17fc72b5835e7b347f9a0f9a678fe7202f6a22597fd77ad8182eb9e9210b2874

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/07/2026, 03:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_0c4a769f8957b0e4ddcdb1a977b58154_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe
Size 20.8MB
Sample260723-eclhjsfh94
SHA256 17fc72b5835e7b347f9a0f9a678fe7202f6a22597fd77ad8182eb9e9210b2874
MD5 0c4a769f8957b0e4ddcdb1a977b58154
SHA1 2ce7f18c004fd5034922cae9ff6e8f1a66773df1
SHA512 18cc39868af0fb800aad52aefdc601b67dde15dc8833c4d56bd9654e45d58001511e980c0dc64576a2c4c8a111175561836013c360c702108c59144b2949a82f
SSDEEP 393216:euoZwBFdpRdl2FTTebbs/mrVz7AQoLjTTZrhePOushLR/8IML6D7kh6Zxyz:eG/vRdKenWmBH9oTPePVshLSIIgkEsz
TLSH
T1FC272307BCA068B6C0AFD2328A6691557B72BC991F3223DB3A50B37C2F767D05A75344
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4552	sys_7c0d763d29365ca595012be29cd32cfa.exe
4088	msiexec_0ckrjm.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
5832	tasklist.exe
4796	tasklist.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5520	cmd.exe
5568	cmd.exe
2964	cmd.exe
5372	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4376	chrome.exe

