Overview

overview

7

Static

static

5

AutoHotkey...up.exe

windows10-2004-x64

6

AutoHotkey...up.exe

windows11-ltsc_2024-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    342s
  • max time network
    342s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/07/2026, 08:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    AutoHotkey_2.0.26_setup.exe
  • Size 2.9MB
  • Sample260702-j7wn8aev5w
  • SHA256 2bf1b89b1047136490fc321d2fdc988b42dd86f693eea7872746ac6adf722bc3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
adwaredefense_evasiondiscoveryspywaretrojanupx

Malware Config

Signatures

  • Executes dropped EXE 10 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops desktop.ini file(s) 3 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies trusted root certificate store through registry 1 TTPs 6 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 9 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 1 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 5 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 43 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 19 IoCs
  • Suspicious use of WriteProcessMemory 63 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\AutoHotkey_2.0.26_setup.exe
    "C:\Users\Admin\AppData\Local\Temp\AutoHotkey_2.0.26_setup.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2080
    • C:\Users\Admin\AppData\Local\Temp\AutoHotkey_2.0.26_setup.exe
      "C:\Users\Admin\AppData\Local\Temp\AutoHotkey_2.0.26_setup.exe" /to "C:\Program Files\AutoHotkey"
      2⤵
      • Drops file in Program Files directory
      • Modifies trusted root certificate store through registry
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2652
      • C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe
        "C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe" "C:\Program Files\AutoHotkey\UX\reset-assoc.ahk" /check
        3⤵
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:760
  • C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe
    "C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe" UX\ui-dash.ahk
    1⤵
    • Executes dropped EXE
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:4716
    • C:\Windows\explorer.exe
      explorer /select,"C:\Users\Admin\Documents\AutoHotkey\Untitled.ahk"
      2⤵
        PID:2432
      • C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe
        "C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe" /script WindowSpy.ahk
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:980
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Drops desktop.ini file(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2968
      • C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe
        "C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe" "C:\Program Files\AutoHotkey\UX\launcher.ahk" "C:\Users\Admin\Documents\AutoHotkey\Untitled.ahk"
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1508
        • C:\Program Files\AutoHotkey\v2\AutoHotkey64.exe
          "C:\Program Files\AutoHotkey\v2\AutoHotkey64.exe" "C:\Users\Admin\Documents\AutoHotkey\Untitled.ahk"
          3⤵
          • Executes dropped EXE
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:700
      • C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe
        "C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe" "C:\Program Files\AutoHotkey\UX\launcher.ahk" "C:\Users\Admin\Downloads\hi.ahk"
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1124
        • C:\Program Files\AutoHotkey\v2\AutoHotkey64.exe
          "C:\Program Files\AutoHotkey\v2\AutoHotkey64.exe" "C:\Users\Admin\Downloads\hi.ahk"
          3⤵
          • Executes dropped EXE
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:5432
      • C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe
        "C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe" "C:\Program Files\AutoHotkey\UX\launcher.ahk" "C:\Users\Admin\Downloads\hi.ahk"
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:5812
        • C:\Program Files\AutoHotkey\v2\AutoHotkey64.exe
          "C:\Program Files\AutoHotkey\v2\AutoHotkey64.exe" "C:\Users\Admin\Downloads\hi.ahk"
          3⤵
          • Executes dropped EXE
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:4680
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:3676
      • C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe
        "C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe" "C:\Program Files\AutoHotkey\UX\ui-newscript.ahk" "C:\Users\Admin\Desktop\New AutoHotkey Script.ahk"
        1⤵
        • Executes dropped EXE
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        PID:2236
      • C:\Windows\system32\notepad.exe
        "C:\Windows\system32\notepad.exe"
        1⤵
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:3432
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        1⤵
        • Drops file in Windows directory
        • Enumerates system info in registry
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:1700
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0xc4,0x7ffc10c0c728,0x7ffc10c0c734,0x7ffc10c0c740
          2⤵
            PID:756
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1612,i,11115114928147661223,16782871026576067082,262144 --field-trial-handle=1796,i,9088394719102148199,11121129227763262518,262144 --variations-seed-version --mojo-platform-channel-handle=1788 /prefetch:2
            2⤵
              PID:6088
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1900,i,2997065821249050819,12025203301685818781,524288 --field-trial-handle=1796,i,9088394719102148199,11121129227763262518,262144 --variations-seed-version --mojo-platform-channel-handle=1992 /prefetch:11
              2⤵
              • System Time Discovery
              PID:1444
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2320,i,12986465649232847336,712552844003621599,524288 --field-trial-handle=1796,i,9088394719102148199,11121129227763262518,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:13
              2⤵
                PID:2996
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3260,i,1117885810591760754,11977792274435443361,2097152 --field-trial-handle=1796,i,9088394719102148199,11121129227763262518,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
                2⤵
                  PID:1380
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,9998162032758924296,1036401040119397232,2097152 --field-trial-handle=1796,i,9088394719102148199,11121129227763262518,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
                  2⤵
                    PID:5904
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4712,i,2338340188444423624,14835150384300676218,2097152 --field-trial-handle=1796,i,9088394719102148199,11121129227763262518,262144 --variations-seed-version --mojo-platform-channel-handle=4720 /prefetch:1
                    2⤵
                      PID:4472
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4744,i,11209774269893635656,12135415466279239175,524288 --field-trial-handle=1796,i,9088394719102148199,11121129227763262518,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:14
                      2⤵
                        PID:5792
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4936,i,8733912755834265307,17618086969095291900,524288 --field-trial-handle=1796,i,9088394719102148199,11121129227763262518,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:14
                        2⤵
                          PID:5600
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4880,i,3362929893221879749,8721588075207080950,524288 --field-trial-handle=1796,i,9088394719102148199,11121129227763262518,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:14
                          2⤵
