add444f8daae234c00f3dd712e2ce7460b772d29be32c569dbddac63541e1307

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BDY-KT_2024-KG.exe
Size 377KB
Sample260910-e4b37axfnc
SHA256 add444f8daae234c00f3dd712e2ce7460b772d29be32c569dbddac63541e1307
MD5 15496ac57fa6a9399a02c09e9c7ca1ee
SHA1 98f0165735b5b190ce975824a89232b3449d8607
SHA512 8049b6764fbbf2ee674158adb38fbd4bf8d49752751e87f64411b98c814a93e47a52284fb9bab893e7bf49a8973321788c71c23d1a241245b6cf91a7404b40eb
SSDEEP 6144:BZmKB24o/FpybjPuRS7AFQ/NpiIjPKmXkPv50iYDsYjuDqg2B+5odTpcnTrIxMcp:BkFFkPWFQ/fPjCP7KA9Vo/6TLo
TLSH
T17E8412ECB676EA07C6541976C640DBF4020ABD19CC08E34779D8FD9BBBB52218B463E0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery upx

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	BDY-KT_2024-KG.exe

Loads dropped DLL 1 IoCs

pid	Process
2900	BDY-KT_2024-KG.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2900-0-0x0000000000A50000-0x0000000000B14000-memory.dmp	upx
behavioral1/memory/2900-7-0x0000000000A50000-0x0000000000B14000-memory.dmp	upx
behavioral1/memory/2900-27-0x0000000000A50000-0x0000000000B14000-memory.dmp	upx
behavioral1/memory/2900-81-0x0000000000A50000-0x0000000000B14000-memory.dmp	upx
behavioral1/memory/2900-83-0x0000000000A50000-0x0000000000B14000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BDY-KT_2024-KG.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5020	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134334882098919717"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 34 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	BDY-KT_2024-KG.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	BDY-KT_2024-KG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	BDY-KT_2024-KG.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	BDY-KT_2024-KG.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	BDY-KT_2024-KG.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	BDY-KT_2024-KG.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	BDY-KT_2024-KG.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	BDY-KT_2024-KG.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	BDY-KT_2024-KG.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	BDY-KT_2024-KG.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	BDY-KT_2024-KG.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	BDY-KT_2024-KG.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	BDY-KT_2024-KG.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	BDY-KT_2024-KG.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	BDY-KT_2024-KG.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	BDY-KT_2024-KG.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	BDY-KT_2024-KG.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	BDY-KT_2024-KG.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	BDY-KT_2024-KG.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	BDY-KT_2024-KG.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	BDY-KT_2024-KG.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	BDY-KT_2024-KG.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	BDY-KT_2024-KG.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	BDY-KT_2024-KG.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	BDY-KT_2024-KG.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	BDY-KT_2024-KG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	BDY-KT_2024-KG.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	BDY-KT_2024-KG.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	BDY-KT_2024-KG.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	BDY-KT_2024-KG.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	BDY-KT_2024-KG.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	BDY-KT_2024-KG.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	BDY-KT_2024-KG.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3028	chrome.exe
3028	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe

Suspicious use of FindShellTrayWindow 39 IoCs

pid	Process
2900	BDY-KT_2024-KG.exe
2900	BDY-KT_2024-KG.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
2900	BDY-KT_2024-KG.exe
2900	BDY-KT_2024-KG.exe
2900	BDY-KT_2024-KG.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2900	BDY-KT_2024-KG.exe
2900	BDY-KT_2024-KG.exe
2900	BDY-KT_2024-KG.exe
2900	BDY-KT_2024-KG.exe
2900	BDY-KT_2024-KG.exe
2900	BDY-KT_2024-KG.exe
2900	BDY-KT_2024-KG.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 3964 wrote to memory of 5928	3964	chrome.exe	101
PID 3964 wrote to memory of 5020	3964	chrome.exe	102
PID 3964 wrote to memory of 5832	3964	chrome.exe	103
PID 3964 wrote to memory of 5832	3964	chrome.exe	103
PID 3964 wrote to memory of 3360	3964	chrome.exe	105
PID 3964 wrote to memory of 3360	3964	chrome.exe	105
PID 3964 wrote to memory of 5100	3964	chrome.exe	106
PID 3964 wrote to memory of 5100	3964	chrome.exe	106
PID 3964 wrote to memory of 6056	3964	chrome.exe	107
PID 3964 wrote to memory of 6056	3964	chrome.exe	107
PID 3964 wrote to memory of 2132	3964	chrome.exe	108
PID 3964 wrote to memory of 2132	3964	chrome.exe	108
PID 3964 wrote to memory of 5644	3964	chrome.exe	110
PID 3964 wrote to memory of 5644	3964	chrome.exe	110
PID 3964 wrote to memory of 2652	3964	chrome.exe	113
PID 3964 wrote to memory of 4580	3964	chrome.exe	118
PID 3964 wrote to memory of 1084	3964	chrome.exe	119
PID 3964 wrote to memory of 4548	3964	chrome.exe	120
PID 3964 wrote to memory of 3028	3964	chrome.exe	121