Checks processor information in registry 2 TTPs 26 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	sys_7c0d763d29365ca595012be29cd32cfa.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	sys_7c0d763d29365ca595012be29cd32cfa.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	sys_7c0d763d29365ca595012be29cd32cfa.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	sys_7c0d763d29365ca595012be29cd32cfa.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	sys_7c0d763d29365ca595012be29cd32cfa.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	sys_7c0d763d29365ca595012be29cd32cfa.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	sys_7c0d763d29365ca595012be29cd32cfa.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	sys_7c0d763d29365ca595012be29cd32cfa.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	sys_7c0d763d29365ca595012be29cd32cfa.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	sys_7c0d763d29365ca595012be29cd32cfa.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	sys_7c0d763d29365ca595012be29cd32cfa.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	sys_7c0d763d29365ca595012be29cd32cfa.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	sys_7c0d763d29365ca595012be29cd32cfa.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	sys_7c0d763d29365ca595012be29cd32cfa.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	sys_7c0d763d29365ca595012be29cd32cfa.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	sys_7c0d763d29365ca595012be29cd32cfa.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	sys_7c0d763d29365ca595012be29cd32cfa.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	sys_7c0d763d29365ca595012be29cd32cfa.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	sys_7c0d763d29365ca595012be29cd32cfa.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	sys_7c0d763d29365ca595012be29cd32cfa.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	sys_7c0d763d29365ca595012be29cd32cfa.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	sys_7c0d763d29365ca595012be29cd32cfa.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	sys_7c0d763d29365ca595012be29cd32cfa.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	sys_7c0d763d29365ca595012be29cd32cfa.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292520878668583"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3312	chrome.exe
3312	chrome.exe
2504	chrome.exe
2504	chrome.exe
3312	chrome.exe
3312	chrome.exe
3712	chrome.exe
3712	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5832	tasklist.exe
Token: SeDebugPrivilege	4796	tasklist.exe
Token: SeShutdownPrivilege	3312	chrome.exe
Token: SeCreatePagefilePrivilege	3312	chrome.exe
Token: SeShutdownPrivilege	3312	chrome.exe
Token: SeCreatePagefilePrivilege	3312	chrome.exe
Token: SeShutdownPrivilege	3312	chrome.exe
Token: SeCreatePagefilePrivilege	3312	chrome.exe
Token: SeShutdownPrivilege	3312	chrome.exe
Token: SeCreatePagefilePrivilege	3312	chrome.exe
Token: SeShutdownPrivilege	3312	chrome.exe
Token: SeCreatePagefilePrivilege	3312	chrome.exe
Token: SeShutdownPrivilege	3312	chrome.exe
Token: SeCreatePagefilePrivilege	3312	chrome.exe
Token: SeShutdownPrivilege	3312	chrome.exe
Token: SeCreatePagefilePrivilege	3312	chrome.exe
Token: SeShutdownPrivilege	3312	chrome.exe
Token: SeCreatePagefilePrivilege	3312	chrome.exe
Token: SeShutdownPrivilege	3312	chrome.exe
Token: SeCreatePagefilePrivilege	3312	chrome.exe
Token: SeShutdownPrivilege	3312	chrome.exe
Token: SeCreatePagefilePrivilege	3312	chrome.exe
Token: SeShutdownPrivilege	3312	chrome.exe
Token: SeCreatePagefilePrivilege	3312	chrome.exe
Token: SeShutdownPrivilege	3312	chrome.exe
Token: SeCreatePagefilePrivilege	3312	chrome.exe
Token: SeShutdownPrivilege	3312	chrome.exe
Token: SeCreatePagefilePrivilege	3312	chrome.exe
Token: SeShutdownPrivilege	3312	chrome.exe
Token: SeCreatePagefilePrivilege	3312	chrome.exe
Token: SeShutdownPrivilege	3312	chrome.exe
Token: SeCreatePagefilePrivilege	3312	chrome.exe
Token: SeShutdownPrivilege	3312	chrome.exe
Token: SeCreatePagefilePrivilege	3312	chrome.exe
Token: SeShutdownPrivilege	3312	chrome.exe
Token: SeCreatePagefilePrivilege	3312	chrome.exe
Token: SeShutdownPrivilege	3312	chrome.exe
Token: SeCreatePagefilePrivilege	3312	chrome.exe
Token: SeShutdownPrivilege	3312	chrome.exe
Token: SeCreatePagefilePrivilege	3312	chrome.exe
Token: SeShutdownPrivilege	3312	chrome.exe
Token: SeCreatePagefilePrivilege	3312	chrome.exe
Token: SeShutdownPrivilege	3312	chrome.exe
Token: SeCreatePagefilePrivilege	3312	chrome.exe
Token: SeShutdownPrivilege	3312	chrome.exe
Token: SeCreatePagefilePrivilege	3312	chrome.exe
Token: SeShutdownPrivilege	3312	chrome.exe
Token: SeCreatePagefilePrivilege	3312	chrome.exe
Token: SeShutdownPrivilege	3312	chrome.exe
Token: SeCreatePagefilePrivilege	3312	chrome.exe
Token: SeShutdownPrivilege	3312	chrome.exe
Token: SeCreatePagefilePrivilege	3312	chrome.exe
Token: SeShutdownPrivilege	3312	chrome.exe
Token: SeCreatePagefilePrivilege	3312	chrome.exe
Token: SeShutdownPrivilege	3312	chrome.exe
Token: SeCreatePagefilePrivilege	3312	chrome.exe
Token: SeShutdownPrivilege	3312	chrome.exe
Token: SeCreatePagefilePrivilege	3312	chrome.exe
Token: SeShutdownPrivilege	3312	chrome.exe
Token: SeCreatePagefilePrivilege	3312	chrome.exe
Token: SeShutdownPrivilege	3312	chrome.exe
Token: SeCreatePagefilePrivilege	3312	chrome.exe
Token: SeShutdownPrivilege	3312	chrome.exe
Token: SeCreatePagefilePrivilege	3312	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 3736 wrote to memory of 4552	3736	2026-07-23_0c4a769f8957b0e4ddcdb1a977b58154_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe	86
PID 4552 wrote to memory of 2964	4552	sys_7c0d763d29365ca595012be29cd32cfa.exe	88
PID 2964 wrote to memory of 5832	2964	cmd.exe	89
PID 4552 wrote to memory of 5372	4552	sys_7c0d763d29365ca595012be29cd32cfa.exe	91
PID 5372 wrote to memory of 4796	5372	cmd.exe	92
PID 4552 wrote to memory of 5520	4552	sys_7c0d763d29365ca595012be29cd32cfa.exe	93
PID 5520 wrote to memory of 3312	5520	cmd.exe	94
PID 3312 wrote to memory of 3364	3312	chrome.exe	95
PID 3312 wrote to memory of 5976	3312	chrome.exe	96
PID 3312 wrote to memory of 5976	3312	chrome.exe	96
PID 3312 wrote to memory of 4376	3312	chrome.exe	97
PID 3312 wrote to memory of 3272	3312	chrome.exe	98
PID 3312 wrote to memory of 3272	3312	chrome.exe	98
PID 3312 wrote to memory of 2616	3312	chrome.exe	100
PID 3312 wrote to memory of 4756	3312	chrome.exe	101
PID 3312 wrote to memory of 2616	3312	chrome.exe	100
PID 3312 wrote to memory of 4756	3312	chrome.exe	101
PID 3312 wrote to memory of 4500	3312	chrome.exe	102
PID 3312 wrote to memory of 4500	3312	chrome.exe	102
PID 4552 wrote to memory of 5568	4552	sys_7c0d763d29365ca595012be29cd32cfa.exe	103
PID 5568 wrote to memory of 4088	5568	cmd.exe	105
PID 4088 wrote to memory of 2504	4088	msiexec_0ckrjm.exe	106
PID 4088 wrote to memory of 2504	4088	msiexec_0ckrjm.exe	106
PID 3312 wrote to memory of 3416	3312	chrome.exe	109
PID 3312 wrote to memory of 3680	3312	chrome.exe	112
PID 3312 wrote to memory of 1440	3312	chrome.exe	113
PID 3312 wrote to memory of 2276	3312	chrome.exe	114
PID 3312 wrote to memory of 3712	3312	chrome.exe	121

