5907fd2db2a24dd831fbf49787f46d9dcd12bbbce64b20d6aaaf5f66d4e8e210

Analysis

user interaction
yes
max time kernel
58s
max time network
59s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/11/2026, 20:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
build_20261104_201624.exe
Size 389KB
Sample261104-y2sspsds2x
SHA256 5907fd2db2a24dd831fbf49787f46d9dcd12bbbce64b20d6aaaf5f66d4e8e210
MD5 c2099344fbafdc100fb98d8dc0cd6b1c
SHA1 85f3e7cfe9f213e4ad7d988a2c6be3ec407f7eb9
SHA512 fcfe836c4f1ef9f8f2b82587ec05b730e591d6133450d7c38adf406f48a6c2a2134b57e3a063e3aa19dae7463ef6ac09517f6cc2c7c6351b542c0bac60697c25
SSDEEP 6144:bP3b2phaEPx8lE6gcXXcx+90rIoqpzMow5vEQJ6hhvWQfPSqv2wPH9wTWhwE:z3yphao/6gU0+UxfxJwlp3Sm2wPdwC9
TLSH
T1A684E117B3AD30F8D5B7963888514941F772B8350B619B5F07A4437A2F636C8AE3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Executes a file named after a Windows system binary 1 TTPs 3 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker\RuntimeBroker.exe	build_20261104_201624.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker\RuntimeBroker.exe	RuntimeBroker.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Caches\RuntimeBroker.exe	RuntimeBroker.exe

Executes dropped EXE 2 IoCs

pid	Process
3704	RuntimeBroker.exe
4972	RuntimeBroker.exe

Modifies file permissions 1 TTPs 5 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
820	icacls.exe
4176	icacls.exe
3532	icacls.exe
2676	icacls.exe
3464	icacls.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftWindowsRuntimeBroker = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\RuntimeBroker\\RuntimeBroker.exe\""	build_20261104_201624.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
43	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Direct Volume Access: Opens a physical disk for reading 1 TTPs 16 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive12	build_20261104_201624.exe
File opened (read-only)	\??\PhysicalDrive13	build_20261104_201624.exe
File opened (read-only)	\??\PhysicalDrive1	build_20261104_201624.exe
File opened (read-only)	\??\PhysicalDrive3	build_20261104_201624.exe
File opened (read-only)	\??\PhysicalDrive4	build_20261104_201624.exe
File opened (read-only)	\??\PhysicalDrive6	build_20261104_201624.exe
File opened (read-only)	\??\PhysicalDrive7	build_20261104_201624.exe
File opened (read-only)	\??\PhysicalDrive8	build_20261104_201624.exe
File opened (read-only)	\??\PhysicalDrive0	build_20261104_201624.exe
File opened (read-only)	\??\PhysicalDrive2	build_20261104_201624.exe
File opened (read-only)	\??\PhysicalDrive10	build_20261104_201624.exe
File opened (read-only)	\??\PhysicalDrive11	build_20261104_201624.exe
File opened (read-only)	\??\PhysicalDrive9	build_20261104_201624.exe
File opened (read-only)	\??\PhysicalDrive5	build_20261104_201624.exe
File opened (read-only)	\??\PhysicalDrive14	build_20261104_201624.exe
File opened (read-only)	\??\PhysicalDrive15	build_20261104_201624.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4896	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	build_20261104_201624.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	build_20261104_201624.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RuntimeBroker.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3320	chrome.exe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	build_20261104_201624.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	build_20261104_201624.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	build_20261104_201624.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	build_20261104_201624.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	build_20261104_201624.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 7 IoCs

