f84feb66671ecb4b79c7ddbdc72acc56c71aa3f4bfe3c07a9c6f41917e3e0a2c

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/10/2026, 22:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_be0df29331bc0fb8048146046e9c3edd_cobalt-strike_icedid_ryuk_satacom.exe
Size 1.3MB
Sample261023-2af7davy3l
SHA256 f84feb66671ecb4b79c7ddbdc72acc56c71aa3f4bfe3c07a9c6f41917e3e0a2c
MD5 be0df29331bc0fb8048146046e9c3edd
SHA1 d49668cf243691652fd6af3994afe697dd12beac
SHA512 3a641f0d21f3c0866359539731c6bcda52efdbbe22d014421c2f7108aa412e7c41cf022e1b1c4feaaaae89356f6fd4f22898b15e2c4a9756f9f2254fdeca9037
SSDEEP 24576:zkLike9Tn7kiKZsu9AbMxHbMteuDSgB+FNrud7NF5:zwhgV4Sai
TLSH
T1C4555B02EBCBCE76F601483D95994199627328748AC83D7FC12F2D790D7A5E2BAF3215
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery spyware

Malware Config

Signatures

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 30 IoCs

description	pid	Process	procid_target
PID 3276 set thread context of 2324	3276	Explorer.EXE	86
PID 3276 set thread context of 2324	3276	Explorer.EXE	86
PID 3276 set thread context of 2324	3276	Explorer.EXE	86
PID 3276 set thread context of 2324	3276	Explorer.EXE	86
PID 3276 set thread context of 2324	3276	Explorer.EXE	86
PID 3276 set thread context of 2324	3276	Explorer.EXE	86
PID 3276 set thread context of 2324	3276	Explorer.EXE	86
PID 3276 set thread context of 2324	3276	Explorer.EXE	86
PID 3276 set thread context of 2324	3276	Explorer.EXE	86
PID 3276 set thread context of 2324	3276	Explorer.EXE	86
PID 3276 set thread context of 2324	3276	Explorer.EXE	86
PID 3276 set thread context of 2324	3276	Explorer.EXE	86
PID 3276 set thread context of 2324	3276	Explorer.EXE	86
PID 3276 set thread context of 2324	3276	Explorer.EXE	86
PID 3276 set thread context of 2324	3276	Explorer.EXE	86
PID 3276 set thread context of 2324	3276	Explorer.EXE	86
PID 3276 set thread context of 2324	3276	Explorer.EXE	86
PID 3276 set thread context of 2324	3276	Explorer.EXE	86
PID 3276 set thread context of 2324	3276	Explorer.EXE	86
PID 3276 set thread context of 2324	3276	Explorer.EXE	86
PID 3276 set thread context of 2324	3276	Explorer.EXE	86
PID 3276 set thread context of 2324	3276	Explorer.EXE	86
PID 3276 set thread context of 2324	3276	Explorer.EXE	86
PID 3276 set thread context of 2324	3276	Explorer.EXE	86
PID 3276 set thread context of 2324	3276	Explorer.EXE	86
PID 3276 set thread context of 2324	3276	Explorer.EXE	86
PID 3276 set thread context of 2324	3276	Explorer.EXE	86
PID 3276 set thread context of 2324	3276	Explorer.EXE	86
PID 3276 set thread context of 2324	3276	Explorer.EXE	86
PID 3276 set thread context of 2324	3276	Explorer.EXE	86

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\adenine\rhelaendsueght.dat	2026-10-22_be0df29331bc0fb8048146046e9c3edd_cobalt-strike_icedid_ryuk_satacom.exe
File opened for modification	C:\Program Files\truncating\sriantiaold.dat	2026-10-22_be0df29331bc0fb8048146046e9c3edd_cobalt-strike_icedid_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\castaways\pleuysovoart.dat	2026-10-22_be0df29331bc0fb8048146046e9c3edd_cobalt-strike_icedid_ryuk_satacom.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1816	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Suspicious behavior: EnumeratesProcesses 58 IoCs