C:\Users\Admin\AppData\Local\Temp\2026-07-23_0c4a769f8957b0e4ddcdb1a977b58154_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_0c4a769f8957b0e4ddcdb1a977b58154_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3736
- C:\Users\Admin\AppData\Local\Temp\sys_7c0d763d29365ca595012be29cd32cfa.exe
  C:\Users\Admin\AppData\Local\Temp\sys_7c0d763d29365ca595012be29cd32cfa.exe
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:4552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2964
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq chrome.exe""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5372
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq chrome.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check --disable-extensions --disable-plugins --disable-sync --disable-default-apps --mute-audio"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5520
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check --disable-extensions --disable-plugins --disable-sync --disable-default-apps --mute-audio
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:3312
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff3a1dc728,0x7fff3a1dc734,0x7fff3a1dc740
        5⤵
        
        PID:3364
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1696,i,9617565100010849591,16409317637412792667,262144 --field-trial-handle=1952,i,15607348596828786201,10361886989332750104,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1948 /prefetch:2
        5⤵
        
        PID:5976
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mute-audio --force-high-res-timeticks=disabled --metrics-shmem-handle=2268,i,13654405612495171920,802424163604752073,524288 --field-trial-handle=1952,i,15607348596828786201,10361886989332750104,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2272 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:4376
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mute-audio --force-high-res-timeticks=disabled --metrics-shmem-handle=2384,i,2705666640367966136,16697979300949333531,524288 --field-trial-handle=1952,i,15607348596828786201,10361886989332750104,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2556 /prefetch:8
        5⤵
        
        PID:3272
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3232,i,11362209208788448808,15856940696695315828,2097152 --field-trial-handle=1952,i,15607348596828786201,10361886989332750104,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3292 /prefetch:1
        5⤵
        
        PID:2616
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3240,i,7650894048819800998,9482333012204586753,2097152 --field-trial-handle=1952,i,15607348596828786201,10361886989332750104,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3320 /prefetch:1
        5⤵
        
        PID:4756
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4568,i,13192530128543103472,4711783466494120357,2097152 --field-trial-handle=1952,i,15607348596828786201,10361886989332750104,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4576 /prefetch:1
        5⤵
        
        PID:4500
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mute-audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5348,i,8055740097440303350,184226376845117873,524288 --field-trial-handle=1952,i,15607348596828786201,10361886989332750104,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5340 /prefetch:8
        5⤵
        
        PID:3416
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mute-audio --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5656,i,9102838046720858296,4719701605843501463,524288 --field-trial-handle=1952,i,15607348596828786201,10361886989332750104,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5624 /prefetch:8
        5⤵
        
        PID:3680
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mute-audio --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5584,i,1826438422717686789,3503008454075324376,524288 --field-trial-handle=1952,i,15607348596828786201,10361886989332750104,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5352 /prefetch:8
        5⤵
        
        PID:1440
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mute-audio --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5368,i,10710258587882303020,4088608098486480780,524288 --field-trial-handle=1952,i,15607348596828786201,10361886989332750104,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5364 /prefetch:8
        5⤵
        
        PID:2276
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=736,i,12047850837677777148,718995892595633774,262144 --field-trial-handle=1952,i,15607348596828786201,10361886989332750104,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5556 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\grapper_1784778483395_d0i4cs\msiexec_0ckrjm.exe" chrome"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5568
  - - C:\Users\Admin\AppData\Local\Temp\grapper_1784778483395_d0i4cs\msiexec_0ckrjm.exe
      "C:\Users\Admin\AppData\Local\Temp\grapper_1784778483395_d0i4cs\msiexec_0ckrjm.exe" chrome
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4088
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2504

