425da68e77b3c80361dbc5277f4d43dd9425ae3ec147b62f08c0737a3f7808ac

Analysis

user interaction
yes
max time kernel
163s
max time network
169s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
24/10/2026, 16:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
build-VEPI10IT.zip
Size 120.1MB
Sample261024-t6bb1avyg1
SHA256 425da68e77b3c80361dbc5277f4d43dd9425ae3ec147b62f08c0737a3f7808ac
MD5 b66fb4c5de60f4467e6564b6f74bf8f1
SHA1 1c98e531fd3369099f9f856395939f7c61a0f2e3
SHA512 27c614be0fb1e86133bf301d760fe17808455113445fbb8e22cc2895aaa1a11a8ce85531a7686ff19cd1121a32c1fd1d196289c2aa30aaa82fd15be43a0d801b
SSDEEP 3145728:pT9KurjDe0NNorOwgPhfm5PjOAQVnVaba+jj8ts:pIurPTHorOwGhfIjOvnMba+jjAs
TLSH
T16858338418738B7EC5828374EE4459244272FE9CCB149F5B3580BAFDFEB269446E6B34
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery spyware

Malware Config

Signatures

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 8 IoCs

description	pid	Process	procid_target
PID 3488 set thread context of 4956	3488	installer.exe	104
PID 3488 set thread context of 4956	3488	installer.exe	104
PID 3488 set thread context of 4956	3488	installer.exe	104
PID 3488 set thread context of 4956	3488	installer.exe	104
PID 3488 set thread context of 4956	3488	installer.exe	104
PID 3488 set thread context of 4956	3488	installer.exe	104
PID 3488 set thread context of 4956	3488	installer.exe	104
PID 3488 set thread context of 4956	3488	installer.exe	104

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3508	chrome.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3488	installer.exe
3488	installer.exe
3488	installer.exe
3488	installer.exe
3488	installer.exe
3488	installer.exe
3488	installer.exe
3488	installer.exe
3488	installer.exe
3488	installer.exe
3488	installer.exe
3488	installer.exe
3488	installer.exe
3488	installer.exe
3488	installer.exe
3488	installer.exe
3488	installer.exe
3488	installer.exe
3488	installer.exe
3488	installer.exe
4956	chrome.exe
4956	chrome.exe
3488	installer.exe
3488	installer.exe
3488	installer.exe
3488	installer.exe
3488	installer.exe
3488	installer.exe
3488	installer.exe
3488	installer.exe
3488	installer.exe
3488	installer.exe
3488	installer.exe
3488	installer.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
836	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeDebugPrivilege	836	taskmgr.exe
Token: SeSystemProfilePrivilege	836	taskmgr.exe
Token: SeCreateGlobalPrivilege	836	taskmgr.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe

Suspicious use of SendNotifyMessage 51 IoCs

pid	Process
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4956 wrote to memory of 2788	4956	chrome.exe	105
PID 4956 wrote to memory of 4292	4956	chrome.exe	106
PID 4956 wrote to memory of 4292	4956	chrome.exe	106
PID 4956 wrote to memory of 3508	4956	chrome.exe	107
PID 4956 wrote to memory of 4332	4956	chrome.exe	108
PID 4956 wrote to memory of 4332	4956	chrome.exe	108
PID 4956 wrote to memory of 4580	4956	chrome.exe	110
PID 4956 wrote to memory of 772	4956	chrome.exe	111
PID 4956 wrote to memory of 4580	4956	chrome.exe	110
PID 4956 wrote to memory of 772	4956	chrome.exe	111
PID 4956 wrote to memory of 1680	4956	chrome.exe	112
PID 4956 wrote to memory of 1680	4956	chrome.exe	112
PID 4956 wrote to memory of 3204	4956	chrome.exe	113
PID 4956 wrote to memory of 3204	4956	chrome.exe	113
PID 4956 wrote to memory of 4896	4956	chrome.exe	114
PID 4956 wrote to memory of 1520	4956	chrome.exe	120
PID 4956 wrote to memory of 4532	4956	chrome.exe	121
PID 4956 wrote to memory of 4740	4956	chrome.exe	122

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\build-VEPI10IT.zip
1⤵
PID:1752