defense_evasion

pid	Process
4920	taskkill.exe
3140	taskkill.exe
4648	taskkill.exe
3924	taskkill.exe
5060	taskkill.exe
3616	taskkill.exe
4952	taskkill.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2028	schtasks.exe
780	schtasks.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
1788	build_20261104_201624.exe
1788	build_20261104_201624.exe
1788	build_20261104_201624.exe
1788	build_20261104_201624.exe
1788	build_20261104_201624.exe
1788	build_20261104_201624.exe
1788	build_20261104_201624.exe
1788	build_20261104_201624.exe
1796	chrome.exe
1796	chrome.exe
1788	build_20261104_201624.exe
1788	build_20261104_201624.exe
1788	build_20261104_201624.exe
1788	build_20261104_201624.exe
1788	build_20261104_201624.exe
1788	build_20261104_201624.exe
1788	build_20261104_201624.exe
1788	build_20261104_201624.exe
1788	build_20261104_201624.exe
1788	build_20261104_201624.exe
1788	build_20261104_201624.exe
1788	build_20261104_201624.exe
1788	build_20261104_201624.exe
1788	build_20261104_201624.exe
1788	build_20261104_201624.exe
1788	build_20261104_201624.exe
1788	build_20261104_201624.exe
1788	build_20261104_201624.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1796	chrome.exe
1796	chrome.exe
1796	chrome.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	4920	taskkill.exe
Token: SeShutdownPrivilege	1796	chrome.exe
Token: SeCreatePagefilePrivilege	1796	chrome.exe
Token: SeShutdownPrivilege	1796	chrome.exe
Token: SeCreatePagefilePrivilege	1796	chrome.exe
Token: SeShutdownPrivilege	1796	chrome.exe
Token: SeCreatePagefilePrivilege	1796	chrome.exe
Token: SeShutdownPrivilege	1796	chrome.exe
Token: SeCreatePagefilePrivilege	1796	chrome.exe
Token: SeShutdownPrivilege	1796	chrome.exe
Token: SeCreatePagefilePrivilege	1796	chrome.exe
Token: SeShutdownPrivilege	1796	chrome.exe
Token: SeCreatePagefilePrivilege	1796	chrome.exe
Token: SeShutdownPrivilege	1796	chrome.exe
Token: SeCreatePagefilePrivilege	1796	chrome.exe
Token: SeShutdownPrivilege	1796	chrome.exe
Token: SeCreatePagefilePrivilege	1796	chrome.exe
Token: SeDebugPrivilege	3140	taskkill.exe
Token: SeShutdownPrivilege	1796	chrome.exe
Token: SeCreatePagefilePrivilege	1796	chrome.exe
Token: SeDebugPrivilege	4648	taskkill.exe
Token: SeDebugPrivilege	3924	taskkill.exe
Token: SeDebugPrivilege	5060	taskkill.exe
Token: SeDebugPrivilege	3616	taskkill.exe
Token: SeDebugPrivilege	4952	taskkill.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1796	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 820	1788	build_20261104_201624.exe	85
PID 1788 wrote to memory of 4176	1788	build_20261104_201624.exe	87
PID 1788 wrote to memory of 3532	1788	build_20261104_201624.exe	89
PID 1788 wrote to memory of 2676	1788	build_20261104_201624.exe	91
PID 1788 wrote to memory of 3464	1788	build_20261104_201624.exe	93
PID 1788 wrote to memory of 1088	1788	build_20261104_201624.exe	95
PID 1788 wrote to memory of 2028	1788	build_20261104_201624.exe	97
PID 1788 wrote to memory of 4616	1788	build_20261104_201624.exe	99
PID 1788 wrote to memory of 780	1788	build_20261104_201624.exe	101
PID 1788 wrote to memory of 3704	1788	build_20261104_201624.exe	103
PID 1788 wrote to memory of 4920	1788	build_20261104_201624.exe	105
PID 1788 wrote to memory of 1796	1788	build_20261104_201624.exe	109
PID 1796 wrote to memory of 3940	1796	chrome.exe	110
PID 1796 wrote to memory of 3268	1796	chrome.exe	111
PID 1796 wrote to memory of 3268	1796	chrome.exe	111
PID 1796 wrote to memory of 3320	1796	chrome.exe	112
PID 1796 wrote to memory of 3408	1796	chrome.exe	113
PID 1796 wrote to memory of 3408	1796	chrome.exe	113
PID 1796 wrote to memory of 4200	1796	chrome.exe	114
PID 1796 wrote to memory of 4160	1796	chrome.exe	115
PID 1796 wrote to memory of 4200	1796	chrome.exe	114
PID 1796 wrote to memory of 4160	1796	chrome.exe	115
PID 1796 wrote to memory of 3736	1796	chrome.exe	117
PID 1796 wrote to memory of 3736	1796	chrome.exe	117
PID 1796 wrote to memory of 2776	1796	chrome.exe	121
PID 1788 wrote to memory of 3140	1788	build_20261104_201624.exe	125
PID 1788 wrote to memory of 4648	1788	build_20261104_201624.exe	129
PID 1788 wrote to memory of 3924	1788	build_20261104_201624.exe	131
PID 1788 wrote to memory of 5060	1788	build_20261104_201624.exe	134
PID 1788 wrote to memory of 3616	1788	build_20261104_201624.exe	136
PID 1788 wrote to memory of 4952	1788	build_20261104_201624.exe	138
PID 1788 wrote to memory of 4896	1788	build_20261104_201624.exe	140
PID 4896 wrote to memory of 2784	4896	cmd.exe	142