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5580

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3092

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 4a7ae36111f0f9c2c233244e3b4418b6604e5360d769e8e4dcfd3510645b9f4f
MD5 d9b0eeefdc8bf044e6f027f4089f0254
SHA1 20f2a8b6cc949f22594b1066b5507b8c531bad77
SHA512 2b9e8fe576fde23aa7867949fbe2da8b53755fb1de538d18a9cbacd78d4bbf9b1e67574975354893973e3dd1f517dd6d2eaec03e80d6c83672ee6c42a2c8dfda
TLSH
T178E022AEC8219C2708FD1B2820100746F7540317BF90CC4F3B3E93088FB5B3A86AA82C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 ca0f839eceb755be172f0ef215ef75ed814aa64013f6b34ebe5c0bdd570d3a78
MD5 f6ad0b3762bfa1936e22be34f85e66e7
SHA1 1660b60cd0affe633bbe5bec18b84d35ba0a35c8
SHA512 5240989f6e4dfa72920cca541736d41692f198b2ac54499f2ff79533a10f35ea61406456736f47e240815121da9ff5c1552071f6f84f6a9793cc9655e52b4700
TLSH
T147418DF793E4957E8A0592F4EB15AE1FCE6D0614031C3CA688D46E1B43E68B2D20078E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 a65377ee9d26e2417b9519a96c1a31144695eb747d376fc73439f7cae33c489f
MD5 e46b9f9e440a12d9d8e8287d74e83fe1
SHA1 67d3031159772468b5ed9ac08f782f6783e93f7b
SHA512 be08c70b7462feb1924e8b7f61eb97176ebf919d15ee3358d07309bf2990246e3d93bb92dbb1a12c97b9655e16ef935f6501a5114c7009586fcd5653911d55ca
SSDEEP 192:cR9FFaMvv7cpAPRp2qg9BHsb+WNnQt40lUCLHkwAaM1lVyIsnAUge:cR9FIMnwUXlgrwa40OCbgaM1Te
TLSH
T17142D72EAD60657B5DDFC21AFA253B53E7F9102275902EC4EAFC892C14E76CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 0e6b1ff730372c657188616c4740b2d113fb8d4e2f10cb56847b7657e803ca36
MD5 dafc0213daa82df25235c7ff935ca4f3
SHA1 f76bc972d90b86d762ec657181ac63bb8f20a8a8
SHA512 89d35fcac2b338f13771c363d774eaf4e1cdd99791d75388e20b70c17dcb7efba49e429e65ee7804c863380886049aeecfe30d16e30e50398177484dc2f9f6b7
SSDEEP 192:cR9FFaMvv7cpJPRppqg9BHsb+WNnQt40iUCLHkwAam1lVyIsnAUgE:cR9FIMnwvXMgrwa403Cbgam1TE
TLSH
T18A42B62EA960257B9DDED219FA257B53E3F5102275902EC4EAFC8A2C15E76CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 14KB
SHA256 bf7e038bfd553dffd991be1a081f860e6b46e00e690a135e0cd47c6c3d1be2f1
MD5 f3fdb7a68489a1a0ee51a00d28508a1b
SHA1 93c75cfda821953a36eae5df2ba0d89202642f88
SHA512 17d35a102f91eb5212096a5057b778ff3e57d61e385a8da43e3ba76de38d5647bc177021b20281a654a8181d0d8fc620886f04aee4ea4fd27078ca985b44083d
SSDEEP 384:dXjRs7KxkXqKf/pUZNCgVLH2HfgslKa7pLuLcSjzOXODR0+ErU3nNLr3YG:dzRs7KxkXqKf/pUZNCgVLH2Hfgs8a7pi
TLSH
T15262F967A84C9D7B0F94C58CD8177E4FADB4024B66ED886493FB982503D5BCE110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nmmhkkegccagdldgiimedpiccmgmieda\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nmmhkkegccagdldgiimedpiccmgmieda\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 641a75971776fa969b2f9fd7fd1f4f6929b698c50e8e17fa7f7753cec0f95cd6
MD5 4d3e881e737152e13735b51250e0b82c
SHA1 36f21f3ae4c901e14a318291049842e67c01f691
SHA512 73ea1aecdaa4aaa40487210819b9c248b9ca967d7c3559015563bde6290e7151c6d6cc4259617bfe60af84218ba30f34a232619099500fcfd3cb3ef0063def6f
SSDEEP 6144:qlzg8JWg8lpU1ToakZQ2CZom7IbFmUi21rSm8uUVNSlzYo:q2MW1OMakZQ2CZom7Ipfi21b8j8zV
TLSH
T1D2342214AE667DBBDE4D8244B6593F0E0EA51D43E1F1C64747A699C0ADCE2C31B83B2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 149df5bca505f82b8d6e1797586df8b24050ac6fd60b6f1cf125d088fb2e3915
MD5 c855c08deb4bdb069036b175e2fd07ae
SHA1 3de5b81d464bca1726fadad5f6ecc0631ab87718
SHA512 b46131ab1515fa26222ee9f4e23a01fb2c9be5f237cf57d325f3a6d735bbe3ff8b3272d8c8dc39e6e5a557411656ca4d1975500f334d602e788326cf6c5431ce
SSDEEP 6144:Zlzg8JWg8lpU1ToakZQ2CZom7IbFmUi21rSm8uUVNSlzYo:Z2MW1OMakZQ2CZom7Ipfi21b8j8zV
TLSH
T108342214AE667DBBDE4D8244B6593F0E0EA41D43E1F5C64747A699C0ADCE2C31B83B2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 eb27d05d105791049b955388412cc76500030745825ea7a7904cebcf14d8a01b
MD5 b7b9f04bbbe14bb936f502d0b098b417
SHA1 6b5ec1529e2237d534e7e035878454899ce6032b
SHA512 91cc6bf3697acb2541a21100d01928ac91bcc6530e3a2d540fa0b375af639cf0da58e21a79fc778fbda121df59198db6f13a1c0c79e993aecc524cfc2ae9c28c
SSDEEP 6144:eElzg8JWg8lpU1ToakZQ2CZom7IbFmUi21rSm8uUVNSlzYo:/2MW1OMakZQ2CZom7Ipfi21b8j8zV
TLSH
T1CF342234AE627CBBDE598304B6592F0E0EB41E43E5F5C60A46665D8069CE2C71F83B2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 31a2f3e0343a99e6c201e16c90380800714f5e29b90753722e41f90e59ecf867
MD5 449050dd6bfc95aecb7d455a39ee01d7
SHA1 5a42fb5b0ddc22279acf9149ad9436e37344dc60
SHA512 1b6e5bdc1004551934cd2e21dd45306f84a0b6b14cc3bceb7569780f91ee2cea59d5fe84b339f959cc1c1871eee6ca01aceb86a08e785d8c063368825a11eb8a
SSDEEP 3072:SXFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:aFmUi21rSm8uUVNSlzY/
TLSH
T1D2C313007AE3E8F2FE5930447BEE2A145D6C0E818291C64152739D419DEF3C71FAAB39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec_0ckrjm.exe