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5060

C:\Users\Admin\Desktop\installer.exe
"C:\Users\Admin\Desktop\installer.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:3488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4956
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffb76f1c728,0x7ffb76f1c734,0x7ffb76f1c740
    3⤵
    PID:2788
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1824,i,9982181544903930910,6525014161169451044,262144 --field-trial-handle=2064,i,8683782858759653022,6286021139531117388,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2060 /prefetch:2
    3⤵
    PID:4292
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1672,i,15600019904705631030,8572306533088032824,524288 --field-trial-handle=2064,i,8683782858759653022,6286021139531117388,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2356 /prefetch:3
    3⤵
    - System Time Discovery
    PID:3508
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2444,i,4359782736088837888,9612867936622961947,524288 --field-trial-handle=2064,i,8683782858759653022,6286021139531117388,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2616 /prefetch:8
    3⤵
    PID:4332
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3260,i,444604485465356586,13729048596970471781,2097152 --field-trial-handle=2064,i,8683782858759653022,6286021139531117388,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3320 /prefetch:1
    3⤵
    PID:4580
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3264,i,7593090013759694430,15906573793462566212,2097152 --field-trial-handle=2064,i,8683782858759653022,6286021139531117388,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3340 /prefetch:1
    3⤵
    PID:772
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4212,i,14702136442560440499,2074410057361803389,2097152 --field-trial-handle=2064,i,8683782858759653022,6286021139531117388,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4308 /prefetch:2
    3⤵
    PID:1680
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4696,i,10647227473646673172,2275858690950017354,2097152 --field-trial-handle=2064,i,8683782858759653022,6286021139531117388,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4584 /prefetch:1
    3⤵
    PID:3204
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5352,i,17566785893266542904,12621779922887770497,524288 --field-trial-handle=2064,i,8683782858759653022,6286021139531117388,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5280 /prefetch:8
    3⤵
    PID:4896
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5664,i,3989017132735114825,3972043638579419798,524288 --field-trial-handle=2064,i,8683782858759653022,6286021139531117388,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5364 /prefetch:8
    3⤵
    PID:1520
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5676,i,17369766044786908128,2690329803700523403,524288 --field-trial-handle=2064,i,8683782858759653022,6286021139531117388,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5680 /prefetch:8
    3⤵
    PID:4532
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5488,i,4365612551267670634,17936963938558629463,524288 --field-trial-handle=2064,i,8683782858759653022,6286021139531117388,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5692 /prefetch:8
    3⤵
    PID:4740

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4104

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4992

C:\Users\Admin\Desktop\installer.exe
"C:\Users\Admin\Desktop\installer.exe"
1⤵
PID:912

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:836

C:\Users\Admin\Desktop\installer.exe
"C:\Users\Admin\Desktop\installer.exe"
1⤵
PID:5192

C:\Users\Admin\Desktop\installer.exe
"C:\Users\Admin\Desktop\installer.exe"
1⤵
PID:5256

C:\Users\Admin\Desktop\installer.exe
"C:\Users\Admin\Desktop\installer.exe"
1⤵
PID:5320

C:\Users\Admin\Desktop\installer.exe
"C:\Users\Admin\Desktop\installer.exe"
1⤵
PID:5376

C:\Users\Admin\Desktop\installer.exe
"C:\Users\Admin\Desktop\installer.exe"
1⤵
PID:5436

C:\Users\Admin\Desktop\installer.exe
"C:\Users\Admin\Desktop\installer.exe"
1⤵
PID:5496

C:\Users\Admin\Desktop\installer.exe
"C:\Users\Admin\Desktop\installer.exe"
1⤵
PID:5556

C:\Users\Admin\Desktop\installer.exe
"C:\Users\Admin\Desktop\installer.exe"
1⤵
PID:5620

C:\Users\Admin\Desktop\installer.exe
"C:\Users\Admin\Desktop\installer.exe"
1⤵
PID:5684

C:\Users\Admin\Desktop\installer.exe
"C:\Users\Admin\Desktop\installer.exe"
1⤵
PID:5740

C:\Users\Admin\Desktop\installer.exe
"C:\Users\Admin\Desktop\installer.exe"
1⤵
PID:5808

