43e07451144f77c09d8ff4bdc61e62aeb6ecf39c4f2a18b51d3b5078b8eb37b5

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/08/2026, 06:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-12_c26a7f60cc40956e0233330685d5d6af_amadey_cobalt-strike_emotet_hijackloader_icedid_njrat_remcos_ryuk_satacom_vidar.exe
Size 20.2MB
Sample260813-grsxaack8v
SHA256 43e07451144f77c09d8ff4bdc61e62aeb6ecf39c4f2a18b51d3b5078b8eb37b5
MD5 c26a7f60cc40956e0233330685d5d6af
SHA1 541ceae94dc1418851b8cb43762f550289d17b2b
SHA512 b032a663dde7e884a1fc5e14dedae7fefd3f7f65d21c921add43169b501fe4272801b4adf06452a25011d78b7ed252089e1a945cf6a8891a396fecd2244f34dd
SSDEEP 393216:VyZ/K0ttYZTayZ/K0ttYZT5yZ/K0ttYZTayZ/K0ttYZTW:VyZ/K0ttYZTayZ/K0ttYZT5yZ/K0ttY1
TLSH
T167275B03F2E940E9E0AAD174CE7597319B32BC5A8BF1A5DF224076D41E76AD07B38721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Program Files\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Program Files\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Program Files\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Program Files\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Program Files\Crashpad\settings.dat	chrmstp.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1844	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134310745809188735"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2860	chrome.exe
2860	chrome.exe
2860	chrome.exe
2860	chrome.exe
3796	chrome.exe
3796	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2860	chrome.exe
2860	chrome.exe
2860	chrome.exe
2860	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2860	chrome.exe
Token: SeCreatePagefilePrivilege	2860	chrome.exe
Token: SeShutdownPrivilege	2860	chrome.exe
Token: SeCreatePagefilePrivilege	2860	chrome.exe
Token: SeShutdownPrivilege	2860	chrome.exe
Token: SeCreatePagefilePrivilege	2860	chrome.exe
Token: SeShutdownPrivilege	2860	chrome.exe
Token: SeCreatePagefilePrivilege	2860	chrome.exe
Token: SeShutdownPrivilege	2860	chrome.exe
Token: SeCreatePagefilePrivilege	2860	chrome.exe
Token: SeShutdownPrivilege	2860	chrome.exe
Token: SeCreatePagefilePrivilege	2860	chrome.exe
Token: SeShutdownPrivilege	2860	chrome.exe
Token: SeCreatePagefilePrivilege	2860	chrome.exe
Token: SeShutdownPrivilege	2860	chrome.exe
Token: SeCreatePagefilePrivilege	2860	chrome.exe
Token: SeShutdownPrivilege	2860	chrome.exe
Token: SeCreatePagefilePrivilege	2860	chrome.exe
Token: SeShutdownPrivilege	2860	chrome.exe
Token: SeCreatePagefilePrivilege	2860	chrome.exe
Token: SeShutdownPrivilege	2860	chrome.exe
Token: SeCreatePagefilePrivilege	2860	chrome.exe
Token: SeShutdownPrivilege	2860	chrome.exe
Token: SeCreatePagefilePrivilege	2860	chrome.exe
Token: SeShutdownPrivilege	2860	chrome.exe
Token: SeCreatePagefilePrivilege	2860	chrome.exe
Token: SeShutdownPrivilege	2860	chrome.exe
Token: SeCreatePagefilePrivilege	2860	chrome.exe
Token: SeShutdownPrivilege	2860	chrome.exe
Token: SeCreatePagefilePrivilege	2860	chrome.exe
Token: SeShutdownPrivilege	2860	chrome.exe
Token: SeCreatePagefilePrivilege	2860	chrome.exe
Token: SeShutdownPrivilege	2860	chrome.exe
Token: SeCreatePagefilePrivilege	2860	chrome.exe
Token: SeShutdownPrivilege	2860	chrome.exe
Token: SeCreatePagefilePrivilege	2860	chrome.exe
Token: SeShutdownPrivilege	2860	chrome.exe
Token: SeCreatePagefilePrivilege	2860	chrome.exe
