c05b0ff470f3a0c7d8679d48217c35c8d473c406d8cacaadd8993073cd60b717

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/07/2026, 01:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_a42b2d741433ad756ab8f23893928b44_amadey_cobalt-strike_emotet_hijackloader_icedid_luca-ste.exe
Size 24.5MB
Sample260707-b85phscw9p
SHA256 c05b0ff470f3a0c7d8679d48217c35c8d473c406d8cacaadd8993073cd60b717
MD5 a42b2d741433ad756ab8f23893928b44
SHA1 77f24d5d9d99fbddde12a079f40c41142dc67b2a
SHA512 0257613e0a07b46b69b3278b024aef37e29eb30e2df1acb8c58bed36ca44fd4a40d40a1eac92f67ca93cbb08511a8165e390a70d0547cd27e63b647869824cc1
SSDEEP 393216:VyZ/K0ttYZTEqayZ/K0ttYZTEqBWqQjp3:VyZ/K0ttYZTEqayZ/K0ttYZTEqUfjp3
TLSH
T166477D03F2A841A9E06AD178CE669732EB727C494BF165DF224076D52F33AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Program Files\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Program Files\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Program Files\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Program Files\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Program Files\Crashpad\metadata	chrmstp.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3564	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134278626128219548"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4944	chrome.exe
4944	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
1544	chrmstp.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2296	3028	2026-07-06_a42b2d741433ad756ab8f23893928b44_amadey_cobalt-strike_emotet_hijackloader_icedid_luca-ste.exe	84
PID 3028 wrote to memory of 4732	3028	2026-07-06_a42b2d741433ad756ab8f23893928b44_amadey_cobalt-strike_emotet_hijackloader_icedid_luca-ste.exe	85
PID 4732 wrote to memory of 4500	4732	chrome.exe	86
PID 4732 wrote to memory of 960	4732	chrome.exe	87
PID 4732 wrote to memory of 960	4732	chrome.exe	87
PID 4732 wrote to memory of 3564	4732	chrome.exe	88
PID 4732 wrote to memory of 2328	4732	chrome.exe	89
PID 4732 wrote to memory of 2328	4732	chrome.exe	89
PID 4732 wrote to memory of 984	4732	chrome.exe	91
PID 4732 wrote to memory of 984	4732	chrome.exe	91
PID 4732 wrote to memory of 4404	4732	chrome.exe	92
PID 4732 wrote to memory of 4404	4732	chrome.exe	92
PID 4732 wrote to memory of 2912	4732	chrome.exe	93
PID 4732 wrote to memory of 2912	4732	chrome.exe	93
PID 4732 wrote to memory of 4624	4732	chrome.exe	94
PID 4732 wrote to memory of 4624	4732	chrome.exe	94
PID 4732 wrote to memory of 3536	4732	chrome.exe	95
PID 4732 wrote to memory of 3536	4732	chrome.exe	95
PID 4732 wrote to memory of 4936	4732	chrome.exe	96
PID 4732 wrote to memory of 4936	4732	chrome.exe	96
PID 4732 wrote to memory of 1628	4732	chrome.exe	98
PID 4732 wrote to memory of 2748	4732	chrome.exe	99
PID 2748 wrote to memory of 4868	2748	chrmstp.exe	102
PID 2748 wrote to memory of 1544	2748	chrmstp.exe	103
PID 1544 wrote to memory of 4876	1544	chrmstp.exe	104
PID 4732 wrote to memory of 4792	4732	chrome.exe	117
PID 4732 wrote to memory of 3844	4732	chrome.exe	118
PID 4732 wrote to memory of 212	4732	chrome.exe	119
PID 4732 wrote to memory of 4944	4732	chrome.exe	122

