850665a82ccd1b6087342af66385d17976a382d283b86dff4d3c9fba35315f33

Analysis

user interaction
yes
max time kernel
899s
max time network
878s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/08/2026, 13:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
vex - cracked.zip
Size 1.4MB
Sample260801-qmkjsabc33
SHA256 850665a82ccd1b6087342af66385d17976a382d283b86dff4d3c9fba35315f33
MD5 740882011b100f8207d592d421659d13
SHA1 06f991d22b41895641d67ec9c947719f79602322
SHA512 3e6c70b874b77a6d9e8be37e2f969e58a30328a8c8e97e87018875d95b1c2baa4add988d6673b0052705b1544d17c847986eb940b2fc139c11e38aed6fa503de
SSDEEP 24576:vcwQw2m45vn2BVcn4D9IclDlOj6utvv9upRs9qdL0D3I6B4lUlBuRFEeWFvfTX5W:vxovgcno9Icsp9Sj+3z4lwgFO3i
TLSH
T1E165332AA7C62716C17D42CE65A98B4F2CE972EA1200315CE1E5DF30471F8DAFA41EE5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5040	vex - cracked.exe
4572	vex - cracked.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4244	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134300644420743580"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4476	chrome.exe
4476	chrome.exe
5040	vex - cracked.exe
5040	vex - cracked.exe
5040	vex - cracked.exe
5040	vex - cracked.exe
5040	vex - cracked.exe
5040	vex - cracked.exe
5040	vex - cracked.exe
5040	vex - cracked.exe
4572	vex - cracked.exe
4572	vex - cracked.exe
4572	vex - cracked.exe
4572	vex - cracked.exe
4572	vex - cracked.exe
4572	vex - cracked.exe
1704	chrome.exe
1704	chrome.exe
4476	chrome.exe
4476	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeRestorePrivilege	4628	7zG.exe
Token: 35	4628	7zG.exe
Token: SeSecurityPrivilege	4628	7zG.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeSecurityPrivilege	4628	7zG.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeIncreaseQuotaPrivilege	5040	vex - cracked.exe
Token: SeSecurityPrivilege	5040	vex - cracked.exe
Token: SeTakeOwnershipPrivilege	5040	vex - cracked.exe
Token: SeLoadDriverPrivilege	5040	vex - cracked.exe
Token: SeSystemProfilePrivilege	5040	vex - cracked.exe
Token: SeSystemtimePrivilege	5040	vex - cracked.exe
Token: SeProfSingleProcessPrivilege	5040	vex - cracked.exe
Token: SeIncBasePriorityPrivilege	5040	vex - cracked.exe
Token: SeCreatePagefilePrivilege	5040	vex - cracked.exe
Token: SeBackupPrivilege	5040	vex - cracked.exe
Token: SeRestorePrivilege	5040	vex - cracked.exe
Token: SeShutdownPrivilege	5040	vex - cracked.exe
Token: SeDebugPrivilege	5040	vex - cracked.exe
Token: SeSystemEnvironmentPrivilege	5040	vex - cracked.exe
Token: SeChangeNotifyPrivilege	5040	vex - cracked.exe
Token: SeRemoteShutdownPrivilege	5040	vex - cracked.exe
Token: SeUndockPrivilege	5040	vex - cracked.exe
Token: SeManageVolumePrivilege	5040	vex - cracked.exe
Token: SeImpersonatePrivilege	5040	vex - cracked.exe
Token: SeCreateGlobalPrivilege	5040	vex - cracked.exe
Token: 33	5040	vex - cracked.exe
Token: 34	5040	vex - cracked.exe
Token: 35	5040	vex - cracked.exe
Token: 36	5040	vex - cracked.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4628	7zG.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
5040	vex - cracked.exe
5040	vex - cracked.exe
5040	vex - cracked.exe
4572	vex - cracked.exe
4572	vex - cracked.exe
4572	vex - cracked.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4476 wrote to memory of 384	4476	chrome.exe	105
PID 4476 wrote to memory of 3288	4476	chrome.exe	106
PID 4476 wrote to memory of 3288	4476	chrome.exe	106
PID 4476 wrote to memory of 4244	4476	chrome.exe	107
PID 4476 wrote to memory of 2132	4476	chrome.exe	108
PID 4476 wrote to memory of 2132	4476	chrome.exe	108
PID 4476 wrote to memory of 4180	4476	chrome.exe	110
PID 4476 wrote to memory of 4180	4476	chrome.exe	110
PID 4476 wrote to memory of 4216	4476	chrome.exe	111
PID 4476 wrote to memory of 4216	4476	chrome.exe	111
PID 4476 wrote to memory of 4396	4476	chrome.exe	112
PID 4476 wrote to memory of 4396	4476	chrome.exe	112
PID 4476 wrote to memory of 1332	4476	chrome.exe	113
PID 4476 wrote to memory of 1332	4476	chrome.exe	113
PID 4476 wrote to memory of 552	4476	chrome.exe	129
PID 4476 wrote to memory of 3448	4476	chrome.exe	130
PID 4476 wrote to memory of 1276	4476	chrome.exe	131
PID 4476 wrote to memory of 1704	4476	chrome.exe	132
PID 4476 wrote to memory of 1888	4476	chrome.exe	133
PID 4476 wrote to memory of 1888	4476	chrome.exe	133
PID 4476 wrote to memory of 3712	4476	chrome.exe	134