C:\Users\Admin\Desktop\installer.exe
"C:\Users\Admin\Desktop\installer.exe"
1⤵
PID:5932

C:\Users\Admin\Desktop\installer.exe
"C:\Users\Admin\Desktop\installer.exe"
1⤵
PID:5992

C:\Users\Admin\Desktop\installer.exe
"C:\Users\Admin\Desktop\installer.exe"
1⤵
PID:6060

C:\Users\Admin\Desktop\installer.exe
"C:\Users\Admin\Desktop\installer.exe"
1⤵
PID:6120

C:\Users\Admin\Desktop\installer.exe
"C:\Users\Admin\Desktop\installer.exe"
1⤵
PID:1820

C:\Users\Admin\Desktop\installer.exe
"C:\Users\Admin\Desktop\installer.exe"
1⤵
PID:3380

C:\Users\Admin\Desktop\installer.exe
"C:\Users\Admin\Desktop\installer.exe"
1⤵
PID:2560

C:\Users\Admin\Desktop\installer.exe
"C:\Users\Admin\Desktop\installer.exe"
1⤵
PID:5220

C:\Users\Admin\Desktop\installer.exe
"C:\Users\Admin\Desktop\installer.exe"
1⤵
PID:5344

C:\Users\Admin\Desktop\installer.exe
"C:\Users\Admin\Desktop\installer.exe"
1⤵
PID:5452

C:\Users\Admin\Desktop\installer.exe
"C:\Users\Admin\Desktop\installer.exe"
1⤵
PID:5580

C:\Users\Admin\Desktop\installer.exe
"C:\Users\Admin\Desktop\installer.exe"
1⤵
PID:5708

C:\Users\Admin\Desktop\installer.exe
"C:\Users\Admin\Desktop\installer.exe"
1⤵
PID:5916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

36f53541-f825-41ae-b882-93019de46c7e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\36f53541-f825-41ae-b882-93019de46c7e.tmp
Size 270KB
SHA256 1c09d2ea5a3d72bf948e0728e1b3090de04119921729e8222127a8ecde031cb5
MD5 14f9d2ebdef63a1bec9b845b46aedf5e
SHA1 3e7351f6f62f7f36319fca1cd47f19f46e1b0597
SHA512 d397895cf0fac97134455010eb9ca17431cf4a6ff26e275e723762f4b0e2f39607a34dc2165c91275a6049b451c904a4c18796659b1abf7c07126c1dc7bbb392
SSDEEP 6144:sHCsUfw5u7eC94LUX4rY7Q/CuPtbmf1K49XLWbEPi4NTKlLzT:Xs2w5Ee5HrayofM49s4NTK9X
TLSH
T14D4412F1BF1A38693AFDCB237121270A5BBDC957991C2AE640CF3E46119A7D6C209913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5bfaf1a7-7198-4f73-90c3-3c9ea2ee027b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\5bfaf1a7-7198-4f73-90c3-3c9ea2ee027b.tmp
Size 131KB
SHA256 ae24b19c86e7140b44a40d75f0adbf8530007c102d93208ec742c12882d8a259
MD5 edfa189a0bb8d404f198060250d3a1df
SHA1 6f5bc195bec9c3d0230d2175878b931e438ebc3d
SHA512 4022afa0723244569b1a77463dd3ce3b4780252802dc2db9f57c5537ecd21eb86b14aabc4781037cab7a31adb59f7fd79e84b2bfb5755a507e48d74e4c9e7d21
SSDEEP 3072:hIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzh:NPtbmf1K49XLWbEPi4NTKlLzh
TLSH
T10CD312217D01BCB8E9AEDB22B1901A15EAB8D94BD5397BE61CDE3F4805A36D9C304C53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

