1c523529fee38759d5c43fc69a569578ed99ff76ed7ef489f66b760ead3a7fed

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 18:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-25_dc221511df9bd3831787f28260a9e57a_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Size 8.1MB
Sample260925-xepl4agh86
SHA256 1c523529fee38759d5c43fc69a569578ed99ff76ed7ef489f66b760ead3a7fed
MD5 dc221511df9bd3831787f28260a9e57a
SHA1 229c9dee09245f7358f678f05c873db02e4311da
SHA512 8c2b9e4d25b308084d5da7ef11242d668ea67e112de169c0635673e5f2d0180b765cd4a58889a5eb579b004e9429e90b868e2fbca3d8459706aaad446dd5a311
SSDEEP 49152:4hHvh46cZnid5mSAP6vub3dCeIcnOFXQNeeywKNEhDtlcIW9Zzy9Tn527RlcwtLy:jFocK5wFZlcy9r529tD/NcgON92cbv
TLSH
T175867D13F2A501E8D05ED574CF7A56329B317C4A4BB0A2EF29D436A11A75ED4BB3CB20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery spyware stealer

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\chrome_installer.log	2026-09-25_dc221511df9bd3831787f28260a9e57a_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Program Files\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Program Files\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Program Files\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Program Files\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Program Files\Crashpad\settings.dat	chrmstp.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4292	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2876	chrome.exe
2876	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
1144	chrmstp.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1832 wrote to memory of 3372	1832	2026-09-25_dc221511df9bd3831787f28260a9e57a_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe	88
PID 1832 wrote to memory of 2316	1832	2026-09-25_dc221511df9bd3831787f28260a9e57a_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe	89
PID 2316 wrote to memory of 4844	2316	chrome.exe	90
PID 2316 wrote to memory of 1280	2316	chrome.exe	91
PID 2316 wrote to memory of 1280	2316	chrome.exe	91
PID 2316 wrote to memory of 4292	2316	chrome.exe	92
PID 2316 wrote to memory of 2544	2316	chrome.exe	93
PID 2316 wrote to memory of 2544	2316	chrome.exe	93
PID 2316 wrote to memory of 4972	2316	chrome.exe	95
PID 2316 wrote to memory of 4972	2316	chrome.exe	95
PID 2316 wrote to memory of 3780	2316	chrome.exe	96
PID 2316 wrote to memory of 3780	2316	chrome.exe	96
PID 2316 wrote to memory of 2812	2316	chrome.exe	97
PID 2316 wrote to memory of 2812	2316	chrome.exe	97
PID 2316 wrote to memory of 2200	2316	chrome.exe	98
PID 2316 wrote to memory of 2200	2316	chrome.exe	98
PID 2316 wrote to memory of 4352	2316	chrome.exe	105
PID 2316 wrote to memory of 2084	2316	chrome.exe	107
PID 2084 wrote to memory of 4680	2084	chrmstp.exe	109
PID 2084 wrote to memory of 1144	2084	chrmstp.exe	110
PID 1144 wrote to memory of 4904	1144	chrmstp.exe	111
PID 2316 wrote to memory of 5396	2316	chrome.exe	120
PID 2316 wrote to memory of 5404	2316	chrome.exe	121
PID 2316 wrote to memory of 5412	2316	chrome.exe	122
PID 2316 wrote to memory of 2876	2316	chrome.exe	128