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\vex - cracked.zip"
1⤵
PID:700

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3060

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff9c1fc728,0x7fff9c1fc734,0x7fff9c1fc740
  2⤵
  PID:384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,7488347806438146975,10956146090413966703,262144 --field-trial-handle=2068,i,6020955547397860704,15930717627462377894,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2028 /prefetch:2
  2⤵
  PID:3288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1616,i,2775740732650136816,13915168481630926056,524288 --field-trial-handle=2068,i,6020955547397860704,15930717627462377894,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2416,i,11432258529690781149,4063381554870749021,524288 --field-trial-handle=2068,i,6020955547397860704,15930717627462377894,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2584 /prefetch:8
  2⤵
  PID:2132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3268,i,17146628350482217099,9806753108526880778,2097152 --field-trial-handle=2068,i,6020955547397860704,15930717627462377894,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:4180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3480,i,7900983722086425479,9998481459703683249,2097152 --field-trial-handle=2068,i,6020955547397860704,15930717627462377894,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4496,i,4895722100949136848,1494302469170247812,2097152 --field-trial-handle=2068,i,6020955547397860704,15930717627462377894,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3848 /prefetch:2
  2⤵
  PID:4396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4732,i,6434170351004274146,10436305612266862354,2097152 --field-trial-handle=2068,i,6020955547397860704,15930717627462377894,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:1332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5436,i,4116944093251355762,9251792734650170327,524288 --field-trial-handle=2068,i,6020955547397860704,15930717627462377894,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  PID:552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5440,i,10003442022627242510,14000173807155863961,524288 --field-trial-handle=2068,i,6020955547397860704,15930717627462377894,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  PID:3448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5444,i,14779378832600705053,7378691566441914201,524288 --field-trial-handle=2068,i,6020955547397860704,15930717627462377894,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  PID:1276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4720,i,7923895203711780038,1110061031205138123,262144 --field-trial-handle=2068,i,6020955547397860704,15930717627462377894,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5512,i,16851624281513118098,10271527737709210996,524288 --field-trial-handle=2068,i,6020955547397860704,15930717627462377894,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  PID:1888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6224,i,15504790245151922589,1208031878697023348,524288 --field-trial-handle=2068,i,6020955547397860704,15930717627462377894,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6232 /prefetch:8
  2⤵
  PID:3712

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2760

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\vex - cracked\" -ad -an -ai#7zMap16511:84:7zEvent25052
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4628

C:\Users\Admin\Desktop\vex - cracked\vex - cracked.exe
"C:\Users\Admin\Desktop\vex - cracked\vex - cracked.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5040

C:\Users\Admin\Desktop\vex - cracked\vex - cracked.exe
"C:\Users\Admin\Desktop\vex - cracked\vex - cracked.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4572

