96214b00e6bd0d1d9809fb1c01df5a1ab81e6af4b3e96af2c71c8138655c8a87

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/07/2026, 12:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-03_8ac473a394851648208afa8fecae6b22_amadey_cobalt-strike_emotet_hijackloader_icedid_luca-ste.exe
Size 17.6MB
Sample260703-pm5dhsd13p
SHA256 96214b00e6bd0d1d9809fb1c01df5a1ab81e6af4b3e96af2c71c8138655c8a87
MD5 8ac473a394851648208afa8fecae6b22
SHA1 84816dd3e818d2a968c059bb4b797de6bd03849f
SHA512 dad2a1ad91f502520af32facf2af927e0719b84226b0da87b7b06f8cbed77b3c17704d51b0c9cb136ae83360a08a88811289053a4c52a6572d8b74740b8a1590
SSDEEP 196608:6WyZ/K0ttYVAAT1Kmd0eolySWyZ/K0ttYVAAT1Kmd0eolnKz:VyZ/K0ttYZTEq0WyZ/K0ttYZTEq0dK
TLSH
T166176A13F2A501E9E06AD174CF668231DB727C594BF1A6EF224076D52E33AD07B39722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Program Files\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Program Files\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Program Files\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Program Files\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Program Files\Crashpad\settings.dat	chrmstp.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4968	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134275552816673435"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
2188	chrome.exe
2188	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeCreatePagefilePrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeCreatePagefilePrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeCreatePagefilePrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeCreatePagefilePrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeCreatePagefilePrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeCreatePagefilePrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeCreatePagefilePrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeCreatePagefilePrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeCreatePagefilePrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeCreatePagefilePrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeCreatePagefilePrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeCreatePagefilePrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeCreatePagefilePrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeCreatePagefilePrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeCreatePagefilePrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeCreatePagefilePrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeCreatePagefilePrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeCreatePagefilePrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeCreatePagefilePrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeCreatePagefilePrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeCreatePagefilePrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeCreatePagefilePrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeCreatePagefilePrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeCreatePagefilePrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeCreatePagefilePrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeCreatePagefilePrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeCreatePagefilePrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeCreatePagefilePrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeCreatePagefilePrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeCreatePagefilePrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeCreatePagefilePrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeCreatePagefilePrivilege	1480	chrome.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
3792	chrmstp.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 4732	1768	2026-07-03_8ac473a394851648208afa8fecae6b22_amadey_cobalt-strike_emotet_hijackloader_icedid_luca-ste.exe	85
PID 1768 wrote to memory of 1480	1768	2026-07-03_8ac473a394851648208afa8fecae6b22_amadey_cobalt-strike_emotet_hijackloader_icedid_luca-ste.exe	86
PID 1480 wrote to memory of 4252	1480	chrome.exe	87
PID 1480 wrote to memory of 2084	1480	chrome.exe	88
PID 1480 wrote to memory of 2084	1480	chrome.exe	88
PID 1480 wrote to memory of 4968	1480	chrome.exe	89
PID 1480 wrote to memory of 5048	1480	chrome.exe	90
PID 1480 wrote to memory of 5048	1480	chrome.exe	90
PID 1480 wrote to memory of 3268	1480	chrome.exe	93
PID 1480 wrote to memory of 3268	1480	chrome.exe	93
PID 1480 wrote to memory of 4484	1480	chrome.exe	92
PID 1480 wrote to memory of 4484	1480	chrome.exe	92
PID 1480 wrote to memory of 3100	1480	chrome.exe	94
PID 1480 wrote to memory of 3100	1480	chrome.exe	94
PID 1480 wrote to memory of 116	1480	chrome.exe	95
PID 1480 wrote to memory of 116	1480	chrome.exe	95
PID 1480 wrote to memory of 4940	1480	chrome.exe	96
PID 1480 wrote to memory of 4940	1480	chrome.exe	96
PID 1480 wrote to memory of 3964	1480	chrome.exe	97
PID 1480 wrote to memory of 3964	1480	chrome.exe	97
PID 1480 wrote to memory of 4436	1480	chrome.exe	99
PID 1480 wrote to memory of 3076	1480	chrome.exe	100
PID 3076 wrote to memory of 1408	3076	chrmstp.exe	103
PID 3076 wrote to memory of 3792	3076	chrmstp.exe	104
PID 3792 wrote to memory of 4312	3792	chrmstp.exe	105
PID 1480 wrote to memory of 1476	1480	chrome.exe	109
PID 1480 wrote to memory of 4524	1480	chrome.exe	110
PID 1480 wrote to memory of 2788	1480	chrome.exe	111
PID 1480 wrote to memory of 2188	1480	chrome.exe	119