028114b6-d18e-448a-a35e-cc13a7d6b7e3.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\028114b6-d18e-448a-a35e-cc13a7d6b7e3.tmp
Size 12KB
SHA256 50437932f8d073863c56430cc391018323e6567da2ac09d61c0437c0e349d425
MD5 f97fb5810b4d0a1501d2f087ece777ca
SHA1 c813e557bb813fb598c60c4c93834f5bc7fc0709
SHA512 c71835ec30114517219acafb78e4b6045a15f52c59d42a9d9503fe31a2656bf29d7173662ae89280255845f0f40270244dc67833db54dbe13aad31fda4184f92
SSDEEP 192:GRBDFMbMOZ7bv7MpAPRp2t9tHsb+WNnqM0nz+fkwRh8bafVyIsnAUgraJ:GRBDGh7jwUXOvw30yfxSa5e
TLSH
T1C742C72DBD20793BACDAD61AE9667B93D7F9203131842E44E7FC892C24DB5CC2227517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

213ce567-38c0-4175-9da9-00e4ba517cd2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\213ce567-38c0-4175-9da9-00e4ba517cd2.tmp
Size 414B
SHA256 760ff61813b75c1fa8aa80ee806d5f0623783ec0e6925acee4aa9b8d4691aca7
MD5 83a963a52b216f80a26e48a3b7a0a284
SHA1 ef44393551f593b39a5cc1eebfba111c025f04a9
SHA512 609d05c6f1194bd384c80b505f5134e6c0c5cc17d49e2bc75f74e4e018ebe584be2d39e0f5430a8eefa6f51d279aba63f7727ddc7413e127b366621832c5361a
TLSH
T110E065BEC921AC2719F90B5860545647E65153662B41891F363C920C8FB1B364189C6D
MD5 SHA1 SHA512 TLSH

Submit Download

33ef1131-06fb-4fde-92fb-a4dd462a46a2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\33ef1131-06fb-4fde-92fb-a4dd462a46a2.tmp
Size 12KB
SHA256 6b5b7d4e3a8d0a981a98e7e2edcb79aae30678e6ec6f556cd3cfc955a98584a2
MD5 06566c93baf02f23f809ecbd044ce275
SHA1 5dcbf167d44fe047c4c8c9518567cf807241b3b0
SHA512 5fad692f84735732f66d3eef7ad1c0959b9d4c72817efc1979b9fd602eeaa6ce9e95edcf1283b3742ff8683f63e969fc0326ee4484a5c5134c4056ec6b3dba38
SSDEEP 192:GRBDFMbMOZrv7MpAPRp2t9tHsb+WNnqM0zz+fkwRh8bafVyIsnAUgtaJ:GRBDGhTwUXOvw30efxSa58
TLSH
T1A342B72DAD20793BACDBC61AE9667793D7F9203131942E44E6FC892C24DB5CC2227517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

38be48d1-e9c1-4beb-bf07-85804e1a001e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\38be48d1-e9c1-4beb-bf07-85804e1a001e.tmp
Size 17KB
SHA256 bc874b5dfd433743339ca27fbc016d54b007fab3e56af9f017a931025cb0f537
MD5 8d3394a14b12f06ecbe650f06b4881fa
SHA1 d4c8ccc659c5c983f73adedfc2f5491607ac031e
SHA512 5052397393a9e12e611402bc4ac104433e8a02a13f8c7f9236e7f653a48cb0a7aaac61660c212ab456241d0ca72e689c0cbd6c0186b51f3570b8c09ec3b374b4
SSDEEP 384:K0juV7KxkXqKf/pUZNCgVLH2HfgslRU7pLuLceScdXODu1+ErU3pfHGeXTuxL:KYuV7KxkXqKf/pUZNCgVLH2HfgsDU7p0
TLSH
T15972E967AC4CAA3B0FD4CACCD8277F4FEDB5025A65D9886443FA982503D5ACB11061E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9d6c6f94-16fc-49c4-b61c-865371a477cf.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\9d6c6f94-16fc-49c4-b61c-865371a477cf.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