pid	Process
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
2324	chrome.exe
2324	chrome.exe
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
2324	chrome.exe
2324	chrome.exe
2348	chrome.exe
2348	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3276	Explorer.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
5048	2026-10-22_be0df29331bc0fb8048146046e9c3edd_cobalt-strike_icedid_ryuk_satacom.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 3276	5048	2026-10-22_be0df29331bc0fb8048146046e9c3edd_cobalt-strike_icedid_ryuk_satacom.exe	56
PID 2324 wrote to memory of 3744	2324	chrome.exe	87
PID 2324 wrote to memory of 1108	2324	chrome.exe	89
PID 2324 wrote to memory of 1816	2324	chrome.exe	88
PID 2324 wrote to memory of 1108	2324	chrome.exe	89
PID 2324 wrote to memory of 2928	2324	chrome.exe	90
PID 2324 wrote to memory of 2928	2324	chrome.exe	90
PID 2324 wrote to memory of 2984	2324	chrome.exe	92
PID 2324 wrote to memory of 2984	2324	chrome.exe	92
PID 2324 wrote to memory of 3924	2324	chrome.exe	93
PID 2324 wrote to memory of 3924	2324	chrome.exe	93
PID 2324 wrote to memory of 3948	2324	chrome.exe	94
PID 2324 wrote to memory of 3948	2324	chrome.exe	94
PID 2324 wrote to memory of 3148	2324	chrome.exe	95
PID 2324 wrote to memory of 3148	2324	chrome.exe	95
PID 2324 wrote to memory of 756	2324	chrome.exe	100
PID 2324 wrote to memory of 4580	2324	chrome.exe	101
PID 2324 wrote to memory of 4580	2324	chrome.exe	101
PID 2324 wrote to memory of 2780	2324	chrome.exe	107
PID 2324 wrote to memory of 3480	2324	chrome.exe	108
PID 2324 wrote to memory of 656	2324	chrome.exe	109
PID 2324 wrote to memory of 4872	2324	chrome.exe	111
PID 2324 wrote to memory of 4872	2324	chrome.exe	111
PID 2324 wrote to memory of 2348	2324	chrome.exe	112

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3276
- C:\Users\Admin\AppData\Local\Temp\2026-10-22_be0df29331bc0fb8048146046e9c3edd_cobalt-strike_icedid_ryuk_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_be0df29331bc0fb8048146046e9c3edd_cobalt-strike_icedid_ryuk_satacom.exe"
  2⤵
  - Drops file in Program Files directory
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2324
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb0135c728,0x7ffb0135c734,0x7ffb0135c740
    3⤵
    PID:3744
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1872,i,1894354922884848886,2889737601878168462,524288 --field-trial-handle=2168,i,1849107302183104330,5793356203381603402,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2224 /prefetch:3
    3⤵
    - System Time Discovery
    PID:1816
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1796,i,2988436121406350993,8862525508502879764,262144 --field-trial-handle=2168,i,1849107302183104330,5793356203381603402,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2028 /prefetch:2
    3⤵
    PID:1108
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2412,i,3244801252069457725,2056571819926236401,524288 --field-trial-handle=2168,i,1849107302183104330,5793356203381603402,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2576 /prefetch:8
    3⤵
    PID:2928
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3228,i,6713744657448499877,13987024521598742919,2097152 --field-trial-handle=2168,i,1849107302183104330,5793356203381603402,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3240 /prefetch:1
    3⤵
    PID:2984
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3268,i,13557685554539412612,9805197186616983207,2097152 --field-trial-handle=2168,i,1849107302183104330,5793356203381603402,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3272 /prefetch:1
    3⤵
    PID:3924
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4344,i,17655107299412941871,16594353714818083214,2097152 --field-trial-handle=2168,i,1849107302183104330,5793356203381603402,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3216 /prefetch:1
    3⤵
    PID:3948
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4540,i,15371925886870962887,8172355095083294613,524288 --field-trial-handle=2168,i,1849107302183104330,5793356203381603402,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3856 /prefetch:8
    3⤵
    PID:3148
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5228,i,9801120380371023826,10093692440352802197,524288 --field-trial-handle=2168,i,1849107302183104330,5793356203381603402,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5232 /prefetch:8
    3⤵
    PID:756
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5132,i,233871794530137461,4074764192354553313,524288 --field-trial-handle=2168,i,1849107302183104330,5793356203381603402,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5324 /prefetch:8
    3⤵
    PID:4580
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5652,i,4097453103394623563,15734702469280592544,524288 --field-trial-handle=2168,i,1849107302183104330,5793356203381603402,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5308 /prefetch:8
    3⤵
    PID:2780
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5224,i,7302981265624145566,16146532408339633245,524288 --field-trial-handle=2168,i,1849107302183104330,5793356203381603402,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5260 /prefetch:8
    3⤵
    PID:3480
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5244,i,6071365027970121407,11016245026163359846,524288 --field-trial-handle=2168,i,1849107302183104330,5793356203381603402,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5312 /prefetch:8
    3⤵
    PID:656
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5364,i,10053115483073976952,7017349378202708512,524288 --field-trial-handle=2168,i,1849107302183104330,5793356203381603402,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5692 /prefetch:8
    3⤵
    PID:4872
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5560,i,1632608717133466864,18011585479468972363,262144 --field-trial-handle=2168,i,1849107302183104330,5793356203381603402,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5344 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2348

