a88d4acc7ce55b91e2aa7eb24eaf5e629f381556462843095b4dc3b0996eee4b

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 12:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Release/Setup.exe
Size 1.1MB
Sample261102-prp5dswt4j
SHA256 a88d4acc7ce55b91e2aa7eb24eaf5e629f381556462843095b4dc3b0996eee4b
MD5 16b6292e228e9cff9204ad182d5e8741
SHA1 6a96eefbe71cb0c8fc3d16deb04c22eb2d340061
SHA512 4ce536d2f419d340f8132d91f9e11a7f8d2bb754a8633409ee4efbd4a3a944a562d0b2ec6ad52cb58922cd6b59c3fd308f87b45e11d51ae6b17cf82faf812ffb
SSDEEP 24576:CIhhWy4WRIQ27h8Fpb/4f3z6A3a16BLzw1a+x:CICyFgCr26Ma13
TLSH
T112457D666FF7257CE0E6E8728D8247F3CB92310982E5248795FD0E09C4054E2AAF75DE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery spyware

Malware Config

Signatures

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 10 IoCs

description	pid	Process	procid_target
PID 3260 set thread context of 4708	3260	Explorer.EXE	88
PID 3260 set thread context of 4708	3260	Explorer.EXE	88
PID 3260 set thread context of 4708	3260	Explorer.EXE	88
PID 3260 set thread context of 4708	3260	Explorer.EXE	88
PID 3260 set thread context of 4708	3260	Explorer.EXE	88
PID 3260 set thread context of 4708	3260	Explorer.EXE	88
PID 3260 set thread context of 4708	3260	Explorer.EXE	88
PID 3260 set thread context of 4708	3260	Explorer.EXE	88
PID 3260 set thread context of 4708	3260	Explorer.EXE	88
PID 3260 set thread context of 4708	3260	Explorer.EXE	88

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2216	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
3260	Explorer.EXE
3260	Explorer.EXE
3260	Explorer.EXE
3260	Explorer.EXE
3260	Explorer.EXE
3260	Explorer.EXE
3260	Explorer.EXE
3260	Explorer.EXE
3260	Explorer.EXE
3260	Explorer.EXE
3260	Explorer.EXE
3260	Explorer.EXE
3260	Explorer.EXE
3260	Explorer.EXE
3260	Explorer.EXE
3260	Explorer.EXE
3260	Explorer.EXE
3260	Explorer.EXE
3260	Explorer.EXE
3260	Explorer.EXE
3260	Explorer.EXE
3260	Explorer.EXE
3260	Explorer.EXE
3260	Explorer.EXE
3260	Explorer.EXE
3260	Explorer.EXE
3260	Explorer.EXE
3260	Explorer.EXE
3260	Explorer.EXE
3260	Explorer.EXE
4708	chrome.exe
4708	chrome.exe
3260	Explorer.EXE
3260	Explorer.EXE
3260	Explorer.EXE
3260	Explorer.EXE
3260	Explorer.EXE
3260	Explorer.EXE
3260	Explorer.EXE
3260	Explorer.EXE
3260	Explorer.EXE
3260	Explorer.EXE
3260	Explorer.EXE
3260	Explorer.EXE
4708	chrome.exe
4708	chrome.exe
2268	chrome.exe
2268	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3260	Explorer.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
1248	Setup.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
3260	Explorer.EXE
3260	Explorer.EXE
3260	Explorer.EXE

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3260	Explorer.EXE
3260	Explorer.EXE
3260	Explorer.EXE

