eff4b583d6a3e0743b7ad853a8227cc04b83eb4d855cac31bdef4fb0185326a9

Analysis

max time kernel
299s
max time network
299s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
07/10/2026, 01:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
𝐒𝐄𝐓𝐔𝐏.exe
Size 1014KB
Sample261007-cebd9abz3q
SHA256 eff4b583d6a3e0743b7ad853a8227cc04b83eb4d855cac31bdef4fb0185326a9
MD5 c9a8bc2237b95e0543c5dc67192de2b5
SHA1 6fbd4c488024b13f36ddcd0eeb73403fca6758bf
SHA512 1b298ff2e8fef642e427bbb87fe4b7e541445820ebc2576930e124f9f7f510be7825bf1d84ebcbe5c18205dcc67c0e82facf91c9c0c800f0aafbe745bdfd4e86
SSDEEP 24576:N2YM6PB435Qt862CCTxbAQE209ZUSYyCoGihMKO:McZ4JQCFCQE20QVKM
TLSH
T1BB2538E53F851EFAF7505935C2AA036A82EBF906D2D488E6E65D88775A00CC07DF1C2D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence spyware

Malware Config

Signatures

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 50 IoCs

description	pid	Process	procid_target
PID 3172 set thread context of 3484	3172	Explorer.EXE	85
PID 3172 set thread context of 3484	3172	Explorer.EXE	85
PID 3172 set thread context of 3484	3172	Explorer.EXE	85
PID 3172 set thread context of 3484	3172	Explorer.EXE	85
PID 3172 set thread context of 3484	3172	Explorer.EXE	85
PID 3172 set thread context of 3484	3172	Explorer.EXE	85
PID 3172 set thread context of 3484	3172	Explorer.EXE	85
PID 3172 set thread context of 3484	3172	Explorer.EXE	85
PID 3172 set thread context of 3484	3172	Explorer.EXE	85
PID 3172 set thread context of 3484	3172	Explorer.EXE	85
PID 3172 set thread context of 3484	3172	Explorer.EXE	85
PID 3172 set thread context of 3484	3172	Explorer.EXE	85
PID 3172 set thread context of 3484	3172	Explorer.EXE	85
PID 3172 set thread context of 3484	3172	Explorer.EXE	85
PID 3172 set thread context of 3484	3172	Explorer.EXE	85
PID 3172 set thread context of 3484	3172	Explorer.EXE	85
PID 3172 set thread context of 3484	3172	Explorer.EXE	85
PID 3172 set thread context of 3484	3172	Explorer.EXE	85
PID 3172 set thread context of 3484	3172	Explorer.EXE	85
PID 3172 set thread context of 3484	3172	Explorer.EXE	85
PID 3172 set thread context of 3484	3172	Explorer.EXE	85
PID 3172 set thread context of 3484	3172	Explorer.EXE	85
PID 3172 set thread context of 3484	3172	Explorer.EXE	85
PID 3172 set thread context of 3484	3172	Explorer.EXE	85
PID 3172 set thread context of 3484	3172	Explorer.EXE	85
PID 3172 set thread context of 3484	3172	Explorer.EXE	85
PID 3172 set thread context of 3484	3172	Explorer.EXE	85
PID 3172 set thread context of 3484	3172	Explorer.EXE	85
PID 3172 set thread context of 3484	3172	Explorer.EXE	85
PID 3172 set thread context of 3484	3172	Explorer.EXE	85
PID 3172 set thread context of 3484	3172	Explorer.EXE	85
PID 3172 set thread context of 3484	3172	Explorer.EXE	85
PID 3172 set thread context of 3484	3172	Explorer.EXE	85
PID 3172 set thread context of 3484	3172	Explorer.EXE	85
PID 3172 set thread context of 3484	3172	Explorer.EXE	85
PID 3172 set thread context of 3484	3172	Explorer.EXE	85
PID 3172 set thread context of 3484	3172	Explorer.EXE	85
PID 3172 set thread context of 3484	3172	Explorer.EXE	85
PID 3172 set thread context of 3484	3172	Explorer.EXE	85
PID 3172 set thread context of 3484	3172	Explorer.EXE	85
PID 3172 set thread context of 3484	3172	Explorer.EXE	85
PID 3172 set thread context of 3484	3172	Explorer.EXE	85
PID 3172 set thread context of 3484	3172	Explorer.EXE	85
PID 3172 set thread context of 3484	3172	Explorer.EXE	85
PID 3172 set thread context of 3484	3172	Explorer.EXE	85
PID 3172 set thread context of 3484	3172	Explorer.EXE	85
PID 3172 set thread context of 3484	3172	Explorer.EXE	85
PID 3172 set thread context of 3484	3172	Explorer.EXE	85
PID 3172 set thread context of 3484	3172	Explorer.EXE	85
PID 3172 set thread context of 3484	3172	Explorer.EXE	85