C:\Users\Admin\AppData\Local\Temp\2026-07-03_8ac473a394851648208afa8fecae6b22_amadey_cobalt-strike_emotet_hijackloader_icedid_luca-ste.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-03_8ac473a394851648208afa8fecae6b22_amadey_cobalt-strike_emotet_hijackloader_icedid_luca-ste.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Users\Admin\AppData\Local\Temp\2026-07-03_8ac473a394851648208afa8fecae6b22_amadey_cobalt-strike_emotet_hijackloader_icedid_luca-ste.exe
  C:\Users\Admin\AppData\Local\Temp\2026-07-03_8ac473a394851648208afa8fecae6b22_amadey_cobalt-strike_emotet_hijackloader_icedid_luca-ste.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=103.0.5060.114 --initial-client-data=0x274,0x278,0x27c,0x250,0x280,0x7ff6f640b618,0x7ff6f640b628,0x7ff6f640b638
  2⤵
  PID:4732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1480
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff91150c728,0x7ff91150c734,0x7ff91150c740
    3⤵
    PID:4252
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1728,i,15406269140713393633,480278509464502659,262144 --field-trial-handle=1852,i,7136098155335290580,7439085017752412751,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1820 /prefetch:2
    3⤵
    PID:2084
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2224,i,16720459131883028186,11088125856614404192,524288 --field-trial-handle=1852,i,7136098155335290580,7439085017752412751,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1608 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4968
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2332,i,8732061959576869365,3179361608496645266,524288 --field-trial-handle=1852,i,7136098155335290580,7439085017752412751,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2640 /prefetch:8
    3⤵
    PID:5048
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3204,i,8436980209777912832,2047539710471469143,2097152 --field-trial-handle=1852,i,7136098155335290580,7439085017752412751,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3220 /prefetch:1
    3⤵
    PID:4484
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3208,i,13384820918547043585,585461064129449490,2097152 --field-trial-handle=1852,i,7136098155335290580,7439085017752412751,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3244 /prefetch:1
    3⤵
    PID:3268
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4292,i,11587530036333515244,9437926046512305022,2097152 --field-trial-handle=1852,i,7136098155335290580,7439085017752412751,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4308 /prefetch:2
    3⤵
    PID:3100
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4668,i,6079697772377975961,10627396256311225365,2097152 --field-trial-handle=1852,i,7136098155335290580,7439085017752412751,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4332 /prefetch:1
    3⤵
    PID:116
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4840,i,15556176484775342322,8146002359236113868,524288 --field-trial-handle=1852,i,7136098155335290580,7439085017752412751,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4808 /prefetch:8
    3⤵
    PID:4940
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4984,i,15451679065436342354,1951447647265385610,524288 --field-trial-handle=1852,i,7136098155335290580,7439085017752412751,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4992 /prefetch:8
    3⤵
    PID:3964
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5440,i,7766730784607514674,14854049723401452723,524288 --field-trial-handle=1852,i,7136098155335290580,7439085017752412751,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5448 /prefetch:8
    3⤵
    PID:4436
- - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
    3⤵
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:3076
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff6809155a0,0x7ff6809155ac,0x7ff6809155b8
      4⤵
      Drops file in Program Files directory
      PID:1408
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
      4⤵
      Drops file in Program Files directory
      Modifies registry class
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:3792
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff6809155a0,0x7ff6809155ac,0x7ff6809155b8
        5⤵
        Drops file in Program Files directory
        