Token: SeShutdownPrivilege	2860	chrome.exe
Token: SeCreatePagefilePrivilege	2860	chrome.exe
Token: SeShutdownPrivilege	2860	chrome.exe
Token: SeCreatePagefilePrivilege	2860	chrome.exe
Token: SeShutdownPrivilege	2860	chrome.exe
Token: SeCreatePagefilePrivilege	2860	chrome.exe
Token: SeShutdownPrivilege	2860	chrome.exe
Token: SeCreatePagefilePrivilege	2860	chrome.exe
Token: SeShutdownPrivilege	2860	chrome.exe
Token: SeCreatePagefilePrivilege	2860	chrome.exe
Token: SeShutdownPrivilege	2860	chrome.exe
Token: SeCreatePagefilePrivilege	2860	chrome.exe
Token: SeShutdownPrivilege	2860	chrome.exe
Token: SeCreatePagefilePrivilege	2860	chrome.exe
Token: SeShutdownPrivilege	2860	chrome.exe
Token: SeCreatePagefilePrivilege	2860	chrome.exe
Token: SeShutdownPrivilege	2860	chrome.exe
Token: SeCreatePagefilePrivilege	2860	chrome.exe
Token: SeShutdownPrivilege	2860	chrome.exe
Token: SeCreatePagefilePrivilege	2860	chrome.exe
Token: SeShutdownPrivilege	2860	chrome.exe
Token: SeCreatePagefilePrivilege	2860	chrome.exe
Token: SeShutdownPrivilege	2860	chrome.exe
Token: SeCreatePagefilePrivilege	2860	chrome.exe
Token: SeShutdownPrivilege	2860	chrome.exe
Token: SeCreatePagefilePrivilege	2860	chrome.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2860	chrome.exe
2860	chrome.exe
2860	chrome.exe
4140	chrmstp.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4308 wrote to memory of 3244	4308	2026-08-12_c26a7f60cc40956e0233330685d5d6af_amadey_cobalt-strike_emotet_hijackloader_icedid_njrat_remcos_ryuk_satacom_vidar.exe	88
PID 4308 wrote to memory of 2860	4308	2026-08-12_c26a7f60cc40956e0233330685d5d6af_amadey_cobalt-strike_emotet_hijackloader_icedid_njrat_remcos_ryuk_satacom_vidar.exe	89
PID 2860 wrote to memory of 1620	2860	chrome.exe	90
PID 2860 wrote to memory of 636	2860	chrome.exe	91
PID 2860 wrote to memory of 636	2860	chrome.exe	91
PID 2860 wrote to memory of 1844	2860	chrome.exe	92
PID 2860 wrote to memory of 1540	2860	chrome.exe	93
PID 2860 wrote to memory of 1540	2860	chrome.exe	93
PID 2860 wrote to memory of 3960	2860	chrome.exe	95
PID 2860 wrote to memory of 4764	2860	chrome.exe	96
PID 2860 wrote to memory of 3960	2860	chrome.exe	95
PID 2860 wrote to memory of 4764	2860	chrome.exe	96
PID 2860 wrote to memory of 3288	2860	chrome.exe	97
PID 2860 wrote to memory of 3288	2860	chrome.exe	97
PID 2860 wrote to memory of 4536	2860	chrome.exe	98
PID 2860 wrote to memory of 4536	2860	chrome.exe	98
PID 2860 wrote to memory of 3184	2860	chrome.exe	100
PID 2860 wrote to memory of 5024	2860	chrome.exe	101
PID 5024 wrote to memory of 540	5024	chrmstp.exe	104
PID 5024 wrote to memory of 4140	5024	chrmstp.exe	105
PID 4140 wrote to memory of 2832	4140	chrmstp.exe	106
PID 2860 wrote to memory of 4492	2860	chrome.exe	107
PID 2860 wrote to memory of 4492	2860	chrome.exe	107
PID 2860 wrote to memory of 2484	2860	chrome.exe	108
PID 2860 wrote to memory of 2484	2860	chrome.exe	108
PID 2860 wrote to memory of 3460	2860	chrome.exe	109
PID 2860 wrote to memory of 3460	2860	chrome.exe	109
PID 2860 wrote to memory of 2228	2860	chrome.exe	110
PID 2860 wrote to memory of 2228	2860	chrome.exe	110
PID 2860 wrote to memory of 696	2860	chrome.exe	118
PID 2860 wrote to memory of 2992	2860	chrome.exe	119
PID 2860 wrote to memory of 4424	2860	chrome.exe	120
PID 2860 wrote to memory of 3796	2860	chrome.exe	122

