9437ca66625489d742f
SSDEEP 3072:AjGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:hm7Rkm1tYpBeh2BAog
TLSH
T1F7C3023B5D75EC3B5CB5A74EB48E0B1E2EF149A6C920DE92C8D85A0437F97CD0A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DsZztPfODq01A.dat

Path C:\Users\Admin\AppData\Local\Microsoft\MY8XF8wwVxFgP\DsZztPfODq01A.dat
Size 1.2MB
SHA256 b0204edb64a87d3f7eb1a99d68106282fa87ae69b9716b94deff062a5d067375
MD5 44742f96b120767cf70dec59dce9bb86
SHA1 e228babc84c492ec75a461d77d7a89c321ed361e
SHA512 4b8eac93cd4d603de5158a4e5295c12320f2683f38c85f47367dfae411f7e3877995438e3bc869c1c8988ffcfac868df1ca22eaa9cffd6525349d3aa389664e8
SSDEEP 24576:fQihRIDde2KYBPJuD8hn0WROhGthLdhsX9MRmIE+76jFN4z1f9iufam:N92NBxuU0BhWIMRae6jFNe1Vdam
TLSH
T13545ADACE85CDC583E3DC5A6496C38EBB9130AD7FD2518E0016F729613A9FEE51B0D24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MuLgzs9yWInIu.dll

Path C:\Users\Admin\AppData\Local\Microsoft\MY8XF8wwVxFgP\MuLgzs9yWInIu.dll
Size 112KB
SHA256 c389a7b18089b0e4bc0442f69da52a9b464d681dd171c08b62062f772b1bbb6b
MD5 fe68543f2067f52ca34e9aef32bc614c
SHA1 20ac08f44b979cd788eabdf8a3e8ec9b74bf9ff0
SHA512 a1831d5aca28bfb5c47804c699b73fa97e43e2608e4c2b9216a34a72857b1e6a0d09964ca6d5aea3749b10253b5c408a4e6faa006b72c8789bfe06319646e07d
SSDEEP 3072:f8jfNiyh5WWWschmh2lhPtzd3naZ8rVYrurDkctvpaPx+:i5HWspihPtBL/EM
TLSH
T17FB35B57A3E500BBE177827884934A45EB72B8164761AFEF03A4425E1F237D18D3EB72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svc_bounce_240703500.html

Path C:\Users\Admin\AppData\Local\Temp\svc_bounce_240703500.html
Size 159B
SHA256 36f647142346f627ac8c6439a11e1fa55e042eeb9ebc788a234eafc008f57176
MD5 f3241e8a401538bd1d844fdce064e94e
SHA1 792e4848d32a0f22ead124a4b921d4e24ee16d89
SHA512 f5ec2f68646f1e28a381712af94e2b09e6a4f32e2adda9148378775fdfeb649012bc6e87b04940897832e1ec06a20f3f3fb5106e1c21474c189fc6b207d4111e
TLSH
T146C08CFB7810F04AAAD0B29099F2B15C187923540CC5C90420C03425880836ED8028DA
MD5 SHA1 SHA512 TLSH

Submit Download

cln_240697656.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp\cln_240697656.bat
Size 174B
SHA256 8ea9c8eced98a62e96298cf1f4cd81ac4507f70aaf9d46253ce677f405fc2227
MD5 dce6f69297ebda7474bd3b0a44902142
SHA1 87f3d3cc9f89fc78b6ca788304f1c7192a3d4734
SHA512 b41ed0be3391d022e92bb8726c1f6f264c607e82359d9330c84fd1316533f92897f1b8dacd5af8ac4cffc0aeaf241c79e90ac93163f0e5587d7e23589b12e026
TLSH
T194C08057705547E7520B207654ED294D9047C0CD1A8156650266447F66891E8D1B6ED4
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2136-9-0x000001DD47DC0000-0x000001DD47EF4000-memory.dmp

Download

memory/2136-34-0x000001DD47DC0000-0x000001DD47EF4000-memory.dmp

Download

memory/2136-39-0x000001DD47DC0000-0x000001DD47EF4000-memory.dmp

Download

memory/2136-37-0x000001DD47DC0000-0x000001DD47EF4000-memory.dmp

Download

memory/2136-28-0x000001DD47DC0000-0x000001DD47EF4000-memory.dmp

Download

memory/2136-29-0x000001DD47DC0000-0x000001DD47EF4000-memory.dmp

Download

memory/2136-54-0x000001DD47DC0000-0x000001DD47EF4000-memory.dmp

Download

memory/2136-30-0x000001DD47DC0000-0x000001DD47EF4000-memory.dmp

Download

memory/2136-72-0x000001DD47DC0000-0x000001DD47EF4000-memory.dmp

Download

memory/2136-32-0x000001DD47DC0000-0x000001DD47EF4000-memory.dmp

Download

memory/2136-33-0x000001DD47DC0000-0x000001DD47EF4000-memory.dmp

Download

memory/2136-27-0x000001DD47DC0000-0x000001DD47EF4000-memory.dmp

Download

memory/2136-35-0x000001DD47DC0000-0x000001DD47EF4000-memory.dmp

Download

memory/2136-31-0x000001DD47DC0000-0x000001DD47EF4000-memory.dmp

Download

memory/2136-16-0x000001DD47DC0000-0x000001DD47EF4000-memory.dmp

Download

memory/2136-23-0x000001DD47DC0000-0x000001DD47EF4000-memory.dmp

Download

memory/2136-24-0x000001DD47DC0000-0x000001DD47EF4000-memory.dmp

Download

memory/2136-26-0x000001DD47DC0000-0x000001DD47EF4000-memory.dmp

Download

memory/2136-170-0x000001DD47DC0000-0x000001DD47EF4000-memory.dmp

Download

memory/2136-18-0x000001DD47DC0000-0x000001DD47EF4000-memory.dmp

Download

memory/2136-19-0x000001DD47DC0000-0x000001DD47EF4000-memory.dmp

Download

memory/2136-17-0x000001DD47DC0000-0x000001DD47EF4000-memory.dmp

Download