        PID:4312
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5828,i,18054926280828492901,3107529006835445995,524288 --field-trial-handle=1852,i,7136098155335290580,7439085017752412751,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5460 /prefetch:8
    3⤵
    PID:1476
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5848,i,3183998509429128616,12776803229728491529,524288 --field-trial-handle=1852,i,7136098155335290580,7439085017752412751,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5696 /prefetch:8
    3⤵
    PID:4524
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5692,i,11860702357070470550,1954324014765418877,524288 --field-trial-handle=1852,i,7136098155335290580,7439085017752412751,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5792 /prefetch:8
    3⤵
    PID:2788
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5624,i,7616158189528652086,6181301059681902357,262144 --field-trial-handle=1852,i,7136098155335290580,7439085017752412751,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5736 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2188

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Program Files\Crashpad\settings.dat
Size 40B
SHA256 23cf1c00d83e0bcc8457755e2c39e1f39fa33e423d619281a05a4d9b315f6b8a
MD5 c65c7673fdeaa16ee58ec3acc233b4fd
SHA1 c2fed56c577be33aec3d4ae93c495987d81606f7
SHA512 f48ae60345706193daeae5bb2afb1d4e1ed4f45ee4e0113e98745801e39f508d32fd2b6c7711bb9def82823f0547778b7f7aea7699b7a187f550ae2cccef1ae6
MD5 SHA1 SHA512

Submit Download

3076_13427555281995733.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\3076_13427555281995733.pma
Size 344B
SHA256 fd668d6edcf6b6cc176edd9bf7b0d7f1881fe2f0d94ebae656127c27a359550e
MD5 1b7cdddfb06152ae01f12d9f253237d6
SHA1 1ef358781a086a0727f4fa95cd53510eb328bc52
SHA512 4705c93b233be92dd2d04649d404b538bc76607bbe655d5e35a739653ac1af776ecdd12ec1cbf81476070ec5bae633f891817155014730a06939efb21bd132ea
TLSH
T159E0A79677648B7BD446CD31457B03523F6AF8501F81176F4740758F1E522D88E06420
MD5 SHA1 SHA512 TLSH

Submit Download

3792_13427555281977240.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\3792_13427555281977240.pma
Size 696B
SHA256 cb1b94bdd2d9b0183048030b178be4f9ec2d1e56d6195bb66b5f6c58f9d625c8
MD5 3a360f61f3c3ad1323169821e2ca2af0
SHA1 7f2370694f22f859a2b600194c2756091c87a174
SHA512 7d9d396e892c4be9ef090b038bcf8d89e585a60ae7e2e569a2a065254417f02d0351a736d8f20bdf47d6980ea474c6e79e7bc7a67872003e1028ebfbdb835b1d
TLSH
T19D01C94AA3144F67CC468E3584BE27512BB9FA501F821BBF7B10724F2E021C89E99168
MD5 SHA1 SHA512 TLSH