C:\Users\Admin\AppData\Local\Temp\2026-09-25_dc221511df9bd3831787f28260a9e57a_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-25_dc221511df9bd3831787f28260a9e57a_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Users\Admin\AppData\Local\Temp\2026-09-25_dc221511df9bd3831787f28260a9e57a_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
  C:\Users\Admin\AppData\Local\Temp\2026-09-25_dc221511df9bd3831787f28260a9e57a_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=156.0.8069.0 "--attachment=C:\Program Files\chrome_installer.log" --attachment=C:\Users\Admin\AppData\Local\Google\GoogleUpdater\updater.log --attachment=C:\Users\Admin\AppData\Local\Google\GoogleUpdater\updater_history.jsonl --initial-client-data=0x260,0x264,0x268,0x248,0x26c,0x7ff7a70465a8,0x7ff7a70465b8,0x7ff7a70465c8
  2⤵
  PID:3372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2316
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffcd173c728,0x7ffcd173c734,0x7ffcd173c740
    3⤵
    PID:4844
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1712,i,9126397870449995803,16972219049568107444,262144 --field-trial-handle=2000,i,11454022937852383658,7864116568462484481,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1996 /prefetch:2
    3⤵
    PID:1280
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2256,i,14935239938502757529,2204574974728658948,524288 --field-trial-handle=2000,i,11454022937852383658,7864116568462484481,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1608 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4292
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2380,i,3466376260788421162,15297242733056454757,524288 --field-trial-handle=2000,i,11454022937852383658,7864116568462484481,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2536 /prefetch:8
    3⤵
    PID:2544
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3220,i,6542878928707754756,17710464634723840893,2097152 --field-trial-handle=2000,i,11454022937852383658,7864116568462484481,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3232 /prefetch:1
    3⤵
    PID:4972
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3252,i,16587767544785175512,9079006786244331893,2097152 --field-trial-handle=2000,i,11454022937852383658,7864116568462484481,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3288 /prefetch:1
    3⤵
    PID:3780
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4440,i,17756686403720393528,8083570176721164158,2097152 --field-trial-handle=2000,i,11454022937852383658,7864116568462484481,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4428 /prefetch:2
    3⤵
    PID:2812
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4608,i,5142410241677530891,4847650117512008265,2097152 --field-trial-handle=2000,i,11454022937852383658,7864116568462484481,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4716 /prefetch:1
    3⤵
    PID:2200
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5508,i,15490774407107814109,2057165695072867759,524288 --field-trial-handle=2000,i,11454022937852383658,7864116568462484481,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5512 /prefetch:8
    3⤵
    PID:4352
- - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
    3⤵
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:2084
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff7e29f55a0,0x7ff7e29f55ac,0x7ff7e29f55b8
      4⤵
      Drops file in Program Files directory
      PID:4680
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
      4⤵
      Drops file in Program Files directory
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:1144
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff7e29f55a0,0x7ff7e29f55ac,0x7ff7e29f55b8
        5⤵
        Drops file in Program Files directory
        
        PID:4904
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5776,i,15300950109762926758,5233743656579789452,524288 --field-trial-handle=2000,i,11454022937852383658,7864116568462484481,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5784 /prefetch:8
    3⤵
    PID:5396
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5620,i,6607217081115691751,1745977896045463604,524288 --field-trial-handle=2000,i,11454022937852383658,7864116568462484481,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5576 /prefetch:8
    3⤵
    PID:5404
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5568,i,2594990952982456576,9935964598375692023,524288 --field-trial-handle=2000,i,11454022937852383658,7864116568462484481,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5192 /prefetch:8
    3⤵
    PID:5412
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5700,i,10533545272107250130,5183447816235054586,262144 --field-trial-handle=2000,i,11454022937852383658,7864116568462484481,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4556 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2876

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1220

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Program Files\Crashpad\settings.dat
Size 40B
SHA256 30773c04526fb6000dccd8988a5897d899df29762888f71091b19b8c397f8483
MD5 05c66616342c072c676f051339387d65
SHA1 55412d4234c40f3fb2f44e3413929135ee66f850
SHA512 e6e479bd31093d811e1f4fa6f50ebc25ddd02d9d98b24fa3bf8ed8e9faf774a7ef41dd7566fdac5188ef06ce153c0f2f6f1eac4d65b36c48c75742f956909677
MD5 SHA1 SHA512

Submit Download

1144_13434835590656286.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\1144_13434835590656286.pma
Size 696B
SHA256 da9a8ae0c04da6ceae900796a026f4777895bf149eed2c495fbdae098362f596
MD5 3f5af086a83b749aa34a3aac1b986a0a
SHA1 0e67e17122beec914722d98cef0e669541560ff3
SHA512 0a12749b3971d0023cc1dd4f87113c94cc2c961ef824009c89a32ba24fe51de83357bb0757af7612ffb3a638302f5a298a2fc823dec8d117cf27255d2996191b
TLSH
T153010E49A3144F77CC828D3584FE27412BB0FA501B821BBF7B10724F2E021C9AED9168
MD5 SHA1 SHA512 TLSH

