a71d919c91f68bb1fe37775bbe90da3d772a9f72d06bd2b6a63dd6a64d472e9e

Resubmissions

09/08/2026, 20:50

260809-zmyk3svhqd7

09/08/2026, 20:47

260809-zla4dsywbz7

09/08/2026, 20:46

260809-zkbnjadm213

Analysis

user interaction
yes
max time kernel
66s
max time network
62s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
09/08/2026, 20:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AleaSetup.exe
Size 1.5MB
Sample260809-zkbnjadm21
SHA256 a71d919c91f68bb1fe37775bbe90da3d772a9f72d06bd2b6a63dd6a64d472e9e
MD5 b68ad1c2e716fd2b3a8568fc41f5a111
SHA1 9f8c7c7c1d43650b4a18b229889197596c387f80
SHA512 833bc00db3ce6c1b72108db557beacf55aa8bb0111c35bbed12f3d354770195e45a3be1438cd1f71ffff5b3e509fb044b721fc9ab040ecf89f77ad2e1ef9e380
SSDEEP 12288:nxcpYp3dSzWRpAyRBWQqjhZdU35ph0lhSMXl8sPvd3kj3fy:nxcpYp32WRpAmkvEh0lhSMXl86v+W
TLSH
T1A975180769ED94FDDA0BC8B00A4F55C359213C9B4B915AEB35C4B6253FFA8B11F3A620
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5864	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307820444999083"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3084	chrome.exe
3084	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe
Token: SeShutdownPrivilege	3084	chrome.exe
Token: SeCreatePagefilePrivilege	3084	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe
3084	chrome.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3084 wrote to memory of 1200	3084	chrome.exe	83
PID 3084 wrote to memory of 5444	3084	chrome.exe	84
PID 3084 wrote to memory of 5444	3084	chrome.exe	84
PID 3084 wrote to memory of 5864	3084	chrome.exe	85
PID 3084 wrote to memory of 420	3084	chrome.exe	86
PID 3084 wrote to memory of 420	3084	chrome.exe	86
PID 3084 wrote to memory of 3316	3084	chrome.exe	87
PID 3084 wrote to memory of 3484	3084	chrome.exe	88
PID 3084 wrote to memory of 3316	3084	chrome.exe	87
PID 3084 wrote to memory of 3484	3084	chrome.exe	88
PID 3084 wrote to memory of 2888	3084	chrome.exe	89
PID 3084 wrote to memory of 2888	3084	chrome.exe	89
PID 3084 wrote to memory of 4080	3084	chrome.exe	92
PID 3084 wrote to memory of 4080	3084	chrome.exe	92
PID 3084 wrote to memory of 3872	3084	chrome.exe	93

C:\Users\Admin\AppData\Local\Temp\AleaSetup.exe
"C:\Users\Admin\AppData\Local\Temp\AleaSetup.exe"
1⤵
PID:5060

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5456

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xe4,0x108,0x7ffcdd3cc728,0x7ffcdd3cc734,0x7ffcdd3cc740
  2⤵
  PID:1200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1608,i,9220430376042978380,812346340648439818,262144 --field-trial-handle=1956,i,16342429174603663676,350882636414985585,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=1952 /prefetch:2
  2⤵
  PID:5444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1472,i,5262790326044395980,10124378784633217377,524288 --field-trial-handle=1956,i,16342429174603663676,350882636414985585,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2260 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2356,i,4888171319431212742,10592172621193020376,524288 --field-trial-handle=1956,i,16342429174603663676,350882636414985585,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2520 /prefetch:13
  2⤵
  PID:420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3228,i,11344289223803003573,11859048016643196794,2097152 --field-trial-handle=1956,i,16342429174603663676,350882636414985585,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:3316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3268,i,10651397260822863010,11823808766734530436,2097152 --field-trial-handle=1956,i,16342429174603663676,350882636414985585,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:3484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4280,i,10075711097355990347,6058665165054977424,2097152 --field-trial-handle=1956,i,16342429174603663676,350882636414985585,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4292 /prefetch:9
  2⤵
  PID:2888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=1624,i,4378347101194930945,17659888428268441922,2097152 --field-trial-handle=1956,i,16342429174603663676,350882636414985585,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:4080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5504,i,5787092824603034610,5835185891985005444,524288 --field-trial-handle=1956,i,16342429174603663676,350882636414985585,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5508 /prefetch:14
  2⤵
  PID:3872