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 ca827beb08972d46263af6276681f7e1d49f41957d1c1b141f538714591462dd
MD5 e6b61f979ab9076d7f0cb01a735a4d36
SHA1 ef67f8c96566fe9ea40073806e3bdb540768fcac
SHA512 20b171e2d379edce1bd25ebd8cdc3e5a44617a5f6e1392c655194fe91745f070549ed9464910a76470d53845349a5b2af14467366f63d2fd67883911c2381e4a
TLSH
T144E02B65CE22AC3728F81728A575870AEA9123576640985F373D910C5FB473A4786C6C
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 034c898b4204eef2019eccef1630340d402705be1ae2a8ec2caa3ae0b8ce2eff
MD5 ceba7146265f4803d9524fd8249129ce
SHA1 ac5ae18d7a15cd4f179028a43b2aa18591fb7e53
SHA512 cd51046869bd5d9eb3116f31ea584328c2aeff0f782881c156400fc7cae16f8e84f392db47894fb2798916c6eeb1179d2eb79a8b6bd58bb6b0366a2805a24355
SSDEEP 192:ZRlH/I5Rjui8v7MF+hAPRp2S9HHsb+WNnz50BUSkwpBVyIsnAUge:ZRlHER1ogo8X91wV0uSle
TLSH
T1FE42B76EEE1129BB6CCBC229FD227B53D7F5102131952E84EAFC8A2C15E75CD211701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 71d5f418128c47e801fca72caab5be6348b8d2a1f59b586b3f2b6949086b0933
MD5 0acb7a8f424cc706202d355c8b6f7a23
SHA1 59030c110f8fdda0924fdf609b29f678ad1d8325
SHA512 314ab5b9548b3badc3bd777571a5390ddbc1108d3e7bdf2590900452ad4374ac5ebb01155a5a679a7351cd0ed0e679d1f145fa95b1d7fb52b81a21dd7919665d
SSDEEP 192:ZRlHkI5Rjui8v7MF+hcPRpmS9HHsb+WNnz50MYUSkwpuVyIsnAUgraJ:ZRlHfR1ogokXN1wV0MxSMe
TLSH
T13552B66EED1169BBACCBC229FD227F53D7F5102121952E44EAFC8A2C15E75CD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 34d3b150d9ebc3413240a436dcd8cc4d2da0e46d00a681d2118263aea9d32f3e
MD5 73285efb9f7ee0bd384426865ccccf8e
SHA1 51903f2b7a36fa90857257254c2bebdfe5da7eef
SHA512 e9bab3e8a04453bd7ca516137298f57170d38058ccd5df170108532fdb6eefb2d5ae94de47967a5242cb07be597050bef4f69d7f740877c626e131f01424e28d
SSDEEP 384:TRjPq7KxkXqKf/pUZNCgVLH2HfgslT37pLuLcSjFgXODPO+ErU3voHGjBm2oR0h9:TxPq7KxkXqKf/pUZNCgVLH2HfgsV37pM
TLSH
T1287219676C4C8E7B0F94CACCDC167F4F9DB5025B65EA886482FA582903D5ADF01061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 921de300e22480f99de668010106396a07f4aba1f8e628540291c6bd2895e150
MD5 966fbcb64a0d1e5d98c3950e56cbaee7
SHA1 4d1c12dc663711d977b52fd3a34dbb002f1dbf64
SHA512 418d3236e3c313d6ba8d5273d9e5fcee99cefd274b8209deb08a888b1ab7627335b0cfac903d456743605114c709946a365790b9b7e3cc34a17b623a2b53147f
TLSH
T1E9B0125184415142C04742F42147148872549F159A0E1F0363E069738C7915080182A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe597083.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe597083.TMP
Size 96B
SHA256 d75d49b23f84cfd4724e84247fb320ce57cc1510f841033aa9728cdddb039de6
MD5 a04f04eeda477715844bd5cfc3b49672
SHA1 2d8072bcdd979834f4d28e1dc03b1783212032f9
SHA512 34aa5eab763bfe84d90eb8278644eb2ef97cb31c3719f78b5099d45752f48e2cef7deafbb5b33fe973583112709a9cc079147ec54d7f4acade5cbdc0aac432d9
TLSH
T1C9B02200C2022322C00303F02AA883E83320CF2AC203020383E00B32EC28320803B020
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 09bd7a2cfd86d6aa41da8b92de33e2808b1507154a7848410e1b4ab1c07a5068
MD5 ff44465ddc8c6037b1aa829b9f86d2b5