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Git\breidyieush.pdf	𝐒𝐄𝐓𝐔𝐏.exe
File opened for modification	C:\Program Files\millipedes\stirthactoerst.dat	Explorer.EXE

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5404	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe

Suspicious behavior: EnumeratesProcesses 52 IoCs

pid	Process
3172	Explorer.EXE
3172	Explorer.EXE
3172	Explorer.EXE
3172	Explorer.EXE
3172	Explorer.EXE
3172	Explorer.EXE
3172	Explorer.EXE
3172	Explorer.EXE
3172	Explorer.EXE
3172	Explorer.EXE
3172	Explorer.EXE
3172	Explorer.EXE
3172	Explorer.EXE
3172	Explorer.EXE
3172	Explorer.EXE
3172	Explorer.EXE
3172	Explorer.EXE
3172	Explorer.EXE
3172	Explorer.EXE
3172	Explorer.EXE
3172	Explorer.EXE
3172	Explorer.EXE
3172	Explorer.EXE
3172	Explorer.EXE
3484	chrome.exe
3484	chrome.exe
3172	Explorer.EXE
3172	Explorer.EXE
3172	Explorer.EXE
3172	Explorer.EXE
3172	Explorer.EXE
3172	Explorer.EXE
3172	Explorer.EXE
3172	Explorer.EXE
3172	Explorer.EXE
3172	Explorer.EXE
3172	Explorer.EXE
3172	Explorer.EXE
3172	Explorer.EXE
3172	Explorer.EXE
3172	Explorer.EXE
3172	Explorer.EXE
3172	Explorer.EXE
3172	Explorer.EXE
3484	chrome.exe
3484	chrome.exe
936	chrome.exe
936	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3172	Explorer.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3484	chrome.exe
3484	chrome.exe
3484	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3484	chrome.exe
Token: SeCreatePagefilePrivilege	3484	chrome.exe
Token: SeShutdownPrivilege	3484	chrome.exe
Token: SeCreatePagefilePrivilege	3484	chrome.exe
Token: SeShutdownPrivilege	3484	chrome.exe
Token: SeCreatePagefilePrivilege	3484	chrome.exe
Token: SeShutdownPrivilege	3484	chrome.exe
Token: SeCreatePagefilePrivilege	3484	chrome.exe
Token: SeShutdownPrivilege	3484	chrome.exe
Token: SeCreatePagefilePrivilege	3484	chrome.exe
Token: SeShutdownPrivilege	3484	chrome.exe
Token: SeCreatePagefilePrivilege	3484	chrome.exe
Token: SeShutdownPrivilege	3484	chrome.exe
Token: SeCreatePagefilePrivilege	3484	chrome.exe
Token: SeShutdownPrivilege	3172	Explorer.EXE
Token: SeCreatePagefilePrivilege	3172	Explorer.EXE
Token: SeShutdownPrivilege	3484	chrome.exe
Token: SeCreatePagefilePrivilege	3484	chrome.exe
Token: SeShutdownPrivilege	3484	chrome.exe
Token: SeCreatePagefilePrivilege	3484	chrome.exe
Token: SeShutdownPrivilege	3484	chrome.exe
Token: SeCreatePagefilePrivilege	3484	chrome.exe
Token: SeShutdownPrivilege	3484	chrome.exe
Token: SeCreatePagefilePrivilege	3484	chrome.exe
Token: SeShutdownPrivilege	3484	chrome.exe
Token: SeCreatePagefilePrivilege	3484	chrome.exe
Token: SeShutdownPrivilege	3484	chrome.exe
Token: SeCreatePagefilePrivilege	3484	chrome.exe
Token: SeShutdownPrivilege	3172	Explorer.EXE
Token: SeCreatePagefilePrivilege	3172	Explorer.EXE
Token: SeShutdownPrivilege	3484	chrome.exe
Token: SeCreatePagefilePrivilege	3484	chrome.exe
Token: SeShutdownPrivilege	3484	chrome.exe
Token: SeCreatePagefilePrivilege	3484	chrome.exe
Token: SeShutdownPrivilege	3484	chrome.exe
Token: SeCreatePagefilePrivilege	3484	chrome.exe
Token: SeShutdownPrivilege	3484	chrome.exe
Token: SeCreatePagefilePrivilege	3484	chrome.exe
Token: SeShutdownPrivilege	3484	chrome.exe
Token: SeCreatePagefilePrivilege	3484	chrome.exe