C:\Users\Admin\AppData\Local\Temp\2026-07-06_a42b2d741433ad756ab8f23893928b44_amadey_cobalt-strike_emotet_hijackloader_icedid_luca-ste.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_a42b2d741433ad756ab8f23893928b44_amadey_cobalt-strike_emotet_hijackloader_icedid_luca-ste.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Users\Admin\AppData\Local\Temp\2026-07-06_a42b2d741433ad756ab8f23893928b44_amadey_cobalt-strike_emotet_hijackloader_icedid_luca-ste.exe
  C:\Users\Admin\AppData\Local\Temp\2026-07-06_a42b2d741433ad756ab8f23893928b44_amadey_cobalt-strike_emotet_hijackloader_icedid_luca-ste.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=103.0.5060.114 --initial-client-data=0x274,0x278,0x27c,0x250,0x280,0x7ff63bc9b618,0x7ff63bc9b628,0x7ff63bc9b638
  2⤵
  PID:2296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4732
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff93af3c728,0x7ff93af3c734,0x7ff93af3c740
    3⤵
    PID:4500
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1768,i,7312759930999964316,3827628128019022111,262144 --field-trial-handle=2024,i,5588083215957606402,8991289425387964741,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2016 /prefetch:2
    3⤵
    PID:960
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1608,i,11236961689347063326,3610269151717742829,524288 --field-trial-handle=2024,i,5588083215957606402,8991289425387964741,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1512 /prefetch:3
    3⤵
    - System Time Discovery
    PID:3564
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=1948,i,16560211834800885783,7475075546211595052,524288 --field-trial-handle=2024,i,5588083215957606402,8991289425387964741,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2360 /prefetch:8
    3⤵
    PID:2328
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3212,i,15611902899090681828,11470135260050284599,2097152 --field-trial-handle=2024,i,5588083215957606402,8991289425387964741,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3268 /prefetch:1
    3⤵
    PID:984
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3220,i,17443961874224106312,15160315135308069319,2097152 --field-trial-handle=2024,i,5588083215957606402,8991289425387964741,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3288 /prefetch:1
    3⤵
    PID:4404
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4308,i,10035488288531723477,11322491151947998413,2097152 --field-trial-handle=2024,i,5588083215957606402,8991289425387964741,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4272 /prefetch:2
    3⤵
    PID:2912
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4672,i,1722635459776489359,13464475200212479749,2097152 --field-trial-handle=2024,i,5588083215957606402,8991289425387964741,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4700 /prefetch:1
    3⤵
    PID:4624
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4668,i,14575206077501782918,804687677126716004,524288 --field-trial-handle=2024,i,5588083215957606402,8991289425387964741,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4848 /prefetch:8
    3⤵
    PID:3536
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5008,i,574827027005632371,16993879019697791692,524288 --field-trial-handle=2024,i,5588083215957606402,8991289425387964741,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5016 /prefetch:8
    3⤵
    PID:4936
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5512,i,16052983881087259329,8489191041761428356,524288 --field-trial-handle=2024,i,5588083215957606402,8991289425387964741,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4948 /prefetch:8
    3⤵
    PID:1628
- - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
    3⤵
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:2748
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff628b155a0,0x7ff628b155ac,0x7ff628b155b8
      4⤵
      Drops file in Program Files directory
      PID:4868
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
      4⤵
      Drops file in Program Files directory
      Modifies registry class
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:1544
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff628b155a0,0x7ff628b155ac,0x7ff628b155b8
        5⤵
        Drops file in Program Files directory
        
        PID:4876
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5720,i,4996955639694169252,3570904193368261141,524288 --field-trial-handle=2024,i,5588083215957606402,8991289425387964741,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4960 /prefetch:8
    3⤵
    PID:4792
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5560,i,6454149700876209319,2730445574369972256,524288 --field-trial-handle=2024,i,5588083215957606402,8991289425387964741,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5772 /prefetch:8
    3⤵
    PID:3844
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=208,i,14759544651934266772,4816111798427653905,524288 --field-trial-handle=2024,i,5588083215957606402,8991289425387964741,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5696 /prefetch:8
    3⤵
    PID:212
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4368,i,17469157631407223340,4736005695382970638,262144 --field-trial-handle=2024,i,5588083215957606402,8991289425387964741,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5660 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4944

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Program Files\Crashpad\settings.dat
Size 40B
SHA256 c63c4eaf7c6eb83a8a28a9db0a1f1d6cef5b7fffbea4d48656099382d5d8b39e
MD5 e5adcb03ee07877a3d3bff3cebcd9064
SHA1 9bd2c5ab99129b1fdbab2e2b211d589c027ce491
SHA512 f6ecee5753849afd2314f7e6af6f9bed3f00b1e4b864aaf6896926798edaa5b8223dc349f88080ded450788883cdc72b0b808d8e3c6c6fb259dba0402d31e97c
MD5 SHA1 SHA512

Submit Download

1544_13427862613157394.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\1544_13427862613157394.pma
Size 696B
SHA256 efdac18a2cd8b05ecaf52c08dab886663e1678bb74a22d7408ff5c66012f9a4b
MD5 5ba07c0840ac9c7ce606a9fdb6ba7550
SHA1 6134e3c27af2f82e317d843ca20f6ccaa3833c04
SHA512 64cee5e7a1dbc1184ebcbe095c68941f839de8a6d4a8eb708f8559ae8aafc2c1263106e73fcd4f49ea878e92bf83dbd6d095a72e62da5a9cba0b32814f46cf92
TLSH
T12B010E46A3144F77CC828D3585FF27912BB0FA501B821BBF7B24724F2E021C89E99168
MD5 SHA1 SHA512 TLSH