C:\Users\Admin\AppData\Local\Temp\BDY-KT_2024-KG.exe
"C:\Users\Admin\AppData\Local\Temp\BDY-KT_2024-KG.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2900

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x498 0x2f4
1⤵
PID:468

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffb1ff1c728,0x7ffb1ff1c734,0x7ffb1ff1c740
  2⤵
  PID:5928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2064,i,7748882660221555911,6660777301449641717,524288 --field-trial-handle=2036,i,6912676994256176018,6332290923138422423,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2072 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1748,i,9770089738635570690,15875308879396803743,262144 --field-trial-handle=2036,i,6912676994256176018,6332290923138422423,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1616 /prefetch:2
  2⤵
  PID:5832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2404,i,1712738549531388789,3896217354621115332,524288 --field-trial-handle=2036,i,6912676994256176018,6332290923138422423,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2572 /prefetch:8
  2⤵
  PID:3360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3020,i,1874703649443952024,3800074316769931895,2097152 --field-trial-handle=2036,i,6912676994256176018,6332290923138422423,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3024,i,2457899411006936729,5639343717041919787,2097152 --field-trial-handle=2036,i,6912676994256176018,6332290923138422423,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:6056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4304,i,11449266265222257011,17580211472827861976,2097152 --field-trial-handle=2036,i,6912676994256176018,6332290923138422423,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4316 /prefetch:2
  2⤵
  PID:2132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4600,i,6972615660412416223,14096811467976651716,2097152 --field-trial-handle=2036,i,6912676994256176018,6332290923138422423,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4592 /prefetch:1
  2⤵
  PID:5644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5516,i,7340624283338303959,7226780182301011975,524288 --field-trial-handle=2036,i,6912676994256176018,6332290923138422423,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  PID:2652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=1708,i,16840366075441085388,346713793955454451,524288 --field-trial-handle=2036,i,6912676994256176018,6332290923138422423,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  PID:4580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5988,i,1329578748249657761,5744978703115744622,524288 --field-trial-handle=2036,i,6912676994256176018,6332290923138422423,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  PID:1084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6000,i,6654088186710465303,5736857651238131369,524288 --field-trial-handle=2036,i,6912676994256176018,6332290923138422423,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6124 /prefetch:8
  2⤵
  PID:4548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4452,i,8426267458716549760,13492201099737639863,262144 --field-trial-handle=2036,i,6912676994256176018,6332290923138422423,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4344 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3028