                            PID:6044
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5180,i,2181150995684284968,16824673965656527426,2097152 --field-trial-handle=1796,i,9088394719102148199,11121129227763262518,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:1
                            2⤵
                              PID:3876
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4948,i,6021568970903660119,16345357820952557816,2097152 --field-trial-handle=1796,i,9088394719102148199,11121129227763262518,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:1
                              2⤵
                                PID:1932
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5628,i,7109899152479620290,7380695231534835957,524288 --field-trial-handle=1796,i,9088394719102148199,11121129227763262518,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:14
                                2⤵
                                  PID:2004
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5848,i,13834616551995121691,2257429010895052112,2097152 --field-trial-handle=1796,i,9088394719102148199,11121129227763262518,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:1
                                  2⤵
                                    PID:764
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5916,i,528528105793268023,17544839569947977292,2097152 --field-trial-handle=1796,i,9088394719102148199,11121129227763262518,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:1
                                    2⤵
                                      PID:2376
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6484,i,2128715046159026360,7597851496847117578,2097152 --field-trial-handle=1796,i,9088394719102148199,11121129227763262518,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:1
                                      2⤵
                                        PID:5492
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5888,i,10660054279139638455,9737138738997816854,2097152 --field-trial-handle=1796,i,9088394719102148199,11121129227763262518,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:1
                                        2⤵
                                          PID:1388
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6096,i,14457340079563588634,16940824134147897539,2097152 --field-trial-handle=1796,i,9088394719102148199,11121129227763262518,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:1
                                          2⤵
                                            PID:4592
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5792,i,780283152276321279,1841261438454744255,2097152 --field-trial-handle=1796,i,9088394719102148199,11121129227763262518,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:1
                                            2⤵
                                              PID:5608
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5892,i,7465409032480789026,17675234554523233877,2097152 --field-trial-handle=1796,i,9088394719102148199,11121129227763262518,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:1
                                              2⤵
                                                PID:3624
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6556,i,6588851223564017040,14253397278158617261,2097152 --field-trial-handle=1796,i,9088394719102148199,11121129227763262518,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:1
                                                2⤵
                                                  PID:2728
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5976,i,10992662143860550442,6378785075779442650,524288 --field-trial-handle=1796,i,9088394719102148199,11121129227763262518,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:14
                                                  2⤵
                                                    PID:4532
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6088,i,3653848022672562811,1912775689055688744,524288 --field-trial-handle=1796,i,9088394719102148199,11121129227763262518,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:14
                                                    2⤵
                                                      PID:5744
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6180,i,10203968434494522566,17780880011557656321,524288 --field-trial-handle=1796,i,9088394719102148199,11121129227763262518,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
                                                      2⤵
                                                        PID:5356
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=5392,i,8140487987314145627,1694614848327984181,2097152 --field-trial-handle=1796,i,9088394719102148199,11121129227763262518,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:1
                                                        2⤵
                                                          PID:5876
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6196,i,4608594753008787479,10120042788682977129,2097152 --field-trial-handle=1796,i,9088394719102148199,11121129227763262518,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:9
                                                          2⤵
                                                            PID:5808
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4800,i,12771892389963843118,17466765273777852105,524288 --field-trial-handle=1796,i,9088394719102148199,11121129227763262518,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:14
                                                            2⤵
                                                              PID:2004
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4788,i,5362205333249960252,7653917525887473474,524288 --field-trial-handle=1796,i,9088394719102148199,11121129227763262518,262144 --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:14
                                                              2⤵
                                                                PID:3196
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4792,i,4811894489492807157,3716610444458890198,524288 --field-trial-handle=1796,i,9088394719102148199,11121129227763262518,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:14
                                                                2⤵
                                                                  PID:2292
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6428,i,12661811670057301394,3494249617175636605,262144 --field-trial-handle=1796,i,9088394719102148199,11121129227763262518,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:10
                                                                  2⤵
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:2024
                                                              • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                1⤵
                                                                  PID:3060
                                                                • C:\Windows\system32\svchost.exe
                                                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                  1⤵
                                                                    PID:4760
                                                                  • C:\Windows\system32\svchost.exe
                                                                    C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                                    1⤵
                                                                    • Modifies data under HKEY_USERS
                                                                    PID:5524