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1248 wrote to memory of 3260	1248	Setup.exe	56
PID 4708 wrote to memory of 1588	4708	chrome.exe	89
PID 4708 wrote to memory of 4692	4708	chrome.exe	90
PID 4708 wrote to memory of 4692	4708	chrome.exe	90
PID 4708 wrote to memory of 2216	4708	chrome.exe	91
PID 4708 wrote to memory of 3560	4708	chrome.exe	92
PID 4708 wrote to memory of 3560	4708	chrome.exe	92
PID 4708 wrote to memory of 1400	4708	chrome.exe	94
PID 4708 wrote to memory of 2792	4708	chrome.exe	95
PID 4708 wrote to memory of 1400	4708	chrome.exe	94
PID 4708 wrote to memory of 2792	4708	chrome.exe	95
PID 4708 wrote to memory of 4672	4708	chrome.exe	96
PID 4708 wrote to memory of 4672	4708	chrome.exe	96
PID 4708 wrote to memory of 4296	4708	chrome.exe	97
PID 4708 wrote to memory of 4296	4708	chrome.exe	97
PID 4708 wrote to memory of 4324	4708	chrome.exe	100
PID 4708 wrote to memory of 1480	4708	chrome.exe	101
PID 4708 wrote to memory of 1480	4708	chrome.exe	101
PID 4708 wrote to memory of 1104	4708	chrome.exe	103
PID 4708 wrote to memory of 1104	4708	chrome.exe	103
PID 4708 wrote to memory of 4336	4708	chrome.exe	104
PID 4708 wrote to memory of 4336	4708	chrome.exe	104
PID 4708 wrote to memory of 4920	4708	chrome.exe	106
PID 4708 wrote to memory of 4664	4708	chrome.exe	107
PID 4708 wrote to memory of 4920	4708	chrome.exe	106
PID 4708 wrote to memory of 4664	4708	chrome.exe	107
PID 4708 wrote to memory of 536	4708	chrome.exe	112
PID 4708 wrote to memory of 4068	4708	chrome.exe	113
PID 4708 wrote to memory of 4796	4708	chrome.exe	114
PID 4708 wrote to memory of 2268	4708	chrome.exe	115

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3260
- C:\Users\Admin\AppData\Local\Temp\Release\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Release\Setup.exe"
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4708
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb828ac728,0x7ffb828ac734,0x7ffb828ac740
    3⤵
    PID:1588
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1684,i,520523720812130022,6282437119755841750,262144 --field-trial-handle=1932,i,14351485556569745825,9234327119291438364,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1928 /prefetch:2
    3⤵
    PID:4692
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2268,i,7830296113422895546,13393463441787581094,524288 --field-trial-handle=1932,i,14351485556569745825,9234327119291438364,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2116 /prefetch:3
    3⤵
    - System Time Discovery
    PID:2216
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2420,i,16549219924402977420,17993132785853822041,524288 --field-trial-handle=1932,i,14351485556569745825,9234327119291438364,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2432 /prefetch:8
    3⤵
    PID:3560
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3148,i,7389959319291332757,15756235510556373758,2097152 --field-trial-handle=1932,i,14351485556569745825,9234327119291438364,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3216 /prefetch:1
    3⤵
    PID:1400
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3152,i,12192401503878564246,9244753817573729461,2097152 --field-trial-handle=1932,i,14351485556569745825,9234327119291438364,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3236 /prefetch:1
    3⤵
    PID:2792
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4360,i,4067204260513498689,1811553586612827946,2097152 --field-trial-handle=1932,i,14351485556569745825,9234327119291438364,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4444 /prefetch:1
    3⤵
    PID:4672
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4468,i,2176291805258391118,6156761264523728277,524288 --field-trial-handle=1932,i,14351485556569745825,9234327119291438364,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4496 /prefetch:8
    3⤵
    PID:4296
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5220,i,1926587187558654553,13415667515824915753,524288 --field-trial-handle=1932,i,14351485556569745825,9234327119291438364,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5212 /prefetch:8
    3⤵
    PID:4324
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5320,i,14836814199363243538,13990436609588630040,524288 --field-trial-handle=1932,i,14351485556569745825,9234327119291438364,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5332 /prefetch:8
    3⤵
    PID:1480
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5556,i,2877886530196550231,929535189700239130,524288 --field-trial-handle=1932,i,14351485556569745825,9234327119291438364,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5220 /prefetch:8
    3⤵
    PID:1104
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5456,i,10348318580490607336,8028460903526283005,524288 --field-trial-handle=1932,i,14351485556569745825,9234327119291438364,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5428 /prefetch:8
    3⤵
    PID:4336
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5432,i,562960368834893141,16234228075093377890,2097152 --field-trial-handle=1932,i,14351485556569745825,9234327119291438364,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5344 /prefetch:1
    3⤵
    PID:4920
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5556,i,16078979803402342256,7485328182002128603,2097152 --field-trial-handle=1932,i,14351485556569745825,9234327119291438364,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5388 /prefetch:2
    3⤵
    PID:4664
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5372,i,14488074811944178349,4817500389071447486,524288 --field-trial-handle=1932,i,14351485556569745825,9234327119291438364,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5380 /prefetch:8
    3⤵
    PID:536
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5704,i,14496501877815300896,13253809317623754910,524288 --field-trial-handle=1932,i,14351485556569745825,9234327119291438364,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5872 /prefetch:8
    3⤵
    PID:4068
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5424,i,5138047754398773746,4403654883242314903,524288 --field-trial-handle=1932,i,14351485556569745825,9234327119291438364,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6052 /prefetch:8
    3⤵
    PID:4796
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5540,i,4692518444456228797,2791965634774363494,262144 --field-trial-handle=1932,i,14351485556569745825,9234327119291438364,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5264 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2268