Token: SeShutdownPrivilege	3484	chrome.exe
Token: SeCreatePagefilePrivilege	3484	chrome.exe
Token: SeShutdownPrivilege	3484	chrome.exe
Token: SeCreatePagefilePrivilege	3484	chrome.exe
Token: SeShutdownPrivilege	3172	Explorer.EXE
Token: SeCreatePagefilePrivilege	3172	Explorer.EXE
Token: SeShutdownPrivilege	3484	chrome.exe
Token: SeCreatePagefilePrivilege	3484	chrome.exe
Token: SeShutdownPrivilege	3484	chrome.exe
Token: SeCreatePagefilePrivilege	3484	chrome.exe
Token: SeShutdownPrivilege	3484	chrome.exe
Token: SeCreatePagefilePrivilege	3484	chrome.exe
Token: SeShutdownPrivilege	3484	chrome.exe
Token: SeCreatePagefilePrivilege	3484	chrome.exe
Token: SeShutdownPrivilege	3484	chrome.exe
Token: SeCreatePagefilePrivilege	3484	chrome.exe
Token: SeShutdownPrivilege	3484	chrome.exe
Token: SeCreatePagefilePrivilege	3484	chrome.exe
Token: SeShutdownPrivilege	3172	Explorer.EXE
Token: SeCreatePagefilePrivilege	3172	Explorer.EXE
Token: SeShutdownPrivilege	3484	chrome.exe
Token: SeCreatePagefilePrivilege	3484	chrome.exe
Token: SeShutdownPrivilege	3484	chrome.exe
Token: SeCreatePagefilePrivilege	3484	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
4064	𝐒𝐄𝐓𝐔𝐏.exe
3484	chrome.exe
3484	chrome.exe
3484	chrome.exe
3484	chrome.exe
3484	chrome.exe
3484	chrome.exe
3484	chrome.exe
3484	chrome.exe
3484	chrome.exe
3484	chrome.exe
3484	chrome.exe
3484	chrome.exe
3484	chrome.exe
3484	chrome.exe
3484	chrome.exe
3484	chrome.exe
3484	chrome.exe
3484	chrome.exe
3484	chrome.exe
3484	chrome.exe
3484	chrome.exe
3484	chrome.exe
3484	chrome.exe
3484	chrome.exe
3484	chrome.exe
3484	chrome.exe
3484	chrome.exe
3484	chrome.exe
3484	chrome.exe
3484	chrome.exe
3484	chrome.exe
3484	chrome.exe
3484	chrome.exe
3484	chrome.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 4064 wrote to memory of 3172	4064	𝐒𝐄𝐓𝐔𝐏.exe	54
PID 3484 wrote to memory of 2256	3484	chrome.exe	86
PID 3484 wrote to memory of 5260	3484	chrome.exe	87
PID 3484 wrote to memory of 5260	3484	chrome.exe	87
PID 3484 wrote to memory of 5404	3484	chrome.exe	88
PID 3484 wrote to memory of 1576	3484	chrome.exe	89
PID 3484 wrote to memory of 1576	3484	chrome.exe	89
PID 3484 wrote to memory of 4312	3484	chrome.exe	90
PID 3484 wrote to memory of 4312	3484	chrome.exe	90
PID 3484 wrote to memory of 1268	3484	chrome.exe	92
PID 3484 wrote to memory of 1268	3484	chrome.exe	92
PID 3484 wrote to memory of 5712	3484	chrome.exe	94
PID 3484 wrote to memory of 5712	3484	chrome.exe	94
PID 3484 wrote to memory of 1112	3484	chrome.exe	95
PID 3484 wrote to memory of 3776	3484	chrome.exe	97
PID 3484 wrote to memory of 4812	3484	chrome.exe	98
PID 3484 wrote to memory of 4596	3484	chrome.exe	99
PID 3484 wrote to memory of 936	3484	chrome.exe	100
PID 3484 wrote to memory of 4368	3484	chrome.exe	101
PID 3484 wrote to memory of 4368	3484	chrome.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3172
- C:\Users\Admin\AppData\Local\Temp\𝐒𝐄𝐓𝐔𝐏.exe
  "C:\Users\Admin\AppData\Local\Temp\𝐒𝐄𝐓𝐔𝐏.exe"
  2⤵
  - Drops file in Program Files directory
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3484
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb1ffec728,0x7ffb1ffec734,0x7ffb1ffec740
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2256