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 26be3a4c4f454aa1d5bfa824dc95d3252f8ea77118b0821c392fc366fac504dd
MD5 c2760e64594e8806fc9a2cdcbb81bafa
SHA1 5c5fd5a7d933f8816753765ba156c94e12feca76
SHA512 3722db645c59d3ae0a22833bb8204a3a4f2d781608a0d0b9096c2494d78a8bdf7a62352e4c65aed31257934eed275fab1171b1d71bbcd108e16eb97feabf1908
TLSH
T141E02BBEC961DC3708FD176C90500745E75513573741444B3B3C85194FB523A4656C5C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 eb00b26c7133354064eede47b9bcbc4bb7d4a77265a3fba4d44e142eb1dbb778
MD5 891e75b80c6de7fd7bfb8fd5febf5bd6
SHA1 ef8a8914a901db856a4511e9593eed565f481d28
SHA512 d9ef4602c8a4099f955ed2b684aa78e6282116996e48ffbdb4afd2d399e584890b5b6b2b229652ab6a374f1520d135105195430888785d0b9795acf0ae35c940
TLSH
T1FC51ADF7D3E8866E851192F49B216E2FCE3D0A14121C3C6688D4EE5B53E29B2D21134E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 bc0966f71d7272c157e3e267d5b7d48fb7143832b86050a1b3b5322c7a13702a
MD5 19650f316d73744840127db3b1b59b44
SHA1 7d28b90ba6376bacfc0c3ae8256ff8071f84be56
SHA512 3bd7eb502748bbaf00c6af3d30ca701f5f21ce4c2dd842c8d5f5f34a2ef4ede452df972e71b5efdb0d55d8cfbea39e53544be5bb3d78b1127604e7a02fc55b07
SSDEEP 192:QIRJUQr87yRVYqv71hpAPRp2g92Hsb+WNnSQ0mrTeSg9w2+Ta+VyIsnAUgtaJ:QIRJUQI7ywmBhUXDQwl0gow2ua28
TLSH
T1AC42E62EA910697B6CDBD32AFE223753D7F5102522E12E80E7FC896C15D75CD222740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 c54836683d23f9fee57c69a9d42002f448a01bbb5b6b38437c5fcac9744adcc4
MD5 97aacfb3977979cfbf9d8a6c4d36d689
SHA1 28c462804fa985bea43aac67e658ae60025ec226
SHA512 ac229055b177234c91f43061b9900ff41ba000713f4120fbf08cb18c16d47d484d5415a198c6f1896335d53e2a7e2f4dc407a06b90151f49d9994124c8990d05
SSDEEP 384:+wjKJ7KxkXqKf/pUZNCgVLH2HfgslU697pLuLcSjwxXODKh+ErU3wZJHG/A1YTPB:+0KJ7KxkXqKf/pUZNCgVLH2HfgsG697U
TLSH
T192720A676C488E770F94C68CEC177F4FADB5024B65E9886483FA982903D5BCF11462EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 b95e6e38e96415a39cc2bd95379d5f080f139e60055175918a0cd4a54f5aa0d8
MD5 597114142e518bb05c50e359c660d211
SHA1 0146b3a1d3f2e02e68d642ab48490e59506fb9de
SHA512 d69657b6bb9670a78eb7c91d4773c75f7c12b7de8fcd219b47aeeeeca574facb2d376343c6ab0f66142e1f5c79ada8d47f7ca000db735e5776910b1b863fd5d6
TLSH
T17AB01250C0015101D0D20AF0115664C877149F209A0A270683E0EF33CC271628014061
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ded2.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58ded2.TMP
Size 96B
SHA256 4bcbd3a00198cc197847624b7c7e5c8408243192ccb82a010eae2c668a2b0019
MD5 ded37aa0335678cb569e106f62dbf943
SHA1 68701dd41774097ce1b4165d6ca710e413a6edda
SHA512 1bbda349b3185767263a7b463224c42c340edb73197102187eef2bf25411907c224593f0521d12842562d9f51f481b1a2e35e22b2a186346201ab68eeda5a2b7
TLSH
T12BB02200C082E382C08A03B020B0C0C8B3B8EF30CB03220382E08F2ACC302328022020
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 6b783da753c8f6f223a025f2a0c65d4ac3c1651edee11e3e4cabcfae4f16ba7c
MD5 31cf3cae5ea5e6bad5e36c5a9cb56111
SHA1 5d3f9a5351f42777dc08b0df638e9597e81c8aa1
SHA512 bc98f0c66ae977a82f481c6e96c4c6b702dccdd27bc046673b431c30d75685b663aed78a4f03efa659090efb4d594cff4ca1eb8a26b887a3057d9792f9d7a5aa
SSDEEP 6144:4mqf4pvhtmkKAXz43+eC1r71im7Rkm1tYpBeh2BAos:hqsvhYmX8ueivX9oBGcAos
TLSH
T1BA34230FDE7664B359A97B1C708F2B1F4AF15E688C30CAE0DA5695047BE6BCC0546A31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 242KB
SHA256 d40e824317f99a372453e8db81cf73be0700bf4be613f2ab7ae3d528bc9120d5
MD5 f0be593daf999d2c75e7b2d0c3316768
SHA1 537cd1a3b8896c7138e17922b87c5d41967e9a47
SHA512 5f48db8cd69e2e5ef54a2b95b930d43ba03ae6d430b9260a99e1eac920dc336334ad3a76e1308d36e00ebc4f7d3b561e9b7598b7f08849c8c4162360d4332a72
SSDEEP 6144:+1mqf4pvhtmkKAXz43+eC1r71im7Rkm1tYpBeh2BAos:/qsvhYmX8ueivX9oBGcAos
TLSH
T17034222FDD3564B35DBA7B1C704E2A1B0EF05F69CD30C9D4E95AA5047BEAACC0946A30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 660b56cf191fb34f8c4a1704411a0fb4fc83a70203b0a3c2200641c16e0f337f
MD5 b6a6dab8c257a9b409a7418daac3f349
SHA1 8e14be640c510de60d40c99e69ae0f5c7ade091c
SHA512 49de2956df47284be7c78d0c41e83cb6df1570dfc70bd0ecb9b39eec6b89ef29da7733267391c66ce2ff657b2f0eafdf3264b61f53a63683f3fbee09234bfbf7
SSDEEP 3072:LGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:Sm7Rkm1tYpBeh2BAo3
TLSH
T1AEC312275E71A9375D79BB4EB08E0B1F1EF14AA6C930DE92C8D85B0437E97CC1A05A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 a748ef1d70741a9a338761bc04fabab05be5415cc74464f14ee6538791cf593b
MD5 303682e4353e427daea28e8734957b5c
SHA1 ee9f5d7889a851b90931a8c347ae48dd2d7847e6
SHA512 d76c7465430fbed181cee0c0e8a496b7d878f25c01575affd4447d02c187615e3ff2f6efddcf61c107ad92186d48f16881e5f2a8d24e9d8d1940497b5f0ebd57
SSDEEP 6144:9mqf4pvhtmkKAXz43+eC1r71im7Rkm1tYpBeh2BAos:sqsvhYmX8ueivX9oBGcAos
TLSH
T1F234230FDE7564B359A97B1C708F2B1F4AF15E68CC30CAE0DA5695047BE6BCC0546A31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BASSMOD.dll