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

04e9f2e7-4ed5-4b29-8283-49ad8cd9f6ca.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\04e9f2e7-4ed5-4b29-8283-49ad8cd9f6ca.tmp
Size 270KB
SHA256 9036e524bbdc1f45afc81e9fc2980eb2a419c28d9e25681eadd0df4ba923158b
MD5 d02727165a5bc946d3220ff5bb578291
SHA1 2ef3ec13501686a478dd23f223f42cbbd4a6e509
SHA512 dc182a350f005eb99c55c62e8b169e7036034dd986a0970717f72e32b827680a3b2372b0da428982b9fffbc21ea9bb8e36cf2b3f2c130688fda3b88d761ace57
SSDEEP 6144:WfoZvHWe40m3otUf+8Wp53EX9pxsNTt+hFD+7t56OD9ZfSApprk:Wf+493obX3ETxsnyFSXD9ZfS4q
TLSH
T16944223599C5DC7B8DFC5246710BF7059EB88ADB929EDA0408A52F4BB01FC5E0A73632
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0dd4a191-f317-4a5b-ba7e-f5978e572ad3.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0dd4a191-f317-4a5b-ba7e-f5978e572ad3.tmp
Size 13KB
SHA256 b6b48ed6fe6091a77eafcbe21f8accf35a407ad75a55a8f208ca49dad0848c31
MD5 29b2fa8addaddef444392efe6dd77df9
SHA1 3b15a7f97f00d5d221e1392c3c60491a610337ee
SHA512 210f09739ac8aa7a54a66f65c8e9110705c100c7748104ca6d9606b2aeee9fd6e0cb900a3026118806cd87db181a0ebd2ab04b9f7106466855b87b757c4f57b3
SSDEEP 384:c6jY/7KxkXqKf/pUZNCgVLH2HfgslcLXODYj+ErU3/QHGZVt7ShEd:cqY/7KxkXqKf/pUZNCgVLH2HfgsqTOEC
TLSH
T18D52F927684C9A3F0FD8CA4DDC12AF4FADF501576668492497FB9C18039A7CA114E2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

357f5e31-8f2d-48f9-987f-55f2f9bef0b9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\357f5e31-8f2d-48f9-987f-55f2f9bef0b9.tmp
Size 11KB
SHA256 a4ef4b3e664f124d26d2b5ffbf7b40e26f6d301e89e8bee72d7d52121d0b6d05
MD5 6d3d76158c482c85b1f0fe03695c9092
SHA1 9013c6329689ae417cc8c25042285548cfc8c880
SHA512 22d907f39b6ab156356ef200b8a27965c3477f663d0a768a00ee94a784606f6f9f996ecf35a3e87845219ae39333a0fa25932e601cf93aefdc51be80b522d641
SSDEEP 192:0RbYDPnv71vAPRp2Z9IHsb+WNnUj0Aze8SiKlVyIsnAUge:0RbYDv56X62wE00Sle
TLSH
T15332B52DAE107A3F5CDBD22AF961BB57D7F5102225952E84E6FC893C24EB5CC2127407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

63f91d64-747e-4ccf-bb7a-e76afb792b89.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\63f91d64-747e-4ccf-bb7a-e76afb792b89.tmp
Size 12KB
SHA256 8d52790c0ec1f250a0c94029490e83093654968c781a5df0316266bc01668961
MD5 74da3249414bc163593cbdc00c6d6f7e
SHA1 38c896226a4145dfdb7b1c955e8cd56e70cdcdc9
SHA512 61f15966853eeb7e126b5bf5e5ae9750ea0ce29bd05b364dc0d1f9cb9137dc4fe457f0f548cc124306b3d6dfe117d715421889a45c887178e292d68bb2f29acf
SSDEEP 192:0RbYDPnv71vEPRpmZ9IHsb+WNnUj0ize8SiKCVyIsnAUgE:0RbYDv5eXK2wE0SSEE
TLSH
T1E642C62AA9103A3F9CDBD629F961BB57D7F5102225943E84E6FC893C24EB5CC2227407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

