8eaa420d3c8e7aa450d79f8635c2de5c8f8038a3d3ee3775a3cb7e411d2181fc

Analysis

user interaction
yes
max time kernel
53s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/10/2026, 11:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IDM_6.4x_Crack_v20.7.exe
Size 55KB
Sample261017-nrc96aef73
SHA256 8eaa420d3c8e7aa450d79f8635c2de5c8f8038a3d3ee3775a3cb7e411d2181fc
MD5 0fb924698ecdc7b9830f86d9ebb57c2e
SHA1 a86fa4adabbd0a9b4f649c1ea94e58efe56f40c9
SHA512 8bb8c4507b40459a1a4767251a6728d57fd58a0ac8bc0ef0e67a45d51b1d85b988989763fd4eddd3218f1af091cc8522d62dd05ae900f22b51df566fd9e3f67b
SSDEEP 768:q9v5Demafo3pZVm/dL4LvK2xyTUrMLS2Ajc2uehfOrL2fZYluzKkWieqpqC47D7D:uDBaaEL4LL+zyxusZYukie8qP
TLSH
T14443E16AFCD88943F62204BE425FA21DDA3455E61378C7573A8D293E7F13BD38B52181
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	3960	wscript.exe
8	3960	wscript.exe

Blocks application from running via registry modification 1 IoCs

Adds application to list of disallowed applications.

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "0"	IDM_6.4x_Crack_v20.7.exe

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "0"	IDM_6.4x_Crack_v20.7.exe

Disables Task Manager via registry modification
defense_evasion

Disables cmd.exe use via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "0"	IDM_6.4x_Crack_v20.7.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	IDM_6.4x_Crack_v20.7.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Executes a VBScript file via the Windows Script Host. 1 TTPs 7 IoCs