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1528

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 736eac9fdcefae02ab16533e2821e50e87cd4f5461f8a1e8a45dc4a0d8701db9
MD5 cd77eccde9a286a2dc70051d9723698d
SHA1 0895d8050276c12e4f3109bbab5f4aea5f3ec2bb
SHA512 ddef217f981c6cf0e243f08035172a4c84e13406f33763506904262dc3e6a43beba15b4ea3909fae60653a3574417fb88e506fc4fea9dd86b09f825e01725476
TLSH
T1DFE061E9CD21EC2708FD471860504746E74113173781491F3A3C951C8FF863B5295D1C
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 73e711e4d459d704cc53f6f372ce2f85c59ae12f5fbe87f46e44e8182ada3b39
MD5 a91247578e2119e5e9fdde449f2e3248
SHA1 72e8196f5cb6af8c076dc73c740eb16b01cc52d2
SHA512 f09b249b34b6e9240261b2397b3a81a16fa9360f3f17e6bb8287aaf6b161ae56f546d4e72a1ec4796b22813601ea98fb3d0c5bae86fe50ecca9fb1d35275d81a
SSDEEP 192:mRf0tOJ7Ysqv7lpuhAPRp209fHsb+WNnuM0wfesP1+VyIsnAUgtaJ:mRf04mZg8XzRwV04o8
TLSH
T15B42C62EFA10693B5CDBD319F922BB53D7F5102525D51D80EAFC9A2C28D7ACC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 79ea521d9f3df87d24eec0f3607ae01ff8cf6eaeb5c7802f7c4721f58b8ddead
MD5 5d35f09b8c86835fb4877dcd0cc40e4a
SHA1 71d399e3fd153dc456fddb8f9cf7b1d428dcd2c7
SHA512 68050d4d5a4a4f94c2a29dfff1edf5350066ef5a2e47ef11dcbd09970c2009d28d7804e59c25d64e43ef8e1367105d32e929bef6a7a0e31d18837b193891b321
SSDEEP 384:WQjb+7KxkXqKf/pUZNCgVLH2Hfgsl5g7pLuLcSjQRXODaB+ErU39rHGQ3uKHaaK7:WUb+7KxkXqKf/pUZNCgVLH2HfgsLg7pn
TLSH
T1BF72F967BC4C9A370F94C6CDD8267A4FADB5024B65DD886483FA982903D4BCF110A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 14ad9b6576a643e295646ba92c6050db79322d1f4ed587fcf6b6f2a9030f72db
MD5 94e4f6a23ec5bc4c4911cc10f5f1d71a
SHA1 37d15c4d68ee8ccc176ce6dac51dd60c564cee75
SHA512 6bce664ad4afb435dad364aa9542f48d5b1799ff9ca444129e0e4c4b5ca351e621b6541a9e7010c49caece89f6b9af1544668eacc5173f934a78496895b3dc70
SSDEEP 6144:EX4NwhgqKR4ILo59R57lOYo8Gf+zfAk3WbhK:EoNweqYhLw/7legfaFK
TLSH
T153342361CA774FEEECB89DBE204417F29FF697D863F8B5028262B456354EA045314738
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 57ebc612256a1337c43fb5d60f63eca2a751e18adc74aada5f3d493ca325c54e
MD5 604d851d898dc70077f21388cc7d7e25
SHA1 b1a013f29da505f14d430d794015d71ddbee62e7
SHA512 4ebe059f9a4828bb0a95a88cecae519d01f68db8423ae32855d4570ef61b308bfd337d58fca7fec7eb82f365f5bb54c9c0b83346fc6def93dc581141bfa21990
SSDEEP 1536:nmueL6TFpmkUjlTArhJ+vgVuFM8r51TRB+BsJYuRZa8pSgeDAkwdqf8Wg+95h6mq:JDFpmzNA9J+zfAsJDREge7oWg+95hy
TLSH
T11FB30212CAAACE9BE4A45C79E4C413F3BEBE5F9527F1BA424166E4023DCE7042395770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download