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2232

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

05f72ce6-a7c9-439c-9a60-7003d3365b14.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\05f72ce6-a7c9-439c-9a60-7003d3365b14.tmp
Size 130KB
SHA256 f600ddf954916c31a658c418bb670d2014158214c26420fa6db2b062b09f07a0
MD5 24c9e53c550b7e8eea35aae3bc4d4907
SHA1 c39369938e88ab4a7d00b18c080b4c0623e34d6c
SHA512 376f50101ad5ba5d686a84c157a6de7481587edf9d6e5c5058ea65bd1c628fd63b56aac4dc453545dfe3d5e69085c3bcdd690055a2cd17a1af719b5d51d10b3d
SSDEEP 3072:d0g+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gr:d0g+hFD+7t56OD9ZfSApprr
TLSH
T16ED31232AA91D8BBC9BC6541B157A304DE766CED41DE3A09444A5F8EE09FC4C06B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1db446f8-8668-4b34-b0bc-ddbc7fbe51f8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\1db446f8-8668-4b34-b0bc-ddbc7fbe51f8.tmp
Size 269KB
SHA256 315cda2f14ac63d8b8aa98eaed5ed1dfa6966ca7580dd6a17b75bfcd73f0eed8
MD5 355c1b4979d690849e2553a8a5326599
SHA1 d82a9cec1c80261f06a2d57a29d09d106847bd82
SHA512 ceb6d51d481c1a79b3979afe7c34a5527a67bb9e4e10919fffd7e160b67631f37e5cbf260adad05ec63762121a29fcd882b80a526b6b96c2b6d9ac941ce08dce
SSDEEP 6144:7WnOV/ve6wQswkOzyQYwGN+hFD+7t56OD9ZfSApprE:7WnORvf7slOzyQYwwyFSXD9ZfS4G
TLSH
T10544233269620D7B5A7D6201A26BE605DF753EE749D41B4C01866F8BE4DFC4A03B2E33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

36cdd159-0ff3-4726-a914-4f73638ccd18.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\36cdd159-0ff3-4726-a914-4f73638ccd18.tmp
Size 270KB
SHA256 6e12765a608e4b44ad19ed70b955bd5a3c8741392a486223703242592b3c0c4a
MD5 02390b6bb7db19a410d4daacccf8f774
SHA1 8505c4c47a1683006d09171fa3bdd98053e94e13
SHA512 e0078ee7cffed0cf107ff913b7e556d52744c05dd970c1700ad571d8d92094108ca43a5704a25fecbf0e0b61f5fd033056d84cabfda476e934ecf0ae5ca13154
SSDEEP 6144:7EdOOV/ve6wQswkOzyQYwGN+hFD+7t56OD9ZfSApprE:7E8ORvf7slOzyQYwwyFSXD9ZfS4G
TLSH
T1A244123239624D7B5ABD6202A257A604DF752EE789D41F4C048A6F4BE4DFC4907B2E33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

53382af6-946e-47ff-9453-900ba8ad51d4.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\53382af6-946e-47ff-9453-900ba8ad51d4.tmp
Size 414B
SHA256 039650310061e4c439d1996ccedd4beae8e8bbaf2008644b5878990f6b89f8d7
MD5 13121d7ee8b9da85ab39a001db63988f
SHA1 f7858139e4e4b20c0a437851dfadd9bf6253eebb
SHA512 69ddeb2e5e0e533b228d10dc66e0bd8ae74f1814abff596275a8ab53f7a1534cfb003ef1c76a619f4192b0bcb25efb14753628ef33a32f0c3b8280447bb32a5f
TLSH
T158E022A9CD39EC2728FD4B1D20904746EF90335766908A4F373C81098FB967A4986CAC
MD5 SHA1 SHA512 TLSH