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1644,i,6698864555221199377,8359998795351882515,262144 --field-trial-handle=1936,i,4653510233226925191,15163405805364642901,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1932 /prefetch:2
    3⤵
    PID:5260
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1464,i,7357833292456559610,16076659808421408264,524288 --field-trial-handle=1936,i,4653510233226925191,15163405805364642901,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2252 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5404
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2336,i,11241946251149029443,5896340167861149853,524288 --field-trial-handle=1936,i,4653510233226925191,15163405805364642901,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2520 /prefetch:13
    3⤵
    PID:1576
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2980,i,7578588915940417128,8967299931766816782,2097152 --field-trial-handle=1936,i,4653510233226925191,15163405805364642901,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3052 /prefetch:1
    3⤵
    PID:4312
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2976,i,6942075058141730550,5305146874417226797,2097152 --field-trial-handle=1936,i,4653510233226925191,15163405805364642901,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3028 /prefetch:1
    3⤵
    PID:1268
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4428,i,16657325544845985316,14088042227957296580,2097152 --field-trial-handle=1936,i,4653510233226925191,15163405805364642901,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4460 /prefetch:1
    3⤵
    PID:5712
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5252,i,7473079609055724980,2939557207459401352,524288 --field-trial-handle=1936,i,4653510233226925191,15163405805364642901,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5256 /prefetch:14
    3⤵
    PID:1112
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5516,i,8123994640306185450,14597324959380381063,524288 --field-trial-handle=1936,i,4653510233226925191,15163405805364642901,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5596 /prefetch:14
    3⤵
    PID:3776
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5252,i,1818539838728439049,5770802157133754033,524288 --field-trial-handle=1936,i,4653510233226925191,15163405805364642901,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5320 /prefetch:14
    3⤵
    PID:4812
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5500,i,2969157899509444275,9881550524906134149,524288 --field-trial-handle=1936,i,4653510233226925191,15163405805364642901,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5308 /prefetch:14
    3⤵
    PID:4596
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5332,i,642163434196831985,16120954320967101364,262144 --field-trial-handle=1936,i,4653510233226925191,15163405805364642901,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5404 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:936
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4124,i,3327576492374581373,11452238089628536209,524288 --field-trial-handle=1936,i,4653510233226925191,15163405805364642901,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4156 /prefetch:14
    3⤵
    PID:4368