Submit Download

2748_13427862613174623.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\2748_13427862613174623.pma
Size 344B
SHA256 fd668d6edcf6b6cc176edd9bf7b0d7f1881fe2f0d94ebae656127c27a359550e
MD5 1b7cdddfb06152ae01f12d9f253237d6
SHA1 1ef358781a086a0727f4fa95cd53510eb328bc52
SHA512 4705c93b233be92dd2d04649d404b538bc76607bbe655d5e35a739653ac1af776ecdd12ec1cbf81476070ec5bae633f891817155014730a06939efb21bd132ea
TLSH
T159E0A79677648B7BD446CD31457B03523F6AF8501F81176F4740758F1E522D88E06420
MD5 SHA1 SHA512 TLSH

Submit Download

chrome_installer.log

Path C:\Program Files\chrome_installer.log
Size 8KB
SHA256 f7d66d20443782a50d1c1a08862c49e9f21f4c103478cb6490e8ce62dab0ef65
MD5 1aa9261c0948aa1cc629ec04a737898c
SHA1 6a80d315b11a5a6671ebb2b658da3ea3d4757c8a
SHA512 29d691ec5952a4aeb4a0b2562d9d7b7c52486f23478d8f0d1d8268c319e90089a0746a506502627ae44075d2c7977a9781f7a1c206b9820b4b0eeb09bda0d319
SSDEEP 192:vYxKi5SR2BtGCns4JYY/8WZ4uCZOtX34+rpad+8:gxKi5SRSsBOnXpad+8
TLSH
T1AF12BFAE8E42486F3B85CF6B335321555E9B344ACBE465723BDFC205F0CAAA4041F5A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 a9bc91a3244e7d72467b656c5486d15c0ed9f92add88f691c3853e2b856cbd81
MD5 b1e1deec2c4182d0013a230b355f4c7d
SHA1 126437183b8f548051a3f561eea1eb0ee68fc9cc
SHA512 e718639402727b342725497f1be1fb31c240520b2883d9791df2e05dd851d0e309e06e9942c2a24d6090668922ba1d9f9a1ebf9b87311e7d55ee2d605549ce06
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 1c8f9a9614146c5720205d5467cbed94fc3d8d34775f3c25060fb73a9e487ba6
MD5 91c37e734bc75fed3ee67d1232f220f9
SHA1 4cfc1dc53b6e235c87fed27af28ebf6dd017a80c
SHA512 f2863f157dd55232cf52deef0d9242cc55ecc2b539d64aadfadaa8466787a57f073587cb12047957db3c8d4d6389066c5ccdf9c892ffd3124258cdf6de2e966d
TLSH
T1C7E02BA9C922AC3719FC175864658745E641531727409C5F7B3D410C4FB473A4186D6C
MD5 SHA1 SHA512 TLSH