97d0ef68-45ee-4bda-8c5a-d6d4e6e0ae82.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\97d0ef68-45ee-4bda-8c5a-d6d4e6e0ae82.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_1\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_1\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0b079300-c957-4328-8e77-c5d1279e6214.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\0b079300-c957-4328-8e77-c5d1279e6214.tmp
Size 2KB
SHA256 0818a5d3d3b23ce02fdc5140b0eb1931f5f944b9a8941035e810c7072824ca00
MD5 93b2e1eebb282ac904bed8b7f3d12b1e
SHA1 d5dea13c7b2347e50c66eda48e4feb349f1c8bd6
SHA512 b4b90ce6fa8b1afa3c764a52d79b13cfecec0deaa11613e5f42e875d91f5baa51802161bd84854c7f282c4cd4073eb0daf32b5a54967758e85d490a9537aa874
TLSH
T1FB51BAB7D3E8866D852156F49B25AE1FCE3D1A18121C3C62C8D8EE4B53F2872D20179E
MD5 SHA1 SHA512 TLSH

Submit Download

364348f9-7db7-42e9-a08c-cdd4427b5b50.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\364348f9-7db7-42e9-a08c-cdd4427b5b50.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 faf59b29867fd6fe75f605a74545f21b82d040aea4c287bf59cd08dcc749fbd1
MD5 0b39438629e35dc3577673eb01c777d7
SHA1 7637644c47770eff8262db404f2f7e168de768c2
SHA512 0f32d50c9b64e8e667f4dc2366a71c77fe34be8f6721185f9496d5f5f284e9b591de1334914d5b935eaae6f74533099de40f506104deb800cc6e2825237bd7a9
TLSH
T1BAA0021442C16865CD7443F871A11546235959152591475364A50E649C5F1C04621541
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnWebGPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

e4d36a1e-3e00-42e5-a238-87539b5ee787.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e4d36a1e-3e00-42e5-a238-87539b5ee787.tmp
Size 414B
SHA256 4979bcfea8361547ee1f71f1b469507eb30bd12c63d18199cf11a84ecbf4caf8
MD5 42550e54a8ace208191db58c73ed69ac
SHA1 0380f5cd6fff7ba3912fdbaf71fdec2601adc090
SHA512 aea4b786fa8049bd020f4365be3e74256633cd2dd44d9842cb365d6673e4e4911437a09abf378c5152679fb9c4a5570c733def9c3bfbb9edbe7dc1634bf3d1ce
TLSH
T189E022BACD35EC2729FC0B5C2490974AEB91131766809A5F373C810D9FF677A49C685C
MD5 SHA1 SHA512 TLSH