                                                                  Network

                                                                        MITRE ATT&CK Enterprise v16

                                                                        Replay Monitor

                                                                        Loading Replay Monitor...

                                                                        Downloads

                                                                        AutoHotkey64.exe
                                                                        • Path C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.26_setup.exe\AutoHotkey64.exe
                                                                        • Size 1.2MB
                                                                        • SHA256 a2a54b8abc476d7671d4de0771bb54bf5f2373d79ff6871d0ba6a62c3b88ae00
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        installed-files.csv
                                                                        • Path C:\Program Files\AutoHotkey\UX\installed-files.csv
                                                                        • Size 2KB
                                                                        • SHA256 10f5119c21b30ad0a528bca80e08f47de639fcc022ff2366f998bbbadbb1de00
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        WindowSpy.ahk
                                                                        • Path C:\Program Files\AutoHotkey\WindowSpy.ahk
                                                                        • Size 159B
                                                                        • SHA256 c1908cfc4b224b3bc8d1a5c67cfe4acdb4e738d8acf98560905afc412981c18b
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        AutoHotkey Dash.lnk
                                                                        • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoHotkey Dash.lnk
                                                                        • Size 1KB
                                                                        • SHA256 c3ed78c3a82ab775b0987703edb21ffed17659170adf71b70facb05683683a41
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        AutoHotkey Window Spy.lnk
                                                                        • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoHotkey Window Spy.lnk
                                                                        • Size 2KB
                                                                        • SHA256 d07379c390166d777240dd59d58934fee2cc683525ba66259493fccf31290460
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        BookmarkMergedSurfaceOrdering
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                        • Size 6B
                                                                        • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                        • MD5 SHA1 SHA512
                                                                        Submit Download

                                                                        the-real-index
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                        • Size 5KB
                                                                        • SHA256 76ee3357ca9058ea99b47eba1d2d9367eba256e2618a1a1e6182e2d0f5ed2bf1
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        messages.json
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en_GB\messages.json
                                                                        • Size 593B
                                                                        • SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        craw_background.js
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
                                                                        • Size 531KB
                                                                        • SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        CURRENT
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
                                                                        • Size 16B
                                                                        • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                        • MD5 SHA1 SHA512
                                                                        Submit Download