Submit Download

Google Profile.ico

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
Size 192KB
SHA256 87e933966804aefee5b77abdae95b1a7f72c298b148190d7d20fe6a77c239f3b
MD5 010ec79a1098823a764aca5c4adfcbef
SHA1 ee77b3b4682e7b05075d7713f354162fe02555bb
SHA512 3ca45c2be2a916e19c5d9c467e1cdfac64b9243c29c9ac79dcde1342cc0cb9203d3f6ffe1b9ca1257799f6c70237e12019908e2c5091dd77d40134a0ae25d6f8
SSDEEP 3072:2Xm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4gMg3cdrqZByGk:2XUMCm4U6q62MEBi99g9sdIJZpVhA
TLSH
T1BA143B265EEEE940EEB11A753E7E4381D6B5B80689FD21E45AE23C112B7FCF505B9003
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 798a1f2127ea75596893f3c116be70e4f88ae973cdb11b2d6ce96bc63b7daeb3
MD5 6f531e95530fa6c8df92432a83f0945b
SHA1 06708ac8a85df12d492c7b5fcdac670a25558bca
SHA512 ed12dff73e3c9d33c00e14b5ca451a7a18904d65d486be233e45b3acd1d9b23cc64dbced20a286aa4d7df4d1dfc977c67cd96a948bf5cdcaa6dc619e932c7d04
TLSH
T119519BF7D3E4856D891152F4AB257E1FDD2D0A24432C3C6289D4AE5F53F2876E20178E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 545a30d934487fb1a167c8afc36651e60cc9bf78ee934577015eb9f813be5558
MD5 abff8acb1ed12c6216acafefb89f08b8
SHA1 0d419517492de160bf0bb2396393b3fd0c8ed94c
SHA512 933dbd20e43c52d4a7501dca447fdaa857b228c0de29f9921c889ab6725c07b6cf3628bfe5ffbc50e01c1ae4c7361a19de0a82e8805b031f0585116286694717
TLSH
T1BE51BBF7C3E4866D891152F4AA207E1FDD2D0A24432C3C6289D4AE5F53F28B2E20178E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 f6e44e7ab788aeb63931ff0b6f88901c85a52817878a19d53184980ed03f7b10
MD5 f09270c594bace17b3c94e070e92f5fd
SHA1 ae21b1b49723bb6df50a1ceab1fd5479c5b651f3
SHA512 a7326f71ec663e9a420d59be684f69a43b6f831248e02ea2cc6f47044e915460d6d3389c337589c8ae98b05408a1a3c225d47ecb2baddaa3eea0832600df499c
SSDEEP 192:1RPaKGIv729PRp2RXsb+WNnGN2uPfNkwoaiiyIsnAUgtaJ:1RPaNUGXqXwE2GIab8
TLSH
T1AB32D62EFD14653B9CCBD21AFA657223D7F5102172D42E88D6FD8A2C16DB5CC222721B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 be2074da5545688e63e34638c37ada1b01ff488dad6f4502dec535ddde36a363
MD5 e15c19d86673ffe895ff65ec5ac785d8
SHA1 fd1e5482fcc398243afeba0b38ec581783229d58
SHA512 73356b5ae68f91cba3221eb59cc18cd5af38cc5ca7d27de927797bdd742ef8042ae25e72ce247a3aee9c6420a1563a3d8396f6ee37c2391baa733aae7bdda79e
SSDEEP 192:1RPa/vGIv72zPRpoRXsb+WNnGN26PfNkwoaliyIsnAUgraJ:1RPaWUgXAXwE2yIaIe
TLSH
T10042C52EFD14653B9CCAD22AFA557723D7F5102132D42E88E6FD8A1C16DB5CC222721B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 d5adc8c588fd60585dc79f8ce1d28465764258eee51ffd0074f25cd40d3dd341
MD5 5f37b11db78be78dd8a310208a0f760a
SHA1 eaaeb7c873bdeab2543939be7e59c681370b28d1
SHA512 7c36ef7da8a4147a7e1b0aff4bc58a85de9706777bd48709201492ca0532e814d3b3c438c115a40c1faf437340a3b96b47978f5add02bc8826af69ac55bb7635
SSDEEP 192:1RPa/vGIv729PRp2RXsb+WNnGN2kPfNkwoaXiyIsnAUgraJ:1RPaWUGXqXwE2kIaCe
TLSH
T15742C62EFD14A53B9CCBD21AFA553623D7F5102172D42E88D6FD8A1C16DB5CC222721B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5850bb.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe5850bb.TMP
Size 3KB
SHA256 5b61cb6a33e9a7c49102f2d960a69fd21f092fe14ee8cc9dda74f4114a4ce34e
MD5 113fddc12451ac2e71fdcdffad26ec96
SHA1 19500b5296a43149945883538027d9c2c06a0415
SHA512 efa86e3a3bf511eaf4dbcad8a18e3271d10a47c68034ee3d7901cd138660914be182132d5f9bdba6d2c3a20b2d246cf41ed718827a4c00a46a23c10bb038b92a
TLSH
T1F861639AC4B48DAB0DB26B75B4390B82F951473F65921446393E05CD8FB397B8040FAA