execution

Visual Basic

T1059.005

pid	Process
4392	cscript.exe
2224	cscript.exe
4880	cscript.exe
4108	cscript.exe
3960	wscript.exe
1800	cscript.exe
4080	cscript.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\WinRAR\rarreg.key	IDM_6.4x_Crack_v20.7.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 14 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IDM_6.4x_Crack_v20.7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4592	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4320	IDM_6.4x_Crack_v20.7.exe
4320	IDM_6.4x_Crack_v20.7.exe
4320	IDM_6.4x_Crack_v20.7.exe
4320	IDM_6.4x_Crack_v20.7.exe
4320	IDM_6.4x_Crack_v20.7.exe
4320	IDM_6.4x_Crack_v20.7.exe
4320	IDM_6.4x_Crack_v20.7.exe
4320	IDM_6.4x_Crack_v20.7.exe
4320	IDM_6.4x_Crack_v20.7.exe
4320	IDM_6.4x_Crack_v20.7.exe
4320	IDM_6.4x_Crack_v20.7.exe
4320	IDM_6.4x_Crack_v20.7.exe
4320	IDM_6.4x_Crack_v20.7.exe
4320	IDM_6.4x_Crack_v20.7.exe
4320	IDM_6.4x_Crack_v20.7.exe
4320	IDM_6.4x_Crack_v20.7.exe
4320	IDM_6.4x_Crack_v20.7.exe
4320	IDM_6.4x_Crack_v20.7.exe
4320	IDM_6.4x_Crack_v20.7.exe
4320	IDM_6.4x_Crack_v20.7.exe
4320	IDM_6.4x_Crack_v20.7.exe
4320	IDM_6.4x_Crack_v20.7.exe
4320	IDM_6.4x_Crack_v20.7.exe
4320	IDM_6.4x_Crack_v20.7.exe
4320	IDM_6.4x_Crack_v20.7.exe
4320	IDM_6.4x_Crack_v20.7.exe
4320	IDM_6.4x_Crack_v20.7.exe
4320	IDM_6.4x_Crack_v20.7.exe
4320	IDM_6.4x_Crack_v20.7.exe
4320	IDM_6.4x_Crack_v20.7.exe
4320	IDM_6.4x_Crack_v20.7.exe
4320	IDM_6.4x_Crack_v20.7.exe
4320	IDM_6.4x_Crack_v20.7.exe
4320	IDM_6.4x_Crack_v20.7.exe
4320	IDM_6.4x_Crack_v20.7.exe
4320	IDM_6.4x_Crack_v20.7.exe
4320	IDM_6.4x_Crack_v20.7.exe
4320	IDM_6.4x_Crack_v20.7.exe
4320	IDM_6.4x_Crack_v20.7.exe
4320	IDM_6.4x_Crack_v20.7.exe
4576	chrome.exe
4576	chrome.exe
4320	IDM_6.4x_Crack_v20.7.exe
4320	IDM_6.4x_Crack_v20.7.exe
4320	IDM_6.4x_Crack_v20.7.exe
4320	IDM_6.4x_Crack_v20.7.exe
4320	IDM_6.4x_Crack_v20.7.exe
4320	IDM_6.4x_Crack_v20.7.exe
4320	IDM_6.4x_Crack_v20.7.exe
4320	IDM_6.4x_Crack_v20.7.exe
4320	IDM_6.4x_Crack_v20.7.exe
4320	IDM_6.4x_Crack_v20.7.exe
4320	IDM_6.4x_Crack_v20.7.exe
4320	IDM_6.4x_Crack_v20.7.exe
4320	IDM_6.4x_Crack_v20.7.exe
4320	IDM_6.4x_Crack_v20.7.exe
4320	IDM_6.4x_Crack_v20.7.exe
4320	IDM_6.4x_Crack_v20.7.exe
4320	IDM_6.4x_Crack_v20.7.exe
4320	IDM_6.4x_Crack_v20.7.exe
4320	IDM_6.4x_Crack_v20.7.exe
4320	IDM_6.4x_Crack_v20.7.exe
4320	IDM_6.4x_Crack_v20.7.exe
4320	IDM_6.4x_Crack_v20.7.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4320 wrote to memory of 4108	4320	IDM_6.4x_Crack_v20.7.exe	86
PID 4320 wrote to memory of 3960	4320	IDM_6.4x_Crack_v20.7.exe	88
PID 4320 wrote to memory of 1800	4320	IDM_6.4x_Crack_v20.7.exe	97
PID 4320 wrote to memory of 4080	4320	IDM_6.4x_Crack_v20.7.exe	101
PID 4320 wrote to memory of 4392	4320	IDM_6.4x_Crack_v20.7.exe	104
PID 4320 wrote to memory of 4576	4320	IDM_6.4x_Crack_v20.7.exe	106
PID 4576 wrote to memory of 2004	4576	chrome.exe	107
PID 4576 wrote to memory of 4704	4576	chrome.exe	108
PID 4576 wrote to memory of 4704	4576	chrome.exe	108
PID 4576 wrote to memory of 4592	4576	chrome.exe	109
PID 4576 wrote to memory of 2264	4576	chrome.exe	110
PID 4576 wrote to memory of 2264	4576	chrome.exe	110
PID 4576 wrote to memory of 3032	4576	chrome.exe	112
PID 4576 wrote to memory of 5032	4576	chrome.exe	113
PID 4576 wrote to memory of 3032	4576	chrome.exe	112
PID 4576 wrote to memory of 5032	4576	chrome.exe	113
PID 4576 wrote to memory of 1352	4576	chrome.exe	114
PID 4576 wrote to memory of 1352	4576	chrome.exe	114
PID 4320 wrote to memory of 2224	4320	IDM_6.4x_Crack_v20.7.exe	115
PID 4576 wrote to memory of 1788	4576	chrome.exe	117
PID 4320 wrote to memory of 4880	4320	IDM_6.4x_Crack_v20.7.exe	119
PID 4320 wrote to memory of 3700	4320	IDM_6.4x_Crack_v20.7.exe	122
PID 4576 wrote to memory of 2756	4576	chrome.exe	125
PID 4576 wrote to memory of 864	4576	chrome.exe	126
PID 4576 wrote to memory of 4340	4576	chrome.exe	127