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\build_20261104_201624.exe
"C:\Users\Admin\AppData\Local\Temp\build_20261104_201624.exe"
1⤵
- Executes a file named after a Windows system binary
- Adds Run key to start application
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Windows\SYSTEM32\icacls.exe
  icacls.exe "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker\RuntimeBroker.exe" /inheritance:r
  2⤵
  - Modifies file permissions
  PID:820
- C:\Windows\SYSTEM32\icacls.exe
  icacls.exe "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker\RuntimeBroker.exe" /grant:r "Admin:(F)"
  2⤵
  - Modifies file permissions
  PID:4176
- C:\Windows\SYSTEM32\icacls.exe
  icacls.exe "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker\RuntimeBroker.exe" /grant:r "SYSTEM:(F)"
  2⤵
  - Modifies file permissions
  PID:3532
- C:\Windows\SYSTEM32\icacls.exe
  icacls.exe "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker\RuntimeBroker.exe" /grant:r "Administrators:(F)"
  2⤵
  - Modifies file permissions
  PID:2676
- C:\Windows\SYSTEM32\icacls.exe
  icacls.exe "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker\RuntimeBroker.exe" /grant:r "Users:(RX)"
  2⤵
  - Modifies file permissions
  PID:3464
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks.exe /delete /tn "MicrosoftWindowsRuntimeBroker" /f
  2⤵
  PID:1088
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks.exe /create /tn "MicrosoftWindowsRuntimeBroker" /tr "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker\RuntimeBroker.exe\"" /sc onlogon /rl LIMITED /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2028
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks.exe /delete /tn "MicrosoftWindowsRuntimeBroker_WD" /f
  2⤵
  PID:4616
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks.exe /create /tn "MicrosoftWindowsRuntimeBroker_WD" /tr "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker\RuntimeBroker.exe\"" /sc minute /mo 5 /rl LIMITED /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:780
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker\RuntimeBroker.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker\RuntimeBroker.exe" /d
  2⤵
  - Executes a file named after a Windows system binary
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  PID:3704
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM chrome.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" about:blank --no-first-run --no-default-browser-check --window-position=0,0 --window-size=800,600
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1796
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffaef09c728,0x7ffaef09c734,0x7ffaef09c740
    3⤵
    PID:3940
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1736,i,9746546340842680976,2001240682947151717,262144 --field-trial-handle=2016,i,8781182504889268516,13801138416316900795,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2008 /prefetch:2
    3⤵
    PID:3268
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1640,i,4770019570989358948,9599306016112474690,524288 --field-trial-handle=2016,i,8781182504889268516,13801138416316900795,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2312 /prefetch:3
    3⤵
    - System Time Discovery
    PID:3320
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2368,i,2970733580471344700,17727291946627663435,524288 --field-trial-handle=2016,i,8781182504889268516,13801138416316900795,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2552 /prefetch:8
    3⤵
    PID:3408
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3164,i,1807332584107536599,11037109403952585092,2097152 --field-trial-handle=2016,i,8781182504889268516,13801138416316900795,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3188 /prefetch:1
    3⤵
    PID:4200
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3192,i,3553103170152362879,12485993494570591172,2097152 --field-trial-handle=2016,i,8781182504889268516,13801138416316900795,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3216 /prefetch:1
    3⤵
    PID:4160
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4268,i,5382963769702970610,346896314043362226,2097152 --field-trial-handle=2016,i,8781182504889268516,13801138416316900795,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4284 /prefetch:2
    3⤵
    PID:3736
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5600,i,18371804543927413706,9533823675797785319,524288 --field-trial-handle=2016,i,8781182504889268516,13801138416316900795,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5364 /prefetch:8
    3⤵
    PID:2776
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM chrome.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3140
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM msedge.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4648
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM firefox.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3924
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM firefox.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5060
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM firefox.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3616
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM firefox.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4952
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c netsh wlan show interfaces
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4896
- - C:\Windows\system32\netsh.exe
    netsh wlan show interfaces
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2784