MD5 SHA1 SHA512 TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 34d3b150d9ebc3413240a436dcd8cc4d2da0e46d00a681d2118263aea9d32f3e
MD5 73285efb9f7ee0bd384426865ccccf8e
SHA1 51903f2b7a36fa90857257254c2bebdfe5da7eef
SHA512 e9bab3e8a04453bd7ca516137298f57170d38058ccd5df170108532fdb6eefb2d5ae94de47967a5242cb07be597050bef4f69d7f740877c626e131f01424e28d
SSDEEP 384:TRjPq7KxkXqKf/pUZNCgVLH2HfgslT37pLuLcSjFgXODPO+ErU3voHGjBm2oR0h9:TxPq7KxkXqKf/pUZNCgVLH2HfgsV37pM
TLSH
T1287219676C4C8E7B0F94CACCDC167F4F9DB5025B65EA886482FA582903D5ADF01061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 fabd8b8aa09c5c75b822b790cdd2133c05250d370e3439f52c68db743f28a93b
MD5 861465cbc26fdde53257cdf29fb19186
SHA1 690197c3678d3512a83566c31c7dc593ad0a19b0
SHA512 680052c12486d9b0a93d3c9c736fd7c97aa312d004a9ad88431cad3e421f4e597d4ea42d31736ab862df59ebdca3203b0ecbc007b4a9df59d36009610bde3958
TLSH
T10EB0120084066602C04202B0314214CC72245F1E960B270983E47D26C82D271C025250
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587f4d.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe587f4d.TMP
Size 96B
SHA256 061a813ef0c050144b9bcae22010a2717625b22c219598c1f1b87999c0801d36
MD5 9514f2cc7a8435a89a765fc2653e3355
SHA1 47ad6404855524ee6e50fa00024575973847d18f
SHA512 b0d2f866fc1b03b19b970423995f591b2ed63b1c19cd2336850214a682a57f1a3dc8726db75eb933d3b845ee09f3b139e343d38af47f5c544e5e70cc94185c8f
TLSH
T1F4B00255D103A313C14343B935A6E6D87564DF29C6431222A6E01B6ADC256768526164
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 8e95fad3dcb787392a1f8e565950540aa8df95bbcaee6464ccf32f67b71a2d6d
MD5 9626310be52cc6a7b5946fcda419b9d5
SHA1 503728768975fabf029c39309fbdeea5b691e6bb
SHA512 f7bf35296e22b009982f34f64b23ef859490b899a4d77d1c64c11863063081714556f987bde2bcea38e8c7074210666c781d5ad9e80a3955c0b04db41efac4f0
SSDEEP 6144:4g2saoajPH/Gc7qlgYl4XEZcK5m7Rkm1tYpBeh2BAoV:4MtazH+ZgYl4YNQ9oBGcAoV
TLSH
T1413423335E3569765CADB767B04F0B1F5DF18A22D420CA96CAE60300B7E1BCE4A49D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 234KB
SHA256 47916f070c83e9e785857d6579f96c19619d789ad55e4f44ebf54a31fbc25576
MD5 92b293801516166a8860df0eb3edda19
SHA1 76e35d09a6ef37dbdbf5370c2b436b45277c5c6a
SHA512 08f8fece81a34d2a39d4b95f127db592654defad4c28f333b3bfa280a6de10c1da06ce76e0c1100a1fde19c54a81f8618a630199fe1b201785c2f02820673b3a
SSDEEP 6144:47L2saoajPH/Gc7qlgYl4XEZcK5m7Rkm1tYpBeh2BAoV:4htazH+ZgYl4YNQ9oBGcAoV
TLSH
T1043412335E2569725CBDB76BB04B1B1F5DF0DB22D420C98689E90300B7E6BCD8E499B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 d5ca1fc6686dd0cf34b30749e1b53cfb4cc8d2310792977439ac4468007fd395
MD5 2fd1132024ed831522aad8ad31f2b524
SHA1 ce96e120ae41cdcb7d7c224142fc3749a70697f8
SHA512 b6187c8b891059953ef60abc964a193dc3ce28f1b944c7b268a14294fbe7418738567cf89ae3cf62b4dad28194c63379a0e4c8ad2b26422120fb4a163d973bff
SSDEEP 3072:/OGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:/Jm7Rkm1tYpBeh2BAoM
TLSH
T134C312275D75E8375878B70EB08E0B1F1EF14AA6D930DA92C8D85B0467F97CC1A05E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 50f31808a0e261c8e21c19b5ffaec3b520c6f9e99b35765a90832168a4bb8741
MD5 798a344393e7bab0e8ae33154295800f
SHA1 740700d1301d5bd2ba0a88526011fe28c852c55e
SHA512 d8df13583f99c76cd74dc844b6d3b90bac82e39209719baf6d635a9a7f0a73e68b493d97b2c540312417abe160d39df30b6fcf56675907a6e8e9f5b54217e7b2
SSDEEP 6144:Pg2saoajPH/Gc7qlgYl4XEZcK5m7Rkm1tYpBeh2BAoV:PMtazH+ZgYl4YNQ9oBGcAoV
TLSH
T19A3413335E3569765CADB767B04F0B1F5DF18A22E420CA96CAE60300B7E1BCE4A49D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download