C:\Users\Admin\AppData\Local\Temp\IDM_6.4x_Crack_v20.7.exe
"C:\Users\Admin\AppData\Local\Temp\IDM_6.4x_Crack_v20.7.exe"
1⤵
- Blocks application from running via registry modification
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Checks computer location settings
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4320
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:4108
- C:\Windows\SysWOW64\wscript.exe
  wscript.exe "C:\Users\Admin\AppData\Local\Temp\\CRK_UPDT_vkkyxiu.vbs" "https://idm.0dy.ir/" "Version" "Download_URL" "20.7" "Crack" "C:\Program Files\Google\Chrome\Application\chrome.exe" silent
  2⤵
  - Badlisted process makes network request
  - Executes a VBScript file via the Windows Script Host.
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:3960
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:1800
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:4080
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:4392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" https://internetdownloadmanager.com/
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4576
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff848c0c728,0x7ff848c0c734,0x7ff848c0c740
    3⤵
    PID:2004
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1736,i,14742124761724110004,12600262195119622833,262144 --field-trial-handle=2040,i,16700454354016361810,3408281224162774992,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2036 /prefetch:2
    3⤵
    PID:4704
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1628,i,854490755562142342,8393957806276449140,524288 --field-trial-handle=2040,i,16700454354016361810,3408281224162774992,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2304 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4592
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2416,i,13230730243635194862,5318138423594610033,524288 --field-trial-handle=2040,i,16700454354016361810,3408281224162774992,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2576 /prefetch:8
    3⤵
    PID:2264
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,14482465435689523702,11453208933710451270,2097152 --field-trial-handle=2040,i,16700454354016361810,3408281224162774992,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3264 /prefetch:1
    3⤵
    PID:3032
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3280,i,10114377031633224770,12832738014364570351,2097152 --field-trial-handle=2040,i,16700454354016361810,3408281224162774992,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3312 /prefetch:1
    3⤵
    PID:5032
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4468,i,11839566526461577304,14346601752227803295,2097152 --field-trial-handle=2040,i,16700454354016361810,3408281224162774992,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4488 /prefetch:2
    3⤵
    PID:1352
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5336,i,17296845864791268578,5303485283982179394,524288 --field-trial-handle=2040,i,16700454354016361810,3408281224162774992,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5340 /prefetch:8
    3⤵
    PID:1788
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5604,i,13852745527602691605,4855786450461669437,524288 --field-trial-handle=2040,i,16700454354016361810,3408281224162774992,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5524 /prefetch:8
    3⤵
    PID:2756
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5596,i,4111073506876645790,2023507737824455927,524288 --field-trial-handle=2040,i,16700454354016361810,3408281224162774992,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4804 /prefetch:8
    3⤵
    PID:864
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5612,i,1149869261714528574,10779547505554446892,524288 --field-trial-handle=2040,i,16700454354016361810,3408281224162774992,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5680 /prefetch:8
    3⤵
    PID:4340
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:2224
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:4880
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /q "%TEMP%\MAS*.ps1" "%TEMP%\*UPDT.vbs" "%TEMP%\*WININF.vbs" 2>nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3700

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

281e04a8-a908-45c3-b660-e2d886c1b786.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\281e04a8-a908-45c3-b660-e2d886c1b786.tmp
Size 130KB
SHA256 a4727c962a126de46f28613f40db163f3b96aa6cca7ab2e684251187990a8189
MD5 6dbf4f2395dec3976715f093dbe2d67e
SHA1 773e38a504ab40d5724344afb632d3ab487bf077
SHA512 105390ade8fdda032837a57649fbc314986edf6dfaab06aeef179a585d3f4962511422c50cf9663ebc94d6e19fef442f7d7e339199b33124ec69912600e0af07
SSDEEP 3072:fL+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+g2:fL+hFD+7t56OD9ZfSAppr2
TLSH
T1EED31232AA91D8BBC9BC6541B157A304DE72ACED81DE3A09444A5F8ED09FC4D0773A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