C:\Users\Admin\AppData\Local\Temp\2026-08-12_c26a7f60cc40956e0233330685d5d6af_amadey_cobalt-strike_emotet_hijackloader_icedid_njrat_remcos_ryuk_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-12_c26a7f60cc40956e0233330685d5d6af_amadey_cobalt-strike_emotet_hijackloader_icedid_njrat_remcos_ryuk_satacom_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4308
- C:\Users\Admin\AppData\Local\Temp\2026-08-12_c26a7f60cc40956e0233330685d5d6af_amadey_cobalt-strike_emotet_hijackloader_icedid_njrat_remcos_ryuk_satacom_vidar.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-12_c26a7f60cc40956e0233330685d5d6af_amadey_cobalt-strike_emotet_hijackloader_icedid_njrat_remcos_ryuk_satacom_vidar.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=103.0.5060.114 --initial-client-data=0x274,0x278,0x27c,0x250,0x280,0x7ff73cbab618,0x7ff73cbab628,0x7ff73cbab638
  2⤵
  PID:3244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2860
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc3321c728,0x7ffc3321c734,0x7ffc3321c740
    3⤵
    PID:1620
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1692,i,13826160071352839943,14139806216763958754,262144 --field-trial-handle=264,i,12952417595038657104,1506633505660397,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1860 /prefetch:2
    3⤵
    PID:636
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2268,i,8601573115393232242,4168633179095312205,524288 --field-trial-handle=264,i,12952417595038657104,1506633505660397,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2264 /prefetch:3
    3⤵
    - System Time Discovery
    PID:1844
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,17360676913406641916,4444226028255437313,524288 --field-trial-handle=264,i,12952417595038657104,1506633505660397,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2536 /prefetch:8
    3⤵
    PID:1540
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3216,i,470702423568630329,14779427528882577924,2097152 --field-trial-handle=264,i,12952417595038657104,1506633505660397,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3248 /prefetch:1
    3⤵
    PID:3960
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3212,i,816402391682064188,5936241782546234169,2097152 --field-trial-handle=264,i,12952417595038657104,1506633505660397,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3288 /prefetch:1
    3⤵
    PID:4764
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4516,i,13773941161157533121,4988576091166585759,524288 --field-trial-handle=264,i,12952417595038657104,1506633505660397,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4416 /prefetch:8
    3⤵
    PID:3288
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4676,i,10317588420568677215,660442011308393354,2097152 --field-trial-handle=264,i,12952417595038657104,1506633505660397,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4688 /prefetch:1
    3⤵
    PID:4536
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5312,i,10953652840149615387,7128795705091841644,524288 --field-trial-handle=264,i,12952417595038657104,1506633505660397,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5304 /prefetch:8
    3⤵
    PID:3184
- - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
    3⤵
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:5024
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff68f7f55a0,0x7ff68f7f55ac,0x7ff68f7f55b8
      4⤵
      Drops file in Program Files directory
      PID:540
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
      4⤵
      Drops file in Program Files directory
      Modifies registry class
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4140
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff68f7f55a0,0x7ff68f7f55ac,0x7ff68f7f55b8
        5⤵
        Drops file in Program Files directory
        