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:400

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

056d4370-6dcd-4e57-ab26-d11d2d05b878.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\056d4370-6dcd-4e57-ab26-d11d2d05b878.tmp
Size 265KB
SHA256 599fae228a4e1fbb83d4ddfb2b5d16574837926e813eeccf9bca8d52f3e41043
MD5 411227ed7d412d73c29e7a3cd9de4e4a
SHA1 9514212908179c46ad36fc3eddaee6dac29f85ab
SHA512 1867ebb977bd834e769dab5a9d67fffd04fb38f2d01e914d458d16ef2d6ace5473df3b4c523b1ad642d654176873198b9712cc10839f5b983db202788d2ada39
SSDEEP 6144:dLym6meaBUs5XlN93RV1JxmX/B5UgKf2ne1utLN:px6mzBUs951rOw2npLN
TLSH
T10D4412A67DECDFD30276B016A8A78F6ACAF33DCD6044EF9195F402C1451A6AD43D9823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2506a8b5-d56f-4fc1-a8f1-2f8f5e4036a3.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\2506a8b5-d56f-4fc1-a8f1-2f8f5e4036a3.tmp
Size 130KB
SHA256 01e42d76110abc6b00017477e05e9350a30e4b0f49c142840acb653b8b97cd4c
MD5 b3e7584da89304c9ef9d34a42b0626ad
SHA1 e31a090fa5b185052f08d263c70b2a00d634354c
SHA512 07da80d00456761ea19fcb6d77be342688a2a68b2baedb1afdd007c3d40c1b2edd9052bf11f851e6c6a6e789b83ba4f75e1ba4cc319aa45aeb565063737a49bc
SSDEEP 3072:ShgYVmX/M9F03bZTGnbgKfHWuoJqrAKrpQpbOYg3xC1:SxmX/B5UgKf2ne1utL1
TLSH
T1CBD302BF9DD9DFE36361F026A9A95B6EC9F67FC8A160DA4080F41085009F1FD4399A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

33361e7f-f427-4269-8c82-b52f58fea46e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\33361e7f-f427-4269-8c82-b52f58fea46e.tmp
Size 266KB
SHA256 fed5122b9256407990dc14655c34ff13e5f471890dacc7c304b42834895b90c2
MD5 77709d902fad5c2d19a39c20c7451ed7
SHA1 baa044d6ac9749b15e92b6aa8f078281bb71bbba
SHA512 5cf826e4c82d87e8e1dac60cb98480f87642da80f55ffcfa232e9fd7009ec534579bb4b2727f40166653133cbdb689b90ba385a4f13fac5a4e46f70bab13ee91
SSDEEP 6144:KaLym6meaBUs5XlN93RV1JxmX/B5UgKf2ne1utLN:vx6mzBUs951rOw2npLN
TLSH
T1034412B67CDCDFD30272B41AA4929F2A8EF33ECDA444EF81A5F412C1451E6AD4799813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8c3e32a8-c035-4aa8-bcc4-33c09bab356c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\8c3e32a8-c035-4aa8-bcc4-33c09bab356c.tmp
Size 265KB
SHA256 117fad1de560e49d4b86e605d9932e821f8298e89fbf519207368b9244fe4b16
MD5 1401bea5358b2b20b41da6e2dd58f2c1
SHA1 2920e758c9c5cff2e92d5830be06c178a5ff2cd2
SHA512 136e1c97ee10c202c409fa95cd7a7fa92fde5607422c13c9ebcb0435a3152aa791bc53e2cbc3b81da911192126f24e13b18a96df11630492cb0a483bb23bb655
SSDEEP 6144:GLym6meaBUs5XlN93RV1JxmX/B5UgKf2ne1utLN:Qx6mzBUs951rOw2npLN
TLSH
T12E4412A67DECDFD30276B016A8A78F6ACAF33DCD6044EF9195F402C1451A6E943D9823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f1d45faf-b013-4a33-8899-f593ce9325ff.dmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\reports\f1d45faf-b013-4a33-8899-f593ce9325ff.dmp
Size 104KB
SHA256 1d944ee96db178258b90a30ba610c496482e07d3b65d00e82be3334aba2cced9
MD5 1bb5d5ae19447a62f18158a193ed405e
SHA1 3f7ccff410908e6128547a2858fed094462f0291
SHA512 e7d246d1d0ecb4a03cf739ec415fa11967e58319ee58bd588c76182bbcbe0ba60f592f12b33bca4fb57f7af76cd32b50385158e4dfce8c87ff8a779b64a9a5a8
SSDEEP 384:V/42nBT6KLcZWMmRsLWgKLPFg3zdPgMQq2kIaL0+0CKyWZsKhokeYemYeIdGLpN+:MKL5/g31LjZeIdGLplKpKW4UWDZWOMX
TLSH
T178B3DC02E7C61566F279C63456D3BB12F7FAE46147524B2B022092B9AC933C4EF77E21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 7c6e2ff2cdb09e3d8d75fdb570270093f07e5e0a43f0e61e4fb2778ae54aada0
MD5 9a55c891d32d99029a871b7231664647
SHA1 0a7ff2067c1292bce3cf69e91bbbda26dc4c0914
SHA512 2293d8dcdd27570365aaf77fbb1762154f8de366d55bf8d4e8f69cec850d94e4067f4f80f018d02279ad49ea03ce6d1e9bbd226cb423dca66bd9a7c6b142c2ed
MD5 SHA1 SHA512