Submit Download

5ba00915-79ac-48bd-b67e-5d0fab9c07c5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\5ba00915-79ac-48bd-b67e-5d0fab9c07c5.tmp
Size 12KB
SHA256 dfa28bd3c2db89a1b5de6d8bcea54c7773fad542a4a08cdddf48d5d5eccd3d5f
MD5 674aeb6259172621cf2900cea36b8e11
SHA1 8199c9933a8c731afe8958975eecd24a74f1cf44
SHA512 b0139bc1df8236c18f503584cfb10be4b315cf44d65b448d061cd565ff854a4dff8731c0b8c06a58c01438263c0836cb2d143a2d759fef48e11090c3af3960f1
SSDEEP 192:vRWqDqlv71vzPRpLZ9IHsb+WNn3U0LkR0ewYHnaQ+VyIsnAUgE:vRWqeV5DXd2wk0YRzHaQ2E
TLSH
T13042C529AD50353B6CDBD32AF961BB53D7F5102661A42E80EAFC893C15EB9CC321B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9b584763-0ef5-4c17-8010-9ef0dfa55634.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\9b584763-0ef5-4c17-8010-9ef0dfa55634.tmp
Size 11KB
SHA256 9be26d06915598cc729a160caa29bc58f74b216317a0ac9441fcc42d1111d1a9
MD5 102117cfbc2bbb53e4226c0f610120dc
SHA1 fb816ac1eedb9efb254daef442e2c923a76fe109
SHA512 b6284f634d7c33775761f395f9b6ef2e22145b989b2747c0fd1fc7540fda64c045f2fc976f6d8beae20eedb27f46e9c64ba49caafedf216688ed0d1d4a6fda45
SSDEEP 192:el64K67/7KxkXqK4I40pUZNCgVLHrKHfFKslEz9LXzKD/Qj+ErUkKN9vVS27SS01:c6jY/7KxkXqKf/pUZNCgVLH2HfgslcLX
TLSH
T1A232D927A44D9A3F0FD8D50DCC12AF8BADF502527368092497FF9D14039A7CA214E5BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

082a918e-2558-42fe-9c7c-e7893a12fd89.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\082a918e-2558-42fe-9c7c-e7893a12fd89.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

0cec7591-3c8d-4507-8e5a-0c39a5a93d90.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\0cec7591-3c8d-4507-8e5a-0c39a5a93d90.tmp
Size 2KB
SHA256 318260d6857c49c2a09b6a25e3f82dc7198c7904dc1728c0697181c9aae0c9f3
MD5 ef313389b464f55542ea91bb311cab00
SHA1 7b7e4e088da52df0950414639f9e0252c3033e75
SHA512 9a6484dff3ac67a223f48ee2f4be261750a4b4092907b521295b4862e3cc2a7b6db7df0a84c10d79b551b6b95ffcba9583d526e42b2a4d42041fadeb4f44164f
TLSH
T14B519AF7C3D49A7E955556F49B21BE1FCD3D0A28131C3C2288E4AE1B53E28B2D25178E
MD5 SHA1 SHA512 TLSH

Submit Download

71db72bb-ff8b-42a7-a584-9f34ea9d9003.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\71db72bb-ff8b-42a7-a584-9f34ea9d9003.tmp
Size 3KB
SHA256 ded561490b70858c397c5ee5f1fd88107c6dd5871b2055c29b4f4833393dab4a
MD5 e76096f556b6296bf20cabec53f39349
SHA1 bf9e3d91151f20d382343055dc13aa8d09c00bf8
SHA512 0e2bb1b35cfb7768cfa0d528b6a5ecf7dc37b33e33afe7e99839eac9220e747abb1a1dbc7f46d7ac9ed106cf8d26ed2e6f19065b522edafddf5c43a245144621
TLSH
T1CF617BF7C3D48A7D895156F49B256E1FCE2D0A24132C3C62C9D4AE1B93E28B2D25174E
MD5 SHA1 SHA512 TLSH

Submit Download

d4faf3ba-5b80-462a-a5a4-04bd8aa480d5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d4faf3ba-5b80-462a-a5a4-04bd8aa480d5.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