        PID:2832
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5532,i,6145869612175753486,17017900941922331722,524288 --field-trial-handle=264,i,12952417595038657104,1506633505660397,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5556 /prefetch:8
    3⤵
    PID:4492
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5592,i,11298370421479463877,14016970847118603099,524288 --field-trial-handle=264,i,12952417595038657104,1506633505660397,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5720 /prefetch:8
    3⤵
    PID:2484
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5708,i,15023878191770242028,14089575006256702036,524288 --field-trial-handle=264,i,12952417595038657104,1506633505660397,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5744 /prefetch:8
    3⤵
    PID:3460
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5800,i,12925299423216447175,13568732740667295641,2097152 --field-trial-handle=264,i,12952417595038657104,1506633505660397,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5852 /prefetch:2
    3⤵
    PID:2228
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5704,i,7006515041397548639,9749898478779501201,524288 --field-trial-handle=264,i,12952417595038657104,1506633505660397,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=208 /prefetch:8
    3⤵
    PID:696
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5500,i,6872087433905448070,4287206812839159936,524288 --field-trial-handle=264,i,12952417595038657104,1506633505660397,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5696 /prefetch:8
    3⤵
    PID:2992
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5332,i,11189914774149632966,9566768542176413037,524288 --field-trial-handle=264,i,12952417595038657104,1506633505660397,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5588 /prefetch:8
    3⤵
    PID:4424
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5628,i,5667275671468255626,14990161823477220034,262144 --field-trial-handle=264,i,12952417595038657104,1506633505660397,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5668 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3796

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3844

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Program Files\Crashpad\settings.dat
Size 40B
SHA256 3b5660f34fee84ce4fee262a918123398751b3f147c921ef78f05e47ca7a0410
MD5 4b8eb31b46f86811c01f222c0735480e
SHA1 e4bc6cf2c31136496cd5beb659cf69ab10d23ab4
SHA512 edf391e86cc2c2bd000ca29d7bd0409246123295badfd7e3b77c436f6f91b00ad6f5bb3c0892f77ed8486082695691296ea3c8221d485d672ef4672ee6cb193a
MD5 SHA1 SHA512

Submit Download

4140_13431074581213018.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\4140_13431074581213018.pma
Size 696B
SHA256 220fdc569353b6cba3c4ae68f88e6dfc8823a93792b9b2ec33ae8a3136ec5749
MD5 3f13d40263cfdbdf5eb25e0793ffa4c3
SHA1 1bd73d3ad385cb5046a24f7892aceaf792e05e8c
SHA512 5599171f92e2ab9636a82b2530facfff86de502b2c1e90536e8da0bd6d27083d6f5c14afff71d071a96cab1c65df3563bd3d92bfb1e2c7c88d8d363d2205d99e
TLSH
T1B101C04563144F67CC468D3584BE27512BB4FA502B4217BF7710714F2E011C89E99164
MD5 SHA1 SHA512 TLSH

Submit Download

5024_13431074581231899.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\5024_13431074581231899.pma
Size 344B
SHA256 fd668d6edcf6b6cc176edd9bf7b0d7f1881fe2f0d94ebae656127c27a359550e
MD5 1b7cdddfb06152ae01f12d9f253237d6
SHA1 1ef358781a086a0727f4fa95cd53510eb328bc52
SHA512 4705c93b233be92dd2d04649d404b538bc76607bbe655d5e35a739653ac1af776ecdd12ec1cbf81476070ec5bae633f891817155014730a06939efb21bd132ea
TLSH
T159E0A79677648B7BD446CD31457B03523F6AF8501F81176F4740758F1E522D88E06420
MD5 SHA1 SHA512 TLSH