Submit Download

2084_13434835590695452.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\2084_13434835590695452.pma
Size 344B
SHA256 fd668d6edcf6b6cc176edd9bf7b0d7f1881fe2f0d94ebae656127c27a359550e
MD5 1b7cdddfb06152ae01f12d9f253237d6
SHA1 1ef358781a086a0727f4fa95cd53510eb328bc52
SHA512 4705c93b233be92dd2d04649d404b538bc76607bbe655d5e35a739653ac1af776ecdd12ec1cbf81476070ec5bae633f891817155014730a06939efb21bd132ea
TLSH
T159E0A79677648B7BD446CD31457B03523F6AF8501F81176F4740758F1E522D88E06420
MD5 SHA1 SHA512 TLSH

Submit Download

chrome_installer.log

Path C:\Program Files\chrome_installer.log
Size 7KB
SHA256 d327197204aad0e32dd2c6a91f7503b7c16e229eb5766a5802fdbf0aa43e72db
MD5 cbd7c14afdf30a5f21e0ffd493d4e306
SHA1 43f36ee3e01f2c22a85814e8581c93f6be843ea2
SHA512 22e7298e28ea77ac8144a108a46c57e34945fe94f634789fed4410d47a50abca291bb71bdcf2f02a16c8e4abd6fcb194f1a81e0bfda2db178aec5a37fe463566
SSDEEP 96:iu3BaGf5FRBJRVmwvGlsoh9hK3FK34yMaIAOXJ+RsaYhK2hK2cS3pe4HuMg45c18:ic8wFR7PmwvGlu1fPrJvzyAdH/g45c18
TLSH
T102F1C99A9E03447B3B858B6B334326A17EAF141AE7E4947277EF6605F0CA964001F5B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_installer.log

Path C:\Program Files\chrome_installer.log
Size 9KB
SHA256 d085b36dbf2ef41436b8ab6821289860c2356d41531635b3e6d68fceca1fe516
MD5 bf0dd0feac87008cfdbdb4064c203624
SHA1 00937dc2f98ed5bb6ab051835c814868548592db
SHA512 a91fe91798eb2a813347c63cf240dd1af90e768760de8d307b07d2b1981fd81fa89af2a908ed606069f58b43ab684a101ec1076d5b01c6e0a0fb8beeaa1b4d1e
SSDEEP 192:ic8wFR7PmwvGlu1fPrJvzyAdH/g45c19pSY:ic8wFR7PmwvGlu1fPrJvzyvic19pSY
TLSH
T12B12BE9A9E03487F3B858B6B334335A16E9F140AE7E4947277EF6605F0CAA64001F5B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 6425e306544eada3397086f82b6fd7cdb8aefeec7d1cb40f10889682c6dcdca2
MD5 f4047e2d9124e64dc7905462238d66a7
SHA1 d0d02389d27ee899b8ab1f357d020446eac137f9
SHA512 8ef4320644acd749609a792ccff20a44ffcce07d2ce7e1172a15bf59d701185e22fe861ae045f73a0f84239b8439a16c38b164dd017a3bd0debd8431bf9b860a
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 1a0923f00492dcaf242cd8303ad727bb35271cfb0b5571c3734732cd10b1a4b7
MD5 ed3da0cffdd9fd881168f5ea6c166aff
SHA1 660531776cb07ca8a2009067519a344ccef848e0
SHA512 11a01dfd9d607918019d6aab8c2e170d32c031c59a9d1e20c5ce411e797aae820c47f2901b007c725c2bc4eb37be2116736789d1d47eb36a5e7701ed5425100c
TLSH
T100F02DB9CC21BC3B18FD1B2E60A45B4BF75113672752854B7B3D820D8FB063B468595C
MD5 SHA1 SHA512 TLSH