Submit Download

1605b0a0-b7b7-46c6-81d3-f7c4b62fbf84.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\1605b0a0-b7b7-46c6-81d3-f7c4b62fbf84.tmp
Size 12KB
SHA256 8949df02d637ad1fbc0f353ceb66fca46c25ce1d407a15bd78f537fe8a4a51ec
MD5 8ea94b6f167c36357b89e9f051d7e39a
SHA1 096a0aa02fed31ac1eabbc2c49be4ae6a6f3c76d
SHA512 b8745be247449943870eca1f92009019dc94bf7789542a2e224926ed3f667ad227bb8abf55f7c8c068ea11f38c49dc7861ae3a04b7755988dbecf71ed3eab9a2
SSDEEP 192:wR9ysC/v7+7pzPRpbR9ZHsb+WNnkSZdPk2uckw+VyIsnAUgraJ:wR9y5XS7pXVbwFZdM2bWe
TLSH
T10D42B52DFD10787B5CEEE22EF9617B57D2F9102225912E88E6FC892C15EB6CD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6cdc1bee-6b13-4178-9c8a-871a6cb2262a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\6cdc1bee-6b13-4178-9c8a-871a6cb2262a.tmp
Size 12KB
SHA256 d971e3cae745ea045cb0534b5a18b981870027380e63dd533c9ae296b6465155
MD5 0f8ffea6dfff3d360c431e50bbc16aa1
SHA1 509a451e42f65468ff24701564a0eea4467049a1
SHA512 7d9cf89ee9c57f5ef4be55dd30a9fbd4f69137496e567c9f56b6e1c55f7b0d8cffabb651e61847ae1a5965aaf392e532becf8a9a6af8af987783fe08b247bfbe
SSDEEP 192:wR9yPC/v7+7pzPRpbR9ZHsb+WNnkSZdPk2uckw+VyIsnAUgraJ:wR9yqXS7pXVbwFZdM2bWe
TLSH
T13842A42DFD10787B5CEEE22EF9617B56D2F9102225912E88E6FC892C15EB6CD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

830f6297-bd0e-4b5a-8399-f6d9b7544939.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\830f6297-bd0e-4b5a-8399-f6d9b7544939.tmp
Size 11KB
SHA256 3de4ab0e023b34a3372da51e91bcf9b5971b9834c7f9194f86a9d5a88539193c
MD5 da45ae261cd63f25610b265e136c8c7b
SHA1 ccd5f4ee7d877bb57c6852711dfac3042badba53
SHA512 36eea2e6c3e069ab522b824e0dee4517ee5b60254da0fcd8b19559c9314ad194f894daa9fe880e929b68c9ce9b03439548e257265252d42c4d632361952e3793
SSDEEP 192:wR9ysC/v7+7pAPRp2R9ZHsb+WNnkSZdfk2uckwCVyIsnAUgtaJ:wR9y5XS7UXybwFZdc2bi8
TLSH
T1AB32A42DFE10787B5CEEE22FE9617757D2F9102221952E84E6FC892C15EB6CC221B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