Path C:\Users\Admin\AppData\Local\Temp\BASSMOD.dll
Size 33KB
SHA256 8ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f
MD5 e4ec57e8508c5c4040383ebe6d367928
SHA1 b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06
SHA512 77d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822
SSDEEP 768:qQmS5iUgi5czW+DlrQOS1DeDdjgNtbX4O6DHix84H0:qQz5Tgof+DdpS1+djctLSHiZ0
TLSH
T130F2E1B43B18CDE2DDC807F41FE4E6A879DB92026A13DBC5D697CA97328B4914D42F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 3d1288cab7af8b9c9e5bf1b08b32c0195174f9deb14310109843caa71364450d
MD5 a1ba6d0825929739c6bb46bfc4d0dbc8
SHA1 7f9dc29d9d50d7e4c2459e855230efdb90e0ab94
SHA512 4387b2cad951d8d361300a66c935ec4da8c43a8bfc6b6130301ebdab7761d1d16f843eda03137f3e1bd255e5d4ff888bd0f059dec9812cd103e3248bbe051873
TLSH
T1AF21BB260689915D26B345E90918B82FA31FD0EB0E3B8D8D3E8E454F7BA2A1C5367646
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2900-84-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/2900-81-0x0000000000A50000-0x0000000000B14000-memory.dmp

Download

memory/2900-27-0x0000000000A50000-0x0000000000B14000-memory.dmp

Download

memory/2900-83-0x0000000000A50000-0x0000000000B14000-memory.dmp

Download

memory/2900-0-0x0000000000A50000-0x0000000000B14000-memory.dmp

Download

memory/2900-10-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/2900-7-0x0000000000A50000-0x0000000000B14000-memory.dmp

Download

memory/2900-28-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/2900-4-0x0000000010000000-0x0000000010013000-memory.dmp

Download