Submit Download

chrome_installer.log

Path C:\Program Files\chrome_installer.log
Size 8KB
SHA256 3dfe17db3613417a068df999fe0cc4c96914d4f3cde0aa6c99fc3c36b32b960e
MD5 ed3c438dc9f9b5086450e9ac284a2bf6
SHA1 115b4a37f5a07d883bce14faba9c06807878a953
SHA512 fdf44e83b911ad1355d81f9231ef62cb06b49f795f1c370569a5aeb1cbf338910648dcffc95947799bbb6fb9ef742f81eb67bdac050a968f75eeebb535431ee1
SSDEEP 96:yFaZ8WMrBsZ8gihK3BK302t3z0v0gihK2QK2tVkS4VXh+x526YhK3aK3330:5KzBtuFczfi7mXhXZSE
TLSH
T16B129EA94E42846F3B82DF2B335321A55DA7600AD7E464723FEBD605F0CE965001F9A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 ecd252b3f1c5f339086245da7090a285db79f6bdbaf05efc407e533763b1cd9d
MD5 9e8a968ddefd4d013e51d21d82cf1104
SHA1 2fbcd2f941dcb366be77993bac70c4e59d25de29
SHA512 5c8f8e39a186c5f1aa266b589b30bd1126d6f7e74860b3db3e5e427f28c5b8e9beec691dfaed35f96d0998833be844518bee7e0a64b8ccb4dde37e161d1c26c8
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 d40c8e85ca517fad3f67daf862188f92e96770e845d9ee6ad4633e323e46ab10
MD5 c89019902a937db8de13c60682ba7b6c
SHA1 f9d9f8f44baf654f5cdea3c400af6094ee767582
SHA512 4ba6d6a2ac1791b66291a02bd6c9033ba890124940f4c6da712269fab1c7d905beadcb72fd148808f299bc7fb50d0a56c0862db8cc30d31cf40e6c84f31cae56
TLSH
T126E02BAADD71AC2B2CFD176C60945B4ADB4013573B40894F3A3C840DCFB8A771555C1C
MD5 SHA1 SHA512 TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

service_worker_bin_prod.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\service_worker_bin_prod.js
Size 131KB
SHA256 5b83ed539c1e9c2769e4e3cd4aa397a66bdd6cfa763e230414c0a885a350903a
MD5 8b795eb263421a7d53c5d4a95646bc45
SHA1 4e48ea3d490b84aa4260a74217ed414bef6b6ad8
SHA512 fb78511b7a274d3c280da40341f19fcd3c2455f6132c41f3e46696e458126a3cec6b27d41b28b2398c622c435a3bb93a2f731fe3e8ed453d365c042b71b8b0dc
SSDEEP 3072:JXNTunelO5KQOpZgLJqVPgbcBJptE/ml/3y7:JAPJOrgmptE/mlP0
TLSH
T17AD3DACCB7A5B4224363A5F5002F010BB23AB8AAE44C85A8F188D9E97D7546D4737F7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Google Profile.ico