45182c7f-bc52-4d4b-8770-a48d84cd77d9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\45182c7f-bc52-4d4b-8770-a48d84cd77d9.tmp
Size 267KB
SHA256 f5fac4f9a88bacf357d753d03c4cb2e04c5426db4aad763e76451ac575263f1a
MD5 8c997853d574b24aa143c7044301b626
SHA1 7840ebc68ef7b531adcbac66b461fbdbdcf34010
SHA512 123de8b23cc07bcd2365e0e641da7f654ffcb9527ed1154af2e14e852a9f8ec91d0df2b78008d7a081d4588750a6e1be7c81363919bdeeaa7d52ac2711bb5428
SSDEEP 6144:tFq1IRfZ0fY7lA1kDLmMw4yH2+hFD+7t56OD9ZfSApprD:tFqA0fkBTY2yFSXD9ZfS4x
TLSH
T1114413631AD1CC9B5ABC5301F15FB3174A22BDFD91EF3E8890871682D1ABD460B32B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2490e3c9-91d5-4aec-920a-73e1ee60c1d5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\2490e3c9-91d5-4aec-920a-73e1ee60c1d5.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

2946cb41-cddb-4536-9c32-b863d449fcfd.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\2946cb41-cddb-4536-9c32-b863d449fcfd.tmp
Size 12KB
SHA256 d5485a65373d1c8a1252f7a973666a7769c4bbff8ec3294475cd6fabeb9b1043
MD5 7e2b0b57fdabd9398fa8f0c716e07102
SHA1 6848e28625fc76b7d277829b719117f5942ca5ab
SHA512 9a4d2598f6db92337794e7c31ffd9f620ee725fb46792c6ad95efdc72ae3fbe4ea8ebc55667a96932204631d2dc8b82b95f45fdd50cad3af93853ec741f5faf8
SSDEEP 192:eR2i9F/ZL8dqazDmv7+pAPRp2TN9THsb+WNnP198i2V62p9S5p0F+VyIsnAUgtaJ:eR7n1SDSaUXu9wdP2E2pX28
TLSH
T16C42A42DBE106A7B5CEBD32AF9627717D7F5103120941E84A6FD893C28EB5CC261741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

79ffc3ee-f6e1-4609-9bff-6ad7dc7b1c2b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\79ffc3ee-f6e1-4609-9bff-6ad7dc7b1c2b.tmp
Size 17KB
SHA256 f7e0a7036b9bf87d18941afe0a0039bacd2a6a85b55115963a1d3bb3d3d25ed8
MD5 f5dea701d1a456a3a13710f824722a0b
SHA1 61f3bdb433c2dbd53fdfbd02fb2c0b467fc8f51a
SHA512 57ad41f970191f2aefbe4c358b9171c2932649453a5d90e4b2377a9c358a9d2f45247433f41a6836a315424d66459abb42a476e472641e65c9e0855795e04ac4
SSDEEP 384:nNjzO7KxkXqKf/pUZNCgVLH2HfgslYk7pLuLceSZkXODzq+ErU3yTHG3E5TZ64:nNzO7KxkXqKf/pUZNCgVLH2Hfgsik7p6
TLSH
T17A72F9A7BC4C9E3B4FE4C99CDC167B4FADB5024755E9886442FA582903C5BCB11062FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 96B
SHA256 df59d0557afe99c217c92678271a04b7f43f843470b391af03580783ab73be17
MD5 0a5d88e0b3587105199a97a93cef3fa4
SHA1 14fb5c45715300abe527136fe5ea7dc90edbd643
SHA512 89c927295e699cf9b86f4c105f5c5fb6034e96f3ec1b31e18773dc9295c526af0e7347b2b751136c589a12a9261e096f475d7e5804fbd660e71dddd32998a39b
TLSH
T133B001A591A9135BE76003BC58DA188121B91B64A626276AC2E064E494222BA85578D5
MD5 SHA1 SHA512 TLSH

Submit Download

9e50bb65-2447-480d-9c62-382d976988f2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\9e50bb65-2447-480d-9c62-382d976988f2.tmp
Size 2KB
SHA256 6da1fca730b7b0c03ab2d36f1c6c94dc8b5383c1d270cf53510a0d837c349dff
MD5 db1e3db3777709b141e61115deedbab0
SHA1 666f9827d67ac592c777b6d4879d1b47e10fc8eb
SHA512 4a5c421e635f44839a17ec6f719aaccec8a8396dac64257083bcdd2d1469859222da00ac5c69ff6e066e0bb373c306fd56a80e4950b0a1caf66e3ad927d18388
TLSH
T118417DF7C3E89A7DC90166F5A7152F2BCE290A14531C3C56C8D4AE1F53E28F1D20054E
MD5 SHA1 SHA512 TLSH