eee480f1-d875-4055-9bd5-f3aa77960746.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\eee480f1-d875-4055-9bd5-f3aa77960746.tmp
Size 11KB
SHA256 e904f471fa3d5919957d1c46ea361426e3da400ed142dadbc06b6f288b5c89e6
MD5 ab76d068794de024efb87b7de5f030f0
SHA1 215f3e8f5b8cd8bcf5a6cc28c6cbf5e6ec81a87f
SHA512 6a9b833b8fdd1a78f5331efd48eedd6b29d7092a7dabec9a11e5b39755a7d4faa9e05e9f97390a5a53e9e16d66f2a9fb8677b1e8a36081b1143219be95dec205
SSDEEP 192:vRWqDqlv71vAPRp2Z9IHsb+WNn3U0kkR0ewYHnav+VyIsnAUge:vRWqeV56X62wk0tRzHav2e
TLSH
T1C032B329AE54753B6CDBC32AFA61B753D7F5102661942E80EAFC883C14EB9CC321B407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e761869e-93e4-421f-88aa-e6e748846288.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\e761869e-93e4-421f-88aa-e6e748846288.tmp
Size 269KB
SHA256 ca21e8704451cf55cc1baa49b1341433df368e5d9a7c00c83d4022d1c6a43ae2
MD5 17eea1b5e251de7ea6a51722280531e3
SHA1 58a8a093fbf7b8558ea0db9b07fe92bc3d40a97b
SHA512 f07273c7357aa1ac4897d0cc71918980ac24d3db087dc66e47b40a29bcb0c041f912516f076e0689eb0415e430a9372fc17a2e2466cb6bcacaea1684563a6c65
SSDEEP 6144:CWnOV/ve6wQswkOzyQYwGN+hFD+7t56OD9ZfSApprE:CWnORvf7slOzyQYwwyFSXD9ZfS4G
TLSH
T19844233269620D7B5A7D6201A26BE605DF753EE749D41B4C01866F8BE4DFC4A03B2E33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

63928d59-2fbf-4a3b-ba78-4f3e600f97e4.tmp

Path C:\Users\Admin\AppData\Local\Temp\63928d59-2fbf-4a3b-ba78-4f3e600f97e4.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3276-29-0x0000000009310000-0x00000000093B2000-memory.dmp

Download

memory/3276-23-0x0000000009310000-0x00000000093B2000-memory.dmp

Download

memory/3276-20-0x0000000009310000-0x00000000093B2000-memory.dmp

Download

memory/3276-16-0x0000000009310000-0x00000000093B2000-memory.dmp

Download

memory/3276-15-0x0000000009310000-0x00000000093B2000-memory.dmp

Download

memory/3276-13-0x0000000009310000-0x00000000093B2000-memory.dmp

Download

memory/3276-12-0x0000000009310000-0x00000000093B2000-memory.dmp

Download

memory/3276-32-0x0000000009310000-0x00000000093B2000-memory.dmp

Download

memory/3276-33-0x0000000009310000-0x00000000093B2000-memory.dmp

Download

memory/3276-26-0x0000000009310000-0x00000000093B2000-memory.dmp

Download

memory/3276-24-0x0000000009310000-0x00000000093B2000-memory.dmp

Download

memory/3276-22-0x0000000009310000-0x00000000093B2000-memory.dmp

Download

memory/3276-18-0x0000000009310000-0x00000000093B2000-memory.dmp

Download

memory/3276-17-0x0000000009310000-0x00000000093B2000-memory.dmp

Download

memory/3276-10-0x0000000009310000-0x00000000093B2000-memory.dmp

Download

memory/3276-9-0x0000000009310000-0x00000000093B2000-memory.dmp

Download

memory/3276-8-0x0000000009310000-0x00000000093B2000-memory.dmp

Download

memory/3276-21-0x0000000009310000-0x00000000093B2000-memory.dmp

Download

memory/3276-27-0x0000000009310000-0x00000000093B2000-memory.dmp

Download

memory/3276-28-0x0000000009310000-0x00000000093B2000-memory.dmp

Download

memory/3276-69-0x0000000009310000-0x00000000093B2000-memory.dmp

Download

memory/3276-72-0x0000000009310000-0x00000000093B2000-memory.dmp

Download

memory/3276-3-0x0000000009310000-0x00000000093B2000-memory.dmp

Download

memory/3276-31-0x0000000009310000-0x00000000093B2000-memory.dmp

Download

memory/3276-14-0x0000000009310000-0x00000000093B2000-memory.dmp

Download

memory/3276-11-0x0000000009310000-0x00000000093B2000-memory.dmp

Download

memory/3276-0-0x0000000009310000-0x00000000093B2000-memory.dmp

Download

memory/3276-1-0x0000000009310000-0x00000000093B2000-memory.dmp

Download

memory/3276-2-0x0000000009310000-0x00000000093B2000-memory.dmp

Download

memory/3276-4-0x0000000009310000-0x00000000093B2000-memory.dmp

Download

memory/3276-5-0x0000000009310000-0x00000000093B2000-memory.dmp

Download

memory/3276-7-0x0000000009310000-0x00000000093B2000-memory.dmp

Download

memory/3276-6-0x0000000009310000-0x00000000093B2000-memory.dmp

Download