Submit Download

c2e540e8-8a4e-4865-8c08-e08bf412dd9a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\c2e540e8-8a4e-4865-8c08-e08bf412dd9a.tmp
Size 269KB
SHA256 62a1a89255c9a775f9d3d0a1c67b2e93c3f94a395ea404270c3f27b1da8bf5ba
MD5 82cff1780d7b6c8e5af86a9b2d4e09d1
SHA1 452412571ace9a1cd9709b8bc858dc0606f90b62
SHA512 4937f204a3b1af7fb8c9265bc0f675bd0515545c600a7e32966ac9ba66b46ae85f3b7b320787bb12fe5b0a085a2178bab4d261e42e8f65846505bafee61a8171
SSDEEP 6144:R1RvHWe40m3otUf+8Wp53EX9pxsNTt+hFD+7t56OD9ZfSApprk:R1f493obX3ETxsnyFSXD9ZfS4q
TLSH
T1344422258EC59C7BCEFC5146750BF7059F6889DA929ADA0508A23F8FB01FC5E0673632
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c63d91e7-cb64-4132-8acf-8e450ff2610c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\c63d91e7-cb64-4132-8acf-8e450ff2610c.tmp
Size 130KB
SHA256 b5f89b77946e9f0840b09133024736879b16c11fb3c33325f5cffb9a48962bda
MD5 ca87ddd9e3ebea593bd3cc6457a1a29f
SHA1 50dc745bd67de954bc06464ce48feb0fb7c8741e
SHA512 27f564a3ad5ffc41d1c98f65ea8347aac223077f14e656d0d6e69a9e6508493dc975a359608fbe16411ea909a3e9936b3140704b01bef5a03b77648e03d8487b
SSDEEP 3072:dhX+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gr:dhX+hFD+7t56OD9ZfSApprr
TLSH
T16CD31232AA91D8BBC9FC6541B157A304DE666CED41DE7A09444A5F8EE09FC4C07B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c6b484a2-de39-42b5-a5aa-17154859a1f0.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\c6b484a2-de39-42b5-a5aa-17154859a1f0.tmp
Size 269KB
SHA256 5ab798af67f6e42349c091d0f7ad5c9b84d33de757da7fd05193950aeb86af63
MD5 bf1c494378488a0c2149085a962581f8
SHA1 ee283d6b9579cd134675956ef7b16fcd4b5f3446
SHA512 ba57910cb9d900f00a1f4a22a25b839851a437f9b2428cfcc5794505d3639daa698885ada356cfaa6023d4efd6067b856f23fe6c27cfca3418966af245fd1717
SSDEEP 6144:W1RvHWe40m3otUf+8Wp53EX9pxsNTt+hFD+7t56OD9ZfSApprk:W1f493obX3ETxsnyFSXD9ZfS4q
TLSH
T19B4422258EC59C7BCEFC5186750BF7059F6889DA929ADA0508A23F4FB01FC5E0673632
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1d7218b3-ebda-4a26-af51-a17120303043.tmp

Path C:\Users\Admin\AppData\Local\Temp\1d7218b3-ebda-4a26-af51-a17120303043.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4708_1908783874\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3260-25-0x0000000009150000-0x00000000091F2000-memory.dmp

Download

memory/3260-23-0x0000000009150000-0x00000000091F2000-memory.dmp

Download

memory/3260-32-0x0000000009150000-0x00000000091F2000-memory.dmp

Download

memory/3260-12-0x0000000009150000-0x00000000091F2000-memory.dmp

Download

memory/3260-11-0x0000000009150000-0x00000000091F2000-memory.dmp

Download

memory/3260-29-0x0000000009150000-0x00000000091F2000-memory.dmp

Download

memory/3260-10-0x0000000009150000-0x00000000091F2000-memory.dmp

Download

memory/3260-9-0x0000000009150000-0x00000000091F2000-memory.dmp

Download

memory/3260-14-0x0000000009150000-0x00000000091F2000-memory.dmp

Download

memory/3260-16-0x0000000009150000-0x00000000091F2000-memory.dmp

Download

memory/3260-17-0x0000000009150000-0x00000000091F2000-memory.dmp

Download

memory/3260-65-0x0000000009150000-0x00000000091F2000-memory.dmp

Download

memory/3260-18-0x0000000009150000-0x00000000091F2000-memory.dmp

Download

memory/3260-19-0x0000000009150000-0x00000000091F2000-memory.dmp

Download

memory/3260-20-0x0000000009150000-0x00000000091F2000-memory.dmp

Download

memory/3260-13-0x0000000009150000-0x00000000091F2000-memory.dmp

Download

memory/3260-24-0x0000000009150000-0x00000000091F2000-memory.dmp

Download

memory/3260-7-0x0000000009150000-0x00000000091F2000-memory.dmp

Download

memory/3260-28-0x0000000009150000-0x00000000091F2000-memory.dmp

Download

memory/3260-22-0x0000000009150000-0x00000000091F2000-memory.dmp

Download

memory/3260-21-0x0000000009150000-0x00000000091F2000-memory.dmp

Download

memory/3260-8-0x0000000009150000-0x00000000091F2000-memory.dmp

Download

memory/3260-0-0x0000000009150000-0x00000000091F2000-memory.dmp

Download

memory/3260-1-0x0000000009150000-0x00000000091F2000-memory.dmp

Download

memory/3260-2-0x0000000009150000-0x00000000091F2000-memory.dmp

Download

memory/3260-3-0x0000000009150000-0x00000000091F2000-memory.dmp

Download

memory/3260-4-0x0000000009150000-0x00000000091F2000-memory.dmp

Download

memory/3260-5-0x0000000009150000-0x00000000091F2000-memory.dmp

Download

memory/3260-6-0x0000000009150000-0x00000000091F2000-memory.dmp

Download