28f98719-5747-4fb2-90dd-6950e798a930.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\28f98719-5747-4fb2-90dd-6950e798a930.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 51d44858f9a70af3039befa0ffb984eb90d3b6f53e85318a83236d2a56a46ed5
MD5 3dd0214f624ecd98f0642c26fa926712
SHA1 821f2d8eaa1c6405ccbf6d960ee9fd62d66d6805
SHA512 64224d291ce78ef8c0e0152957855b9ca2b50fbf2a808b701e684463d5efc0751d09650567a0060aa993395aada34f0d5373133469003c13bdf3128afc213223
TLSH
T14FB01245C4416351C0070BF8126014983254DF19A7052B0286F01D2188391F0812B4D4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 4eeac1fb7f8461127b239e11b0841e27a35d8056347333fc70ae7eb92459357d
MD5 61a3b05599b16579369f73b5486ac6fd
SHA1 d24514903040baea2156ab86148a56867d0805aa
SHA512 73c7541f39530f4bd2f8678f31c7fa3745da3e6df4670c6e517689f50be96dbfe440d8adbd70c78043ff7d1da875935634d2016578ca3c7b9307b8b5f284a419
TLSH
T178B02200C20332A2C00303B02AB880E83220EF20C2032A22A2F00A32EC2822000300BC
MD5 SHA1 SHA512 TLSH

Submit Download

c1ba6586-3b47-4988-860c-423403d2ad6d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\c1ba6586-3b47-4988-860c-423403d2ad6d.tmp
Size 270KB
SHA256 47a98cd0534693d0cc1276014cfe17fa6db71a6a5cbc643b5375ccab0cc88204
MD5 17a20d3e474000e12a1501a93681391f
SHA1 2444e86b3553c4fd06ab5e42e15574782bb53e67
SHA512 87ced9047ad3a0f87815a180571cc3210159aaf574a27bd6e3f5b7a0c8fe4f44728cbd7cbdce759d5c9e3793fc82aceeee38785faba21966f7966ac33bb615b0
SSDEEP 6144:nHCsUfw5u7eC94LUX4rY7Q/CuPtbmf1K49XLWbEPi4NTKlLzT:is2w5Ee5HrayofM49s4NTK9X
TLSH
T1A24412F1BF1A38693AFDCB237121270A5BBDC957991C2AE640CF3E46119A7D6C209913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/836-129-0x00000238E4910000-0x00000238E4911000-memory.dmp