Submit Download

chrome_installer.log

Path C:\Program Files\chrome_installer.log
Size 8KB
SHA256 f8aeab2f3d074be0a16d2b0b87602467c595e15393881d20d2bf117825e6e58f
MD5 02878d2687dbfb1c034cfe3f72be4430
SHA1 a127dfbc533b4094e1020ae3758abbdbdc3bc9d0
SHA512 c1faa08f43daf552e80995359fe363d1696a4b2cfc7fc311b768d7e0b947f792afe7d7523e83d475a2f8b3582589a37b7b01784fc621d8dc728113d0b57b0d4f
SSDEEP 96:YLIavOUR5Ns36OwfvhK3DK3yYuzhqG4nfhK2/K2qUxSNC8HAcxhhK3GK3T/D0:OHGz3i8n7hSdco8zFi/g
TLSH
T1CA12CE9A9E02556F3BC18F2B338332616ED7100AC7E465723BEF9156F0CAA74101F9A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 77bcdb2c3160a7fd4141144587938963255d18e2280ca048bae35e2b889daae1
MD5 f444c4b91d48467daad7fc304bf0b2b7
SHA1 0a54e0644c006f7b684b802915a76b0b9e907f2e
SHA512 954788cc6221a65dba3cd53452e7ffe912bdce7b20bd8cf2525ecbc1a2e6c0ba3448dfbcc8997d4347508beecb9ddb77704805450cb4090f76ac02aea569ca9f
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 9bd5559a405b088e11c109662c8394872afb22b89bb47df0a609b49f4d2e6419
MD5 f572276e71a3b5fbd354e570ef969d1a
SHA1 8fb2dcdebbc972331763dc9e46414ef387d924f2
SHA512 af16115ec3b696a9de407a351a28e687fa8c1c95b6c01f37c693cb839a97d5553f26d629b2b0cecb05abea719faa8b33a74ae4b200e65d6c3c65c526517034e3
TLSH
T152E022A7C865AC7B2DFD471820914B49EEA623162AC1991F3A3DC30C8FB563A4586C6C
MD5 SHA1 SHA512 TLSH