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker\RuntimeBroker.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker\RuntimeBroker.exe"
1⤵
- Executes dropped EXE
PID:4972

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3304

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Direct Volume Access

T1006

File and Directory Permissions Modification

T1222

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

95c8d827-43ad-4dee-a17c-2e6ca90987ae.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\95c8d827-43ad-4dee-a17c-2e6ca90987ae.tmp
Size 130KB
SHA256 f133fb1a85663049ed5ee39b429a009577d1668ca23994295acf22212b0a6855
MD5 9c3dc52f9bcdbc9493863f2e64403591
SHA1 54905f7b26d241caac061712666521182d24b25f
SHA512 059a5d6ac5ca767ebe2ce20eb1c8f0bcd1cab2afa4e643bcff0debe64ea2aa55de16108d3dbe885f865d74b0ec44f8e6f95804cbab94e15da15dd92246e711d6
SSDEEP 3072:k+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+g2:k+hFD+7t56OD9ZfSAppr2
TLSH
T113D31232AA91D8BBC9BC6541B157A304DE726CED81DE3A09444A5F8EE09FC4C0773A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2712a830-812c-4184-b3ca-eaf93c2a9e40.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\2712a830-812c-4184-b3ca-eaf93c2a9e40.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

7f03cbb1-b2b9-44c7-bd09-933a6e20af24.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\7f03cbb1-b2b9-44c7-bd09-933a6e20af24.tmp
Size 414B
SHA256 31798a0c81589f2705e59ad1acc58008535995b7c0ec01f92d6563cbe80653eb
MD5 4750b9c96e4b95b27038f1481a66d500
SHA1 032e081d1fafafdc1089a5ca48a53f265bff8beb
SHA512 ddd2d0eb048d1407a396fb1c95b8b72ef12454c444e0fcafcd4e4b3921c45f8b877612c1d08d1d713d09faccbec9069f0a104afd6bedd6b75310beb589273a8e
TLSH
T129E02BFACD22EC271CFD0B595050064DEB4413572A82894F3B3D550D8FB163712C681C
MD5 SHA1 SHA512 TLSH

Submit Download

7201bdd0-30f0-461f-9738-62391f40767c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\7201bdd0-30f0-461f-9738-62391f40767c.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 a05f8afe96581d90368b741ca8ee56bb0797ffa87738acf376bd83264dac5cc0
MD5 4c4a380e1a17562985786d8972f6b948
SHA1 c661851ec2eb576ef227fb0745eaa26b40c9580c
SHA512 9712afdb6d96696df6f96065df7574e38911496b1540fc46da2a47f98bf0b027dc1a630005e2b59bf5f04090eb766a7340801bf17af5db93c81a2e147bed7cf7
SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2O4k7EHVumNn73:1nbZeMrv/hGt4/nb
TLSH
T1D8D3764B7A743102EDE59A722CE051BB5E3C716D8F11A5D438B620588EF2963A23D4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ckB676.tmp

Path C:\Users\Admin\AppData\Local\Temp\ckB676.tmp
Size 20KB
SHA256 334906fd31008f2d84315a8c9920fa831deccbede7d18910f64e36d4147725e5
MD5 d5659e042c795e653356aa7dae5d31a2
SHA1 c911e6247279a4b1bd135583b7d08731d7b9d83b
SHA512 df50af51f95e21968600958f72f8e69508283607bcd1b829e7519cd79745896fdb1dd2a4f5d2561a6ce37f5cc35dadb4365492d63cbe91f0dfc7f2642dafc05d
SSDEEP 24:TLyW91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fBb+d5wTxzsqKnKVxsZG8ltcj:TeW9aw/aHLopFMavU1iBKHox4ZnKv0ti
TLSH
T1AB92DD8E1F303215C0F88B32EDC209971EBD111C9313AA9AAE1464F3CE9259FF5061A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ckC2EF.tmp

Path C:\Users\Admin\AppData\Local\Temp\ckC2EF.tmp
Size 20KB
SHA256 de48f5c4308a2477450952a8fd6462c411cc966f9e0fb0065a252b3be831a482
MD5 7696a61462ad640aba1171c8c42f837d
SHA1 4b1efd332c87a107f7b72f71e4b88af6c7994e05
SHA512 4b9849565bdb051e85ce777cc950516fa73b8beb75d54cb794a536176e9c239c5ec46de257c01b028924579d94ef7ddba31872ab244d4c2f999000814437e8a0
SSDEEP 24:TLZLbXYFpFNYbatqn1kweka6za6UwpQ9YH8PATZ6HfB:T9LopFMatSaw/auUOt8B
TLSH
T1F4928A4E5F346220C0F44B36EDD189672F7C212CD3A72699DE1420F3DE925ABF1095AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gkAE8.tmp