Path C:\Users\Admin\AppData\Local\Temp\grapper_1784778483395_d0i4cs\msiexec_0ckrjm.exe
Size 1.4MB
SHA256 99413092119b00c09f77a4de1919958a13535cdab1aeebe6dbe406b6581661fa
MD5 f21ee1c62100e896a4fbd6ec6186e6ea
SHA1 282208974eb43c161c6274144ed5b8798555b966
SHA512 93170f84313e89524649d8b1054d4fbd414a93bcf415b332ae367b51e6e711b2c8e6a277c52b7bbd0f1b6452b942f545128a0d4adf71e8430b640aec35b3bacd
SSDEEP 24576:jnrDCpbI66LK8GD9eYfoYwbkVlP8yprpmxWnDuiCK8iW/2rTezxy:3eBI/Wp9FfoYZVW4f718FOne
TLSH
T12565025B66A500F9E1A7C2B9CD51580AE673FC4647B4BB4F03E849960F336B09E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sys_7c0d763d29365ca595012be29cd32cfa.exe

Path C:\Users\Admin\AppData\Local\Temp\sys_7c0d763d29365ca595012be29cd32cfa.exe
Size 41.4MB
SHA256 cc43e822ce264b663b503afffb9f1e9e8c66b818cdfb1a533785335c272d124c
MD5 010e90aeffc3c75d9e819ba827e942a1
SHA1 d271eb2988d6bfa07a7e167d2a50eb5096e5bbd0
SHA512 7b727dcd2c7d82bea5270f2a8fc3116e804d5b1417e77c7d9078e2ab7588c215812cee2514f615b717592335e9297632e73d73376e9e8153c3668000d5866af3
SSDEEP 393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfs:fMguj8Q4Vfv+qFTrYa26JWuQ4s4/EO
TLSH
T1F9979C0773E601D5E5B7D2388AA64507D773B8638331CADF329D06152FABAD09A7E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5308-100-0x0000021ECAE00000-0x0000021ECAEE9000-memory.dmp

Download