Submit Download

Google Profile.ico

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
Size 192KB
SHA256 87e933966804aefee5b77abdae95b1a7f72c298b148190d7d20fe6a77c239f3b
MD5 010ec79a1098823a764aca5c4adfcbef
SHA1 ee77b3b4682e7b05075d7713f354162fe02555bb
SHA512 3ca45c2be2a916e19c5d9c467e1cdfac64b9243c29c9ac79dcde1342cc0cb9203d3f6ffe1b9ca1257799f6c70237e12019908e2c5091dd77d40134a0ae25d6f8
SSDEEP 3072:2Xm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4gMg3cdrqZByGk:2XUMCm4U6q62MEBi99g9sdIJZpVhA
TLSH
T1BA143B265EEEE940EEB11A753E7E4381D6B5B80689FD21E45AE23C112B7FCF505B9003
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 159c932ddc720b74d629b0302a32b9a3c8fd59ebb2105277cb8d159c47111d21
MD5 575c2f59297927a871dd424023b9cd46
SHA1 2082ccbaaee149eebdadbf2c86e11e1f5c7019da
SHA512 aa3d0ff5c847f317927e38ee99dd130981196661908206d311c7a4c4e812050f1734ea6f27dc3d5f7928f1a2d4af0f7f8493c3e987aa9998e92e578dd9623088
TLSH
T12D519BF3C3E4966DC91596E4DB206E2FCE7D0A14032C3C6688D8AE1B53E2872D21138E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 ca0bad6243615a3c8d2f0420fabcdf2d1a658363976568053de742169aa42f5b
MD5 89b53c3859586a486ae61ca04052428f
SHA1 271058c2185aa8bfd9fcc040bd5738d35b8613db
SHA512 ccb35b7f884be80c41dd14b810ff8fb531780d45c807a557dfae731c4acd937258ec4f66e373676a7cdea365b91a8e30c516d5b8057b6f06206d92a4d66a63a6
SSDEEP 192:WpRcDH9P5BgL2EvSTOREunec5shBNi6wWv7VJ9PRp26Xsb+WNncdJ2rZvk2CLkwp:qREvsv8BHXBXwU2a2s6a88
TLSH
T17832B32EBE15753F9CCAC32AFA167617E7F5102075842E88E7F88A1C16D79DC222711B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 d4a8f01f147d414c675b3fbc72860d25d6a33b1bb947175c290b9b857b80d5e0
MD5 ece18c3a6012acaff2d19ae677dac71c
SHA1 dda5248e1a1e178b73af44dc1ad73f20eb9e3eb9
SHA512 5cf616538cb603791a34b338891c1498c4210df6ea1f0c402d26dfbb149f7263755a8f047034a521378b5bfa201829b85cf64a06bc56aa8e5f8c45f50fe321d5
SSDEEP 192:WpRcDH9P5BygL2EvSTOREunec5shBNi6wWv7VJ3IPRpFT6Xsb+WNncdJ2rgvk2Cd:qREvvv8BsXQXwU252s6aae
TLSH
T1C842D62EBA15753F9CCAD32AFA167716E3F4502175842E48E7FC8A1C16E79CC222711B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 6e372eed34e569d8ad9e126177540db6d6b9db6ccfa3da40fb18d8c6076c7a5b
MD5 3b8492c922447b3513312fa1ef522d05
SHA1 cd86f31d3c1b67b2fccc1e89222f435da42c0eb3
SHA512 14fd3cc28dcab1bcd793c8170c321ebc20f2323dccf7d4e09ac1702da3dca28441d1fe7dab7a014f9b8b65223b4453b9af1e7faaabf5ec9512f917296c49a3f5
SSDEEP 192:WpRcDH9P5BgL2EvSTOREunec5shBNi6wWv7VJ3IPRpFT6Xsb+WNncdJ2rgvk2CLh:qREvsv8BsXQXwU252s6aae
TLSH
T17E42D52EBA15753F9CCAD32AFA167716E3F4502175842E48E7FC8A1C16E79CC222711B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe587402.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe587402.TMP
Size 3KB
SHA256 4b072bb8a61ee8cedeb91aae2960e4d9840724c0c96df75171a115967959478f
MD5 83002b439f21c14e3114685ac87d16e0
SHA1 9f2bc883bb045917f087ac1459460db5db70f76e
SHA512 81a829931b7db53e736ad5c6e5a5d673fafbb9b9a2acae875eaf0f4e9606d5403c51c07b8fee8c3617b06657272909f1a658811dd0db45d18773e3f2b87bfde6
TLSH
T193614269D5700DAB5DF6B778BCBE1B82F951023F1140280639BE168C4FB397B8085F6A
MD5 SHA1 SHA512 TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 7f2c3bb0b002e4d7d49e8ebd780daefdc42e5000eb8a51c5ee9d65c53ca14658
MD5 238ecb1a3e1c98f2912f099b0b7b8a1c
SHA1 8ef41ba79237b6d6468df95cd855e11fa292bdcc
SHA512 ce27ea08a3f6036dcdccaf5606f131bfeaa96a34cb88aad7fdbbef444d0eb669f860c23142443bbec8334482763511fadcc152f5ae3ac7f75fcb910a49c20877