SHA1 d0f0e44c4951081c9908edee4bbd374d641bb1a9
SHA512 700c255788d47016bbccbe1514b4747719aaaa40960883e4aa82cef8d53483919406823fbdc4b85b289623f3e31983f6ea3c569fdebf8b8b3167bca0f6f1f403
SSDEEP 3072:/nGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:/Gm7Rkm1tYpBeh2BAoM
TLSH
T11CC312275E75E9375879BB0EB08E0B1F1EF14AA6D830DA92C8D86B0467F97CC1A05D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 9a349bd45adb980fecbaa37997b531c9f0ce1add953c76cd893b1eefc1e4bcd5
MD5 acc680f6730f2b1be74561fbd7b31184
SHA1 3634041d2f8dbdf07de0550cb87481b6753d9df3
SHA512 0709e2d5c25d2ec564d5ee4e6ae93c3e9e4c1538a45f421c046b66e0cf85b337f6001ee708412e652f7adaff4d990276797ce5c7a03735f83ee70c090d428703
SSDEEP 3072:lgGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMx:lLm7Rkm1tYpBeh2BAox
TLSH
T135C312375D75EC3759A9BB1EB04E0B1F0EF14AA6D820DA91C8D85B0823FA7CC1A49934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 7a4464572646e9532c204b862dae2b35adceac927ce1ef1cd00610aa0f6d7bc1
MD5 efcda4850e931b3026e8965225d038c6
SHA1 922a98a5ba5c45a90e2811304a9bb9d644831a21
SHA512 4d831f5455f50961ba5fd29963fec292dc76b05c0f0e736cba03fbe69a894950cf07214920f9325a9781078763eb0336bc4b505b8701ca40d53fcd3463903f3a
SSDEEP 3072:kgGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMx:kLm7Rkm1tYpBeh2BAox
TLSH
T157C312375D75EC3759A9BB1EB04E0B1F1EF14AA6C824DA91C8D85B0823FA7CC1A49934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 61437e4e20479d57caece0bb5fc765ec42e3cc3d8413a3d680a2d1210c5a9166
MD5 854451db975960072af67f83c567d54a
SHA1 1efe28b49973d91d26a11be2bed4d8aaee3a66fd
SHA512 0b9532b9b25437e5c79c414e9758d0811338a15d506d0f8d306e31cdfce2dc75b4e1a815bf766b6089a7b493b5c018e8c8854f586167c0bf11c31f7c1874de59
SSDEEP 3072:kCGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMx:k1m7Rkm1tYpBeh2BAox
TLSH
T176C312376D75EC3758B9BB1EB04E0B1F0EF14AA6C824DE91C8D45B0827EA7CC1A09934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 118KB
SHA256 24b0f80d2f019e31ef273348514e88a509253fd00148298edeaaa072167d24f7
MD5 8b7636895cce497d701d3ed496fffec9
SHA1 c236cdc1e4e5153e3adfd0ee5df3edf92d26373b
SHA512 dd0e57e2ab00608aeb770301541a963a42d5dcd26d9640fc590cf1b99112742d3a9554c4147e20b6257106db24e0ef1542ae207c930817519223e383d5d3bec1
SSDEEP 3072:gCwGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMx:gC7m7Rkm1tYpBeh2BAox
TLSH
T1B5C3023B6D61AC379DB5BB1EA04E161F0EF14B67C924DD85D8D82B0873EE68C1E09934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vex - cracked.exe

Path C:\Users\Admin\Desktop\vex - cracked\vex - cracked.exe
Size 3.3MB
SHA256 0a02a538aff69b104f536985edd0fad9781657ca375fc30aefc1264ba142a441
MD5 34c25fecc777476f6d8791707294eae9
SHA1 95c51eebd0ec02c2d54fd8de98104d1c8da1cfeb
SHA512 05149cacaaf386b3350bdf8a8dde18f0e06fb9b53a3acb58418b82933ed8bc6c2ba974c2feb0d47fc6c3b6b32c7a24599ae76887148ac10d4ff423ed0db90489
SSDEEP 49152:5DyRuNkpI544DWIw7rn6ODcrpWGeMMoT8+HE92hGLwE8Pnm8gapl/:ot64bVc1Wj+pl/
TLSH
T1F3F5C226A2A0419BC327DD7841CDD232A6E13CFC8AD4B19F96D07D977A126F019ED23D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download