Submit Download

Google Profile.ico

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
Size 192KB
SHA256 87e933966804aefee5b77abdae95b1a7f72c298b148190d7d20fe6a77c239f3b
MD5 010ec79a1098823a764aca5c4adfcbef
SHA1 ee77b3b4682e7b05075d7713f354162fe02555bb
SHA512 3ca45c2be2a916e19c5d9c467e1cdfac64b9243c29c9ac79dcde1342cc0cb9203d3f6ffe1b9ca1257799f6c70237e12019908e2c5091dd77d40134a0ae25d6f8
SSDEEP 3072:2Xm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4gMg3cdrqZByGk:2XUMCm4U6q62MEBi99g9sdIJZpVhA
TLSH
T1BA143B265EEEE940EEB11A753E7E4381D6B5B80689FD21E45AE23C112B7FCF505B9003
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 2c42bc9e686491320b3da4754f39ab2ee9405ab2e43ca78e6557ff70d7c7d5b4
MD5 8cf8651ad923cea89e9a394deead6a63
SHA1 d64aa134c4962f5ab711d412a672f93ea91af8c6
SHA512 e9db81bc4d0d35f7c9b2fb8d95c58b49fd961a8bc370734ba6c1289e1ed03a66a9f34f2d40bc75bc6028d33a3d6842c6bc2ceacc4cf5b00acb4c266bfcffc869
TLSH
T19D518CB7C7D8866DC40196F59B257E2FCE7D0A14522C3C56C8E8AE5F53E28B2D21134E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 19cf1578d629d7fbaec3c60a3e5d89f95a971ccc07d2ab211ff530c80d279303
MD5 5bd08dbb92201a7499b725ff1d7f6cfd
SHA1 00e1509a4989370cbe1397b8c5ad36b763609532
SHA512 a3ba935024e384bcabcde8bc3dbd95c9e652ce3b49152e7ced871fdc9752134f482687b181b82f963d16d2701504f3665fbaf74a2c73467eda9fcd29001c5df1
SSDEEP 192:LR+5TM5ASGfLv779PRp2SXsb+WNnWN2clUeo8mEe+iyIsnAUgtaJ:LRUTRfz1X5XwM2cDAH8
TLSH
T10632A22DFD30B93B5CCBC219EE267B83D2F5102220C42E84DAF89A6C15DB9CD2227117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 b38abc9873e0ef47d2525cc6944809cb78b30e42231a06587f17e9be0c0d56d5
MD5 fb8484c65a11ac76beeff3a57546cb56
SHA1 f1c7d11cc768ac27572b78e39d5dcd3a1160c3ee
SHA512 046852fb94fa52c1877204a616aba0ca8030f107628fd7a4bb105a550aaa7782d578d421383316c3f65412f286775930d98c598543c9c26821e7d509b09a9851
SSDEEP 192:LR+5TM5ASGfLv779PRp2SXsb+WNnWN2c5Ueo8mye+iyIsnAUgraJ:LRUTRfzVX5XwM2cnQHe
TLSH
T13042932DFD20793B5DCBD219FD26BB93D2F5102220902E84DAFD9A6C15DB5CD2227127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe589c5a.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe589c5a.TMP
Size 3KB
SHA256 ecde4a524cd361c6296a7d7f0765707ed3a039592ac8193cdf087644183bd20d
MD5 ba6f0d8c200e8214724ffa1c0c523abb
SHA1 0ea6b482329133c7637d79d464f88f729dee309e
SHA512 03ceec1428fef6ed4e918537a5d279738c12155fa4431e6b9bd3333a86c31a6b219d0e12683b85974d5bfba12e382d6fedadac042f662880d71cb1566a014565
TLSH
T113614F6DC5A45CAB0EB277B9B42E1781FDA1033F2440141A7ABE598C5FBF85B8081F6D
MD5 SHA1 SHA512 TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 1f54a63591e6dde1b69486f2c8df6aaa98f633d0dd8c27d42b25af96f2f70962
MD5 5cab65b9e642c268f5e70f2293b70c27
SHA1 9b7f8ea2e54c186b6be63179827f24fefd5b4203
SHA512 aaedba4547233d39a1d47ce7a59630f5cd2b806b21bbc46f0287631c30dbc811e831b70b7718e86c903808f8295a1c84b1c15b731955021a00b7e0db90e5171f
SSDEEP 384:JvjFE7KxkXqKf/pUZNCgVLH2HfgslsS7pLuLceSbWXODFs+ErU3kTHGDrUWmrgas:JbFE7KxkXqKf/pUZNCgVLH2HfgsKS7p9
TLSH