SSDEEP 384:Kkj+F7KxkXqKf/pUZNCgVLH2HfgsloD7pLuLcSjsNXOD+F+ErU3qsHGZ45hUeHD:Ko+F7KxkXqKf/pUZNCgVLH2HfgsuD7pY
TLSH
T16D72F9677C4C9A3B0F94C6CCEC277B4FADB6024B65E9886542FA581503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 064b9bc95b3ed97cd51e8ed860b81050feb4cde1b6c746c5ca2ed9a69a40d748
MD5 7ff5bb4998645872811a41cdd9dfe96e
SHA1 bd3192cf7a4b2b4c459e0ccaff372bc0434550b3
SHA512 bfe98a5b545f19fa43f3961545dd33c2290a0a1a3d4d1dda7fa48b578643c9e56ad099e5788877f9c4720b75f10b540b75b6e72f61b3b521f87d648af5167d4b
TLSH
T178B01251D0429121C04302F03146148CB1145F14970E1B0543E0BD22C83916185150D0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589f68.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe589f68.TMP
Size 96B
SHA256 1742c079b2ed49cc454d0961d3589ae3aff7d17dcb06d6d9415e41e9eba3f942
MD5 a63eb6f08ba3bf64f8a484a2e109a887
SHA1 03651efb7606d50d6f99d449e91fb57e9c0a23a0
SHA512 c49370be4d759ed027669c4721381a00738042bcc3db24d74ca1e8c4f35248b411c7266257a2da7c712f3693b350f102038bcc35fdb4cfc77e4a98925cefc56b
TLSH
T16CB00259C3027217C44217B065A595DCB5B1DF25C6032363A3E21B6BEC356714D262A0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 234KB
SHA256 225fee4470f0f5ae1f7003807dc5ae24d209246dde3850e9730ddbae044e0f60
MD5 b4a43c6096b5e488d9441a4de27baae8
SHA1 0a8b332db7c7bc1b8084b60e9dc2d3e8f3bce4cf
SHA512 a01eb47269245119bb6de101e94006b6ca929f63141b5f04db1ff8e6919636e4dbd98e32fa1b6eca2ce6fef0e031c763e910e1a9cf92bd4bf49cc86027f339a5
SSDEEP 3072:jB1mgCELZtCpXh5qTfATCuIbzQACV1cnJLL5hqfd7NtZL8cHQRZEQ6Sps0:jvmg1kQfATCFbzQACjEqZ/ZLW3Ex0
TLSH
T1F534123B9FD11E3A1B424EA075421FE5A7F6966FC9305708936A2BF72DC3C426682858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 bcb1163892ed9e8e8ad52a0f86421b1cb4b4c9ac027b96611e337863a511bf77
MD5 35db1f382007cffe525122015d55c49e
SHA1 30205497455ac5005fdeb9971a5d8f337833bd01
SHA512 b249f0cfc59450e10abaa686a50ebb66e181fcb50a9056d8f713d5733569153f8e42755632d979cdf6695a454016cdb0bce1fd99ea83bccfd790e7a84de0944e
SSDEEP 1536:6nyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbji:8qfd7NtZL8cHQRZEQ6Sps9
TLSH
T1F4C30237EBC25F335D82CB647A534FDA97B644A99030D301AABD3BFB6C93451644249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 326d839111a76a79dad2a83bf67c28a12f36cc0b4845a8c49178f964919d72e3
MD5 ed5b6928c9ba482101d4a8eae4079d4d
SHA1 63e23fd0d0089290a6e093ccd53acca576c9ac6e
SHA512 c8afe4696ab180bbc0c8646bd550f9a7fc6cc6640cfddab7b15f4af6612898075d8467a8ed2886ab43dd689fe7deef96c955f1cf11bb89aeaa0e8c5e6041fefa
SSDEEP 3072:E+1mgCELZtCpXh5qTfATCuIbzQACV1cnJLL5hqfd7NtZL8cHQRZEQ6Sps0:tmg1kQfATCFbzQACjEqZ/ZLW3Ex0
TLSH
T16234123B9FD10E3B1B428AB076430EE9B3F65A6AD8305744937E17FB69C3C462782459
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bb13f5cb-10f2-4049-8adc-f4a3e2012889.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\bb13f5cb-10f2-4049-8adc-f4a3e2012889.tmp
Size 233KB
SHA256 409f0c83b25e82d3a03f3c61edd221bd5ed0e459d626cf68f0d138e44aabc8c0
MD5 7a1438ea359f1ba84bd6eb7617d19f1a
SHA1 a3a36df0783d3b1c2e32e82df27d0909484de676
SHA512 3efedac779b5f0d9e47e6ca14ca7f61f454fedd9e6b7af3e2b4fb5b821921aca8941b0f31c4b0af524881a415985b160a941bb74c168b3f77e67a4c8710fc43a
SSDEEP 3072:R+1mgCELZtCpXh5qTfATCuIbzQACV1cnJLL5hqfd7NtZL8cHQRZEQ6Sps0:ymg1kQfATCFbzQACjEqZ/ZLW3Ex0
TLSH
T17234123B9FD10E3B1B428AB076430EE9B3F65A6AD8305744937E17FB69C3C422782459
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download