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
Size 192KB
SHA256 87e933966804aefee5b77abdae95b1a7f72c298b148190d7d20fe6a77c239f3b
MD5 010ec79a1098823a764aca5c4adfcbef
SHA1 ee77b3b4682e7b05075d7713f354162fe02555bb
SHA512 3ca45c2be2a916e19c5d9c467e1cdfac64b9243c29c9ac79dcde1342cc0cb9203d3f6ffe1b9ca1257799f6c70237e12019908e2c5091dd77d40134a0ae25d6f8
SSDEEP 3072:2Xm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4gMg3cdrqZByGk:2XUMCm4U6q62MEBi99g9sdIJZpVhA
TLSH
T1BA143B265EEEE940EEB11A753E7E4381D6B5B80689FD21E45AE23C112B7FCF505B9003
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c28006c390d604f3c4a41b49970eefb11ca3f3ad3f9d538e86ac4184ba147f5a
MD5 ba66792964db9bda3fa8e1269e8788f2
SHA1 7a02e39aed3c362a2f66b1645851c926b8a3537f
SHA512 a813dd7d01ff4270d128af0f222f82f60caebf8cfd5c2ee650788c7fe873956090df5cd988c1da4d54bb6b36dd8e2a9af75aad2376dbc3ca28d2db98496b21c8
TLSH
T1A4518BF3D7E8967D885156F4AB216E1FDD2D0A24522C3C57C8D4AE5B63E2872D20128E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 7eed4c7225aff415755d95cc18126b96faffc337e231c9853c6e6ca2566ca8e1
MD5 2e2b6c6b3a2ab0f4ce3ca402fa27ba09
SHA1 b875e5d93278e3335db32b84fa972ae024090cf1
SHA512 cd2b4b0821b15c56205bfc62d8f497f098040c0165894bb62bce5a274ea87069d7fd7335c03c2f57056858b7e6255c9f8d65ece03ab046bb49e15dfa74210b7b
SSDEEP 192:HRbjugJQmv78mPRprWXsb+WNnFS2O+2ldDkwTniyIsnAUgraJ:HRbjb6ShXqXwI2l2jDue
TLSH
T10242A32DED14663B5CCBE22AF9557B13D7F5202234951E44FAFC892C16EB9CD2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 4842277123b50fba14ba65a4c01a736857194307ccd1eb20534e01818c9668ff
MD5 f7e33b6973bbb21229159320dd803110
SHA1 4086119787e70c9cf22c72c8b8d827fd641d26f7
SHA512 2e2ffeaa0d5da5e5683e1fa05f6320d90d0c3b7b704f2bb3e46a03b8c4390640a9fa3eb5b97daf8597eb3b6be0965eb2d640be8bd458c4b1dfa83c55c50f80ab
SSDEEP 192:HRbjugJQmv789PRp2WXsb+WNnFS2z+2ldDkwTriyIsnAUgtaJ:HRbjb6ScX1XwI2y2jDS8
TLSH
T13132922DEE14763B5CCBD22AE9557B13D7F9102134851E84FAFC896C16DB9CC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe586702.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe586702.TMP
Size 3KB
SHA256 1416953291c598b10371bf2f93fc3c242176d92ac627352f6bd284a3ef7bf26c
MD5 020164be0c6a0963df6f9985a767a83f
SHA1 c6497b589c2a01000c78c89ec490484370aa9347
SHA512 cb8baf498ee8eb30a1bc8a259d477b4c8b86c39cf6f255f1d33fb95d0f285d88852d95f4819d2a4e966551fced8afc15b7163a45a6b97341ff3e00089cda84b8
TLSH
T18261346DD5A04CA31DF2A77AB83A5F82FE15467B0140285639FE298C0F729674182F6A
MD5 SHA1 SHA512 TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 8d44d22e2dd3c5db8cee65670a835cc7cc77ab289e5f94cef000602269a1ab3e
MD5 f6c302f24f158db7b53e8440d45c6b88
SHA1 5b9d64516bd6523dc3cd37d5e7ab796f9bb642e2
SHA512 e0af3a861ce8c0abe01075ed7bd29bca58c5df27754d5dc9621cac982686b3262819c5f65f13b9ccec9997b6743442c6d8a57bb5f231cc37813e9f487a4d0f76