Submit Download

bca5c743-eae9-43b6-9e4e-a9158231c15b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\bca5c743-eae9-43b6-9e4e-a9158231c15b.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 6053f15e9b662b5c67d67bef704ecd1863f4726d3ebfb990aac1701d052e5a2a
MD5 92a541701dc2113139b5c26c01fc3c91
SHA1 f21608819edec16066b5a2ff4b9c600ddb741dc4
SHA512 5c38d18ea9e33ca923b74012681fbcec54949ad0229e775a47ff1f88d1cff1710e968f53ef7494978cad8eb6dd437d0ffc6fdca0ce1cb96d91b8371c117976f7
TLSH
T111B0124580415302C0D213B4216438A875659F10A705130141F00D15CC361E2C02B099
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 b43f8e0fbbf196fc7a5d70b9a7b90d6f000041ba9d998c400414df677c1e27c7
MD5 8860e61fef6fd7934b844b8e3e5b646a
SHA1 317af285571f74e675419c5e9f71768949f15112
SHA512 aa84e1d03c450ed982801f3202f4eaec10387277ffdff899676fec02463f9cef7cc151865e81c6445f0056c8b0c1e704602a6ec0b11fc0e6cb99bb62abda9372
TLSH
T1D8B02200C003F203C00203B0208882C8F0F0EF30C2030323A3F00A22EC3023382220B0
MD5 SHA1 SHA512 TLSH

Submit Download

ed95b1a2-c02b-4b55-90ca-883e044f28ed.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ed95b1a2-c02b-4b55-90ca-883e044f28ed.tmp
Size 414B
SHA256 ccbdf577d65200311de79adea048847bd58c512d78c421955d5741cae4b4d9cd
MD5 f70a297386dc667e27421565b1048502
SHA1 cfb00c634b6376dfcb16ac0a8328791264348cd2
SHA512 f8496d746cf662d79d5bdecb1206816bb62feb9bf4d82bf2b04a1f4ce9a68de1c3d39f44f4902f28cb74e6f405e32b6f4345f3fbbcd82d56774f4d5989879264
TLSH
T11CE02BEAC962EC2718FD0B5A5091064AE74113576A41494F3F3D81198FB67370AD981C
MD5 SHA1 SHA512 TLSH

Submit Download

CRK_UPDT_vkkyxiu.vbs

Path C:\Users\Admin\AppData\Local\Temp\CRK_UPDT_vkkyxiu.vbs
Size 2KB
SHA256 92fe72cceb630c7eff3b2d3bed9c6969f53e5b9dff1f481888754e59b3c76ab7
MD5 b91c1157d6f1e605cc965d092551b307
SHA1 02469c313acdea89c3a669741093e9fe09dfcdfb
SHA512 bc3174aa8962d92910c6183dbefdac6987893eaf10a7dce029cc5bf4133f9b23af7b440c3ed0ed7a499a2049f72d331344ad7472241bcc737aa4dcf878000a6f
TLSH
T1BA519A5DBB0FC53905011AE04DB905096FFCC723D157CA29794FC88E0B1A57DC6E6AE6
MD5 SHA1 SHA512 TLSH

Submit Download

WININF.vbs

Path C:\Users\Admin\AppData\Local\Temp\WININF.vbs
Size 2KB
SHA256 f4a33112450eba45ee2738001352e3af5e977194610a127ee4a8feef4c44568e
MD5 b17ffd1dffbce3695c3ca62b01b54626
SHA1 d7adf2df9decfb331f2d7d6c67933c0a11db24ce
SHA512 1aefe323af119d4c93c818740ef60a5349f11929fc136305f20360fff7e32e98f4bde10b25404381a014437ea8779bcb382ff29cd504bf5bbc340133fb66dba2
TLSH
T1554164167F40E67AF0329DB06D7BA44E9A71016B38A58980354889C54F3B0AD8BF11F8
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4320-20-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/4320-125-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/4320-54-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/4320-0-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/4320-19-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/4320-1-0x0000000000439000-0x000000000043A000-memory.dmp

Download