25783fc9-6c19-4071-b98a-2aee415c81af.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\25783fc9-6c19-4071-b98a-2aee415c81af.tmp
Size 3KB
SHA256 ff6d916d824f161e0f42deeccea28559dc1d6b963b7ebce55478eea616668ad1
MD5 edff5c0ab62f648ad92cf260ebc4d251
SHA1 dac96dca15c4e61d3d584dc5885853de4f079084
SHA512 72669f84959cf626ee8b98cdad8308d41e4b1162e8ee7c243247bf5356ccefe1df494dbff97b273e81d178f54597e583b26bee956a476713ed21c94642c61528
TLSH
T119718CF7C3D9C66DC41156E4AA256E2ECE2D0E28522C3C26CCD8AE5F53E2572D25138E
MD5 SHA1 SHA512 TLSH

Submit Download

67f89cde-8483-4ddb-8b76-a9bc949b3eb9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\67f89cde-8483-4ddb-8b76-a9bc949b3eb9.tmp
Size 3KB
SHA256 d77020d8c8878f01fdcca640903ef6023516a848a36b12d133fe738876aeb969
MD5 4b45172fd0daead63a90870b1b239a04
SHA1 df17a72ca60f7481ef0c2c28732386825371da67
SHA512 18cfff91ff5602519ea7945c16332edc12af9beed3c5620a09f9c2f212898c57d64b179b718790f5d5aad04239d9fefe91303df20c2747a8f8214722d825827e
TLSH
T151517CF7C3D4CA6D841156E4AB256E2ECE2D0E18522C3C26CCD8AE5F53E2972D21134E
MD5 SHA1 SHA512 TLSH

Submit Download

b411707b-5cc9-4e4f-9e3e-ae62e2d41324.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\b411707b-5cc9-4e4f-9e3e-ae62e2d41324.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

c4ecb609-8d2e-49be-b7e1-840f4f896248.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\c4ecb609-8d2e-49be-b7e1-840f4f896248.tmp
Size 2KB
SHA256 20f785ad3642c4aaa19612a7d44b6ce2b5a574e1c4c68f49e996ec61fed105d0
MD5 0c3c5ba847a64a78e0bf26a53eacc5db
SHA1 1e90cb828a7fa35290ac6e97b312f914804e971a
SHA512 5320d8b1b376fce5da81d8970c16c457dc953d4e48a109c4e372f3ac4fb54ddb8f351b2536484e0054a7dae60ab39764580f1b4fc5c144ef554cb2bb16298a39
TLSH
T15A516CF7C3D9C66D841157E4AB256E2ECE2D0E18521C3C26CCD8AE5F53E2572D21174E
MD5 SHA1 SHA512 TLSH

Submit Download

c0a57136-a234-45e6-92a2-74ab3c68e8e9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c0a57136-a234-45e6-92a2-74ab3c68e8e9.tmp
Size 649B
SHA256 ad29785af6929e1a41cfbb234446e960870afc8eec8b41895ac4411d94205e34
MD5 430b87674a3cd57a43b8ff62ce3645b4
SHA1 20179eb4c20beb93061119eabb88be40200559d1
SHA512 58ab469393c17356e7b1b9c1b7eabb1423faacf063a6918d9d8d4f2b2a245c97d27a9bdc19ac62258f230679a554afdb69a68f87162107b9392c3c3aaad3dc69
TLSH
T1EDF0F4B9C921BC2718FD2F2961684B4AF74023272B41898F3B3E910C8FB163B4685D2C
MD5 SHA1 SHA512 TLSH

Submit Download

c79e61a6-fdec-4de9-805c-bcd702af8023.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c79e61a6-fdec-4de9-805c-bcd702af8023.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

fdf81be3-8cfa-4cd0-9832-fa3c83f241e4.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\fdf81be3-8cfa-4cd0-9832-fa3c83f241e4.tmp
Size 13KB
SHA256 cbcfbe27999bbf1c38c32cf734dbc58c0c74e8fb94cebfe52fc4ac99ec4b2c4e
MD5 2687abbcac7af17c0b616b501e486b1d
SHA1 baf57c5410325446dd74e61be138853be50fcccc
SHA512 d6063c76c0f9513dcd556327052394a8fbae929daff68178795f4017c88a3a038bc8b09526fadfd4132488a9d51a09e3cd9ab6243430667f2c455f48c796d43f
SSDEEP 384:3hjb67KxkXqKf/pUZNCgVLH2HfgslxwXODb++ErU3l6HGjOoAWI8n:3hb67KxkXqKf/pUZNCgVLH2HfgsP6OPJ
TLSH
T19152F867A84D9A7F0FD8C94DD8266F4FACB5015766680C6893FB5C0803E5BCB114A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