Download

memory/836-128-0x00000238E4910000-0x00000238E4911000-memory.dmp

Download

memory/836-121-0x00000238E4910000-0x00000238E4911000-memory.dmp

Download

memory/836-120-0x00000238E4910000-0x00000238E4911000-memory.dmp

Download

memory/836-131-0x00000238E4910000-0x00000238E4911000-memory.dmp

Download

memory/836-130-0x00000238E4910000-0x00000238E4911000-memory.dmp

Download

memory/836-125-0x00000238E4910000-0x00000238E4911000-memory.dmp

Download

memory/836-119-0x00000238E4910000-0x00000238E4911000-memory.dmp

Download

memory/836-126-0x00000238E4910000-0x00000238E4911000-memory.dmp

Download

memory/836-127-0x00000238E4910000-0x00000238E4911000-memory.dmp

Download

memory/912-84-0x000001F88DB90000-0x000001F88DC2E000-memory.dmp

Download

memory/912-86-0x000001F88DB90000-0x000001F88DC2E000-memory.dmp

Download

memory/912-88-0x000001F88DB90000-0x000001F88DC2E000-memory.dmp

Download

memory/912-87-0x000001F88DB90000-0x000001F88DC2E000-memory.dmp

Download

memory/912-85-0x000001F88DB90000-0x000001F88DC2E000-memory.dmp

Download

memory/912-89-0x000001F88DB90000-0x000001F88DC2E000-memory.dmp

Download

memory/3488-6-0x0000028D45500000-0x0000028D4559E000-memory.dmp

Download

memory/3488-12-0x0000028D45500000-0x0000028D4559E000-memory.dmp

Download

memory/3488-22-0x0000028D45500000-0x0000028D4559E000-memory.dmp

Download

memory/3488-47-0x0000028D45500000-0x0000028D4559E000-memory.dmp

Download

memory/3488-23-0x0000028D45500000-0x0000028D4559E000-memory.dmp

Download

memory/3488-24-0x0000028D45500000-0x0000028D4559E000-memory.dmp

Download

memory/3488-25-0x0000028D45500000-0x0000028D4559E000-memory.dmp

Download

memory/3488-83-0x0000028D45500000-0x0000028D4559E000-memory.dmp

Download

memory/3488-26-0x0000028D45500000-0x0000028D4559E000-memory.dmp

Download

memory/3488-28-0x0000028D45500000-0x0000028D4559E000-memory.dmp

Download

memory/3488-29-0x0000028D45500000-0x0000028D4559E000-memory.dmp

Download

memory/3488-30-0x0000028D45500000-0x0000028D4559E000-memory.dmp

Download

memory/3488-3-0x0000028D45500000-0x0000028D4559E000-memory.dmp

Download

memory/3488-8-0x0000028D45500000-0x0000028D4559E000-memory.dmp

Download

memory/3488-9-0x0000028D45500000-0x0000028D4559E000-memory.dmp

Download

memory/3488-10-0x0000028D45500000-0x0000028D4559E000-memory.dmp

Download

memory/3488-17-0x0000028D45500000-0x0000028D4559E000-memory.dmp

Download

memory/3488-11-0x0000028D45500000-0x0000028D4559E000-memory.dmp

Download

memory/3488-13-0x0000028D45500000-0x0000028D4559E000-memory.dmp

Download

memory/3488-14-0x0000028D45500000-0x0000028D4559E000-memory.dmp

Download

memory/3488-15-0x0000028D45500000-0x0000028D4559E000-memory.dmp

Download

memory/3488-16-0x0000028D45500000-0x0000028D4559E000-memory.dmp

Download

memory/3488-18-0x0000028D45500000-0x0000028D4559E000-memory.dmp

Download

memory/3488-19-0x0000028D45500000-0x0000028D4559E000-memory.dmp

Download

memory/3488-20-0x0000028D45500000-0x0000028D4559E000-memory.dmp

Download

memory/3488-21-0x0000028D45500000-0x0000028D4559E000-memory.dmp

Download

memory/3488-7-0x0000028D45500000-0x0000028D4559E000-memory.dmp

Download

memory/3488-0-0x0000028D45500000-0x0000028D4559E000-memory.dmp

Download

memory/3488-2-0x0000028D45500000-0x0000028D4559E000-memory.dmp

Download

memory/3488-4-0x0000028D45500000-0x0000028D4559E000-memory.dmp

Download

memory/3488-5-0x0000028D45500000-0x0000028D4559E000-memory.dmp

Download

memory/5192-135-0x0000024CEF600000-0x0000024CEF69E000-memory.dmp

Download

memory/5192-134-0x0000024CEF600000-0x0000024CEF69E000-memory.dmp

Download

memory/5192-132-0x0000024CEF600000-0x0000024CEF69E000-memory.dmp

Download

memory/5192-137-0x0000024CEF600000-0x0000024CEF69E000-memory.dmp

Download

memory/5192-133-0x0000024CEF600000-0x0000024CEF69E000-memory.dmp

Download

memory/5192-136-0x0000024CEF600000-0x0000024CEF69E000-memory.dmp

Download

memory/5256-139-0x0000018EF2860000-0x0000018EF28FE000-memory.dmp

Download

memory/5256-140-0x0000018EF2860000-0x0000018EF28FE000-memory.dmp

Download

memory/5256-141-0x0000018EF2860000-0x0000018EF28FE000-memory.dmp

Download

memory/5256-143-0x0000018EF2860000-0x0000018EF28FE000-memory.dmp

Download

memory/5256-142-0x0000018EF2860000-0x0000018EF28FE000-memory.dmp

Download

memory/5256-138-0x0000018EF2860000-0x0000018EF28FE000-memory.dmp

Download

memory/5320-148-0x0000025EF2240000-0x0000025EF22DE000-memory.dmp

Download

memory/5320-147-0x0000025EF2240000-0x0000025EF22DE000-memory.dmp

Download

memory/5320-146-0x0000025EF2240000-0x0000025EF22DE000-memory.dmp

Download

memory/5320-144-0x0000025EF2240000-0x0000025EF22DE000-memory.dmp

Download

memory/5320-145-0x0000025EF2240000-0x0000025EF22DE000-memory.dmp

Download

memory/5376-150-0x0000028A74A40000-0x0000028A74ADE000-memory.dmp

Download

memory/5376-149-0x0000028A74A40000-0x0000028A74ADE000-memory.dmp

Download