T1D8721967AC4C9E3B4F94C6CCD8167B4FADB5024B65DE886483FA982503D5ACF110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 cb8238b5b799882d02e6f67e115069a39181e2c3e5229c325d330d2792c86616
MD5 2f34e36a76ceb285ba63edc0c3c22e56
SHA1 1fe5d04c6a5d37aef4fb235548237cbc6c6c080c
SHA512 ab4612d514ddb1ab46faab77cb3cb5ece82d3b1650745cb6a1162657ad19368e71af866e5137b1a119002ff75c1c126f0c64e9b69952523c31f2f2986270761d
TLSH
T10CB0125680415303C19202F4266054983154DF25EA05130191F40F028C35191D05B054
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58cdf9.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58cdf9.TMP
Size 96B
SHA256 082a0f9fa34f280917f19f61bcced2023658c785ae62f3377649af74d50bfff7
MD5 4681615a18ed514b600500aa41287cbb
SHA1 1a61042115143d0e8a2387fc822a03ce7c58fddb
SHA512 4edf2f11ed7f9a89a0d829fe2ca7f8de856b07840a43a8aaecb6a7598df7e9a1afc7c1f309c373ba6b73910c70c0e88e2d8da38a546fbbbb289067b85615c307
TLSH
T145B02208C202A203C08203B038E280CC3330CF2CC203032AF2F00E32CC202300223030
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 265KB
SHA256 ec5fcefef52c84284fe2bdba7b1d81be97646485595ae7c06e416d3a73c18bdd
MD5 5443528f099693d1abe2e588b55602c3
SHA1 fc406cca3a8e149728358d4f901633330fe13fa8
SHA512 d5a2f9f934d1da476bdbddfbc1e61e0679e1609c12ee168a52f9c0f249f7296eb41cc21b1e647a6441d2dbf591c48530a7dc9fb917edd270fcabec7f8a9f330b
SSDEEP 6144:HNb/qgSXuZZ/q+hFD+7t56OD9ZfSApprL:EXXcZCyFSXD9ZfS4R
TLSH
T1F74412B257676897CCBE6461B04352000EF1ADDEDA8D9A0F84D7AF8BD1CBD4905D2E23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 23cff32eae65171a0f32ebeef29fcbd40d2a039945e2449f75375f67001135c7
MD5 f93a9e2a62427f298dc3c5d05ac9528b
SHA1 9d60f5d508b2d4fb73357c8486afce20ca9e5dac
SHA512 4e76553e062aa45df57a70fa1001e3ac8d5493343e524d2b5fa6106acdb29f9d52787e73484103de71bb798e43ba46932e4b15ec87117f49bc8ca2452fde16b6
SSDEEP 3072:wJa+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+g3:w4+hFD+7t56OD9ZfSAppr3
TLSH
T1B7D31232AA94C8BBC9BD6541F157A300CE626CED41DE7A09444A9F8EE09FC5D0773A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 264KB
SHA256 58249a79dfe5acaf3cd991a46ac8ce11897982bed47160cdd5fa20199de4d7c3
MD5 f426db37e080a29110da5c9bedce488f
SHA1 19c607b0c9c34145f9a146a0b4ec0165c6d0beb0
SHA512 294ce9250010ae0a84195a95426c134d3f49154f023bc0bbc4cc34096f620cd23fe46719abc3ac6714e486f614b36ece370e57ce5118a885d463a69eb81321cd
SSDEEP 3072:MJ3HfqAzSKNq+iWNOU4MwoGb4isJ2Ah4+lPFz63F8+7t5x0M2XLqD90xWfrz6a97:M5/qgSXuZZ/q+hFD+7t56OD9ZfSApprL
TLSH
T1DC4423B2576BA9D7C8BE6061B05742000EF15CDE9ACE5A0F84D79F8BD1CBD4902D2E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 264KB
SHA256 d93aeb61d74cf32f8feb349c195bdf6f3a3758c0d0b4861196e70c9320b3e611
MD5 ac9ba387a70969be073df8eeef2a51c0
SHA1 0ffc33242dbc02801db12af3f2049b62fbafc819
SHA512 bf663556afa4b1adf1eed4573f0ef31e4af53b6f258192399c30773be1b9920a702f75ad75d59593ae4a2424726c2886243b9ff609ec7d1287be2242ac0feb4f
SSDEEP 3072:HJ3HfqAzSKNq+iWNOU4MwoGb4isJ2Ah4+lPFz63F8+7t5x0M2XLqD90xWfrz6a97:H5/qgSXuZZ/q+hFD+7t56OD9ZfSApprL
TLSH
T11C4423B2576BA9D7C8BE6061B05742000EF15CDE9ACE5A0F84D79F8BD1CBD4902D2E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download