edca896d-1747-4fa7-8b9c-422eb72099d4.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\edca896d-1747-4fa7-8b9c-422eb72099d4.tmp
Size 266KB
SHA256 fc4467b0abef3e08f38ed82b589bf283bc4041b745bdb969aba22ab525f3671a
MD5 b60a8d9178e7b7478da1e845bfbeb577
SHA1 5ea89eb17670d801bab673227180acf825cc11ac
SHA512 af982234678ac52d8dca8ed1f050232905b5dab61c35a42a6bb4a3e626703a5f217e43d278d12d8289670426459a5d259b1b5dbf33c61d19fff473dd31f13737
SSDEEP 6144:6aLym6meaBUs5XlN93RV1JxmX/B5UgKf2ne1utLN:fx6mzBUs951rOw2npLN
TLSH
T1DB4412B67DDCDFC30272B41AA4929F2A8EF33ECDA444EF81A5F412C1451E6AD4799813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3172-11-0x00000000043F0000-0x0000000004480000-memory.dmp

Download

memory/3172-74-0x00000000043F0000-0x0000000004480000-memory.dmp

Download

memory/3172-14-0x00000000043F0000-0x0000000004480000-memory.dmp

Download

memory/3172-12-0x00000000043F0000-0x0000000004480000-memory.dmp

Download

memory/3172-3-0x00000000043F0000-0x0000000004480000-memory.dmp

Download

memory/3172-10-0x00000000043F0000-0x0000000004480000-memory.dmp

Download

memory/3172-9-0x00000000043F0000-0x0000000004480000-memory.dmp

Download

memory/3172-28-0x00000000043F0000-0x0000000004480000-memory.dmp

Download

memory/3172-8-0x00000000043F0000-0x0000000004480000-memory.dmp

Download

memory/3172-17-0x00000000043F0000-0x0000000004480000-memory.dmp

Download

memory/3172-18-0x00000000043F0000-0x0000000004480000-memory.dmp

Download

memory/3172-19-0x00000000043F0000-0x0000000004480000-memory.dmp

Download

memory/3172-59-0x00000000043F0000-0x0000000004480000-memory.dmp

Download

memory/3172-20-0x00000000043F0000-0x0000000004480000-memory.dmp

Download

memory/3172-22-0x00000000043F0000-0x0000000004480000-memory.dmp

Download

memory/3172-16-0x00000000043F0000-0x0000000004480000-memory.dmp

Download

memory/3172-24-0x00000000043F0000-0x0000000004480000-memory.dmp

Download

memory/3172-25-0x00000000043F0000-0x0000000004480000-memory.dmp

Download

memory/3172-26-0x00000000043F0000-0x0000000004480000-memory.dmp

Download

memory/3172-27-0x00000000043F0000-0x0000000004480000-memory.dmp

Download

memory/3172-23-0x00000000043F0000-0x0000000004480000-memory.dmp

Download

memory/3172-13-0x00000000043F0000-0x0000000004480000-memory.dmp

Download

memory/3172-1-0x00000000043F0000-0x0000000004480000-memory.dmp

Download

memory/3172-0-0x00000000043F0000-0x0000000004480000-memory.dmp

Download

memory/3172-2-0x00000000043F0000-0x0000000004480000-memory.dmp

Download

memory/3172-5-0x00000000043F0000-0x0000000004480000-memory.dmp

Download

memory/3172-6-0x00000000043F0000-0x0000000004480000-memory.dmp

Download

memory/3172-7-0x00000000043F0000-0x0000000004480000-memory.dmp

Download

memory/3172-4-0x00000000043F0000-0x0000000004480000-memory.dmp

Download