Path C:\Users\Admin\AppData\Local\Temp\gkAE8.tmp
Size 96KB
SHA256 33a2357af8dc03cc22d2b7ce5c90abf25ac8b40223155a516f1a8df4acbf2a53
MD5 6066c07e98c96795ecd876aa92fe10f8
SHA1 f73cbd7b307c53aaae38677d6513b1baa729ac9f
SHA512 7d76207c1c6334aa98f79c325118adf03a5ba36b1e2412803fd3e654a9d3630c775f32a98855c46342eba00d4a8496a3ded3686e74beaac9c216beee37aa5cb7
SSDEEP 12:DQnD+23Fmdmc/OPVJXfPNn43etRRfYR5O8atLwxeYaNcDakMG/lO:DQnS232mNVpP965RayKN0MG/lO
TLSH
T192A3DD826B781395C44701B2FCB0565E0D3CA23849272B55AC39B0B30CD6A438A329FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RuntimeBroker.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker\RuntimeBroker.exe
Size 389KB
SHA256 5907fd2db2a24dd831fbf49787f46d9dcd12bbbce64b20d6aaaf5f66d4e8e210
MD5 c2099344fbafdc100fb98d8dc0cd6b1c
SHA1 85f3e7cfe9f213e4ad7d988a2c6be3ec407f7eb9
SHA512 fcfe836c4f1ef9f8f2b82587ec05b730e591d6133450d7c38adf406f48a6c2a2134b57e3a063e3aa19dae7463ef6ac09517f6cc2c7c6351b542c0bac60697c25
SSDEEP 6144:bP3b2phaEPx8lE6gcXXcx+90rIoqpzMow5vEQJ6hhvWQfPSqv2wPH9wTWhwE:z3yphao/6gU0+UxfxJwlp3Sm2wPdwC9
TLSH
T1A684E117B3AD30F8D5B7963888514941F772B8350B619B5F07A4437A2F636C8AE3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1788-626-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/1788-663-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/1788-21-0x00007FFB09E80000-0x00007FFB09FAA000-memory.dmp

Download

memory/1788-19-0x00007FFB09FB0000-0x00007FFB0A151000-memory.dmp

Download

memory/1788-18-0x00007FFB08630000-0x00007FFB08657000-memory.dmp

Download

memory/1788-17-0x00007FFB08950000-0x00007FFB08AA6000-memory.dmp

Download

memory/1788-16-0x00007FFB08F60000-0x00007FFB0900C000-memory.dmp

Download

memory/1788-15-0x00007FFB08C90000-0x00007FFB08F59000-memory.dmp

Download

memory/1788-13-0x00007FFB0AF10000-0x00007FFB0B105000-memory.dmp

Download

memory/1788-85-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/1788-142-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/1788-24-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/1788-20-0x00007FFB00240000-0x00007FFB00348000-memory.dmp

Download

memory/1788-145-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/1788-310-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/1788-307-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/1788-317-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/1788-14-0x00007FFB09650000-0x00007FFB0970E000-memory.dmp

Download

memory/1788-585-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/1788-582-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/1788-590-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/1788-598-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/1788-609-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/1788-614-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/1788-616-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/1788-615-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/1788-12-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/1788-631-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/1788-633-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/1788-641-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/1788-657-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/1788-22-0x00007FFB09850000-0x00007FFB09BA5000-memory.dmp

Download

memory/1788-665-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/1788-673-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/1788-686-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/1788-694-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/1788-689-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/1788-688-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/1788-687-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/1788-681-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/1788-680-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/1788-679-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/1788-678-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/1788-672-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/1788-671-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/1788-670-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/1788-664-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/1788-662-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/1788-656-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/1788-655-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/1788-654-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/1788-649-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/1788-648-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/1788-647-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/1788-646-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/1788-640-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/1788-639-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/1788-638-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/1788-632-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/1788-630-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/1788-623-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/1788-608-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/1788-606-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/1788-4-0x0000000140000000-0x00000001404D7000-memory.dmp

Download