SSDEEP 384:6QjOp7KxkXqKf/pUZNCgVLH2HfgslIB7pLuLci3QRXODOB+ErU3ymHG/5UJ4vtEC:6UOp7KxkXqKf/pUZNCgVLH2HfgsGB7ph
TLSH
T12B72E8676C488E370F94CACDDC17BF4FADB5024B65ED886493FA582903D5ACB11062EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 aab018cd2e4fdd839ce716811ed580db5ee5403475c8c6c3b1e20b4b7b431b9f
MD5 ae840c1f368266d571c9e0e29b0df19f
SHA1 a91d5749e5e4a9e3066018a8b69f9332f56523e8
SHA512 9de01d7593fa42b5a7b9696ae88376edfab7df60bb81ae4b7ba71062f49c8bcc5cb808642a189253317ef0df7b2a91860e999c47f34d613b8a9a1c93d46d4a66
TLSH
T16AB01205C08B5740E94081F01115644422106E35A0400743C3E09A95CC530D04272214
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 239KB
SHA256 04ce3f3e47defee2ba78bcd157dc2b77ab23c2e23b417b68c0190f7254742e09
MD5 1ae56c4106909a8c9b4f7482b2a3f2c5
SHA1 4906622566bf8ff1caf4c0197addec203e3f79bf
SHA512 a8545c75f49082ac0638378eb992d8c9caa73b59452e2b0de74c95c3823ac91b689f6703b72aa3da91bd0e6e0f3309586feea0d4b94822d6c32be4f7967042b6
SSDEEP 6144:81c1fOTnQ7FAql5DyXIj8Y3u/s9m7Rkm1tYpBeh2BAo0:UcFOmFAqliIfNU9oBGcAo0
TLSH
T187341237DD55ED358B396B8AF10A0A4E0DA02693C724DC979CC47A047B5DAC94FC2EB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 238KB
SHA256 3ab819c0eb2d9511033f02ec105b76cce3abd9aa3bb8eb661f10e29946e51710
MD5 d74ee6266a8404b805451686346d2805
SHA1 fa4635019e16c0e1230e4ad36c2ca90823a03c47
SHA512 0b5017fbe65b2beeb291df56aa692ce46916de7feef572268c1f80447ab1b95eed50b44967a8937b8013e8a14f5195f4016fe349cd9d5e426a4abc213425b0b3
SSDEEP 6144:/t1fOTnQ7FAql5DyXIj8Y3u/s9m7Rkm1tYpBeh2BAo0:/tFOmFAqliIfNU9oBGcAo0
TLSH
T101341237DD55ED398B39678AF11A0A4E0DB02A928735DCD38DC4B904BB5CAC90FC5A78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 a12f7be7bb0b97bca1f28ccfbe01526dc21ce753bcfca94e0da51089ab257aee
MD5 9427dcd4bc0308263c2c10ecf3e76c9f
SHA1 0120279c4666c4a3df5a170fb63ab1d28d318631
SHA512 82a74d332dd921eb155a55c94db167c44a9c3665aa5973711010aab98e31780c8eaec89a5db5920581b0851f3e47bc616b2ad1eb892fc30e237e5225441f8d6a
SSDEEP 3072:yGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:Fm7Rkm1tYpBeh2BAoO
TLSH
T112C3123B5D65E9375D79A71EB48E0B1E1EF24DA6C930DE42C8D86A0437FA7CC1A04A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 238KB
SHA256 03ab3e5013dd67c53baf7656c3197f1df579adf0a29d4b95303a59365b1efddb
MD5 0b5ce1b05b71d7f9c2224a8f664849de
SHA1 9b3c4712f054a2e7dd281c2fa57921888f1cb2c0
SHA512 ca64072857d0de294d6dcc1ab65ef467e9acda098fadba4c1ad11da740f283aeae05307688cfb5ae4ca59208203e5fad19f5380597e9e4a2c4cf1ef483aa410d
SSDEEP 6144:ut1fOTnQ7FAql5DyXIj8Y3u/s9m7Rkm1tYpBeh2BAo0:utFOmFAqliIfNU9oBGcAo0
TLSH
T16B341237DD55ED398B39678AF11A0A4E0DB02A928735DCD38DC4B904BB5CAC90FC5A78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9c1b0135-6534-4de6-8ab4-26dd778e43f8.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2860_1208444360\9c1b0135-6534-4de6-8ab4-26dd778e43f8.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download