                                                                        6e4a59c1-5685-4cb7-8076-d830fbb6782b.tmp
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\6e4a59c1-5685-4cb7-8076-d830fbb6782b.tmp
                                                                        • Size 5KB
                                                                        • SHA256 bd12caf4cd19f1cbdb33f247f607064f44d6d6c756e75fdb78c78812284deb74
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        SCT Auditing Pending Reports
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                        • Size 2B
                                                                        • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                        • MD5 SHA1 SHA512
                                                                        Submit Download

                                                                        Preferences
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                        • Size 11KB
                                                                        • SHA256 6c31c49fee4af6e30ca1fb5715ee00d9d1fe5399d58c7d2637e54648eaae2e76
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        Preferences
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                        • Size 12KB
                                                                        • SHA256 a41185173773f1b3827a1324eaf05680cffed14fb4bd92fbd09ea4b2d8585a05
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        Secure Preferences
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                        • Size 11KB
                                                                        • SHA256 3abc2ac4a2c5da65126576d58c56c0d597ad898ce7a2078d8f8edc661d9b9ec4
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        the-real-index
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
                                                                        • Size 72B
                                                                        • SHA256 ad6cfa737d16b84458a9941496edb47c56b092934929dcff23aa3ce11925e0ef
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        the-real-index~RFe5cb28e.TMP
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5cb28e.TMP
                                                                        • Size 48B
                                                                        • SHA256 583aa76fb9318222333764dac17b61ca93eb91762ce1e33e7c74927afec24c6f
                                                                        • MD5 SHA1 SHA512
                                                                        Submit Download

                                                                        data_0
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
                                                                        • Size 8KB
                                                                        • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                        Submit Download

                                                                        data_1
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
                                                                        • Size 264KB
                                                                        • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                        Submit Download

                                                                        data_2
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
                                                                        • Size 8KB
                                                                        • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                        Submit Download

                                                                        data_3
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
                                                                        • Size 8KB
                                                                        • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                        Submit Download

                                                                        MANIFEST-000001
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
                                                                        • Size 41B
                                                                        • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                        • MD5 SHA1 SHA512
                                                                        Submit Download

                                                                        Local State
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                        • Size 5KB
                                                                        • SHA256 12f524f7dd7b8ce8fd911c33fe1a61ce0b034a575c1da5273df05ea5400ff1b2
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        Local State
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                        • Size 4KB
                                                                        • SHA256 1c25e3598fda27abb3df9c015cb2cfce9d061ab5519685c9228ad5fb54a227cf
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        Local State
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                        • Size 123KB
                                                                        • SHA256 6927258e790d92a02af74b46086abedb025706d57c62f89e60f06e21abc87ade
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        messages.json
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1700_669733589\CRX_INSTALL\_locales\en\messages.json
                                                                        • Size 450B
                                                                        • SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        default.exc
                                                                        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
                                                                        • Size 2B
                                                                        • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                                                                        • MD5 SHA1 SHA512
                                                                        Submit Download

                                                                        Untitled.ahk
                                                                        • Path C:\Users\Admin\Documents\AutoHotkey\Untitled.ahk
                                                                        • Size 3B
                                                                        • SHA256 f1945cd6c19e56b3c1c78943ef5ec18116907a4ca1efc40a57d48ab1db7adfc5
                                                                        • MD5 SHA1 SHA512
                                                                        Submit Download

                                                                        hi.ahk
                                                                        • Path C:\Users\Admin\Downloads\hi.ahk
                                                                        • Size 44B
                                                                        • SHA256 54091eafde79c0141d30fb34a770f80584464c7d9dd8ec8a493e9e5a491cac57
                                                                        • MD5 SHA1 SHA512
                                                                        Submit Download

                                                                        memory/2080-0-0x0000000000400000-0x000000000095B000-memory.dmp
                                                                        Download

                                                                        memory/2080-2-0x0000000000400000-0x000000000095B000-memory.dmp
                                                                        Download

                                                                        memory/2652-176-0x0000000000400000-0x000000000095B000-memory.dmp
                                                                        Download