bb0bc290151a1ef77e991824eddd79bc30ceb724b6882d3f263814ebeff89baa

Analysis

max time kernel
150s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 02:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe
Size 608KB
Sample261027-ct5lmsce29
SHA256 bb0bc290151a1ef77e991824eddd79bc30ceb724b6882d3f263814ebeff89baa
MD5 f3a52ef1e498c22c5212864cc2e7852e
SHA1 c996c9421803c3cec691023ff72d0cfac604fd9f
SHA512 58f9ab0dade7c01b0f392e78c89cf2d78c5a49489c5229fc8c6a784362730b32ad04c09a1715d4ae373b45eaad34463e0149af0c572d47189e465387fb9f57c5
SSDEEP 12288:B4XxTz+vz72mnrWpcY+cvvaT55gFWlsljt9N9CQ0m:BsxTz+Upc14vmPgHJh0m
TLSH
T15FD43A43F6A242DCD02AC97583599133F6743C4D5A30BA7F67906B651F36BA0EB2DB08
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 32 IoCs

description	pid	Process	procid_target
PID 2632 set thread context of 1564	2632	2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe	85
PID 2632 set thread context of 1564	2632	2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe	85
PID 2632 set thread context of 1564	2632	2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe	85
PID 2632 set thread context of 1564	2632	2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe	85
PID 2632 set thread context of 1564	2632	2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe	85
PID 2632 set thread context of 1564	2632	2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe	85
PID 2632 set thread context of 1564	2632	2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe	85
PID 2632 set thread context of 1564	2632	2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe	85
PID 2632 set thread context of 1564	2632	2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe	85
PID 2632 set thread context of 1564	2632	2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe	85
PID 2632 set thread context of 1564	2632	2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe	85
PID 2632 set thread context of 1564	2632	2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe	85
PID 2632 set thread context of 1564	2632	2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe	85
PID 2632 set thread context of 1564	2632	2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe	85
PID 2632 set thread context of 1564	2632	2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe	85
PID 2632 set thread context of 1564	2632	2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe	85
PID 2632 set thread context of 1564	2632	2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe	85
PID 2632 set thread context of 1564	2632	2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe	85
PID 2632 set thread context of 1564	2632	2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe	85
PID 2632 set thread context of 1564	2632	2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe	85
PID 2632 set thread context of 1564	2632	2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe	85
PID 2632 set thread context of 1564	2632	2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe	85
PID 2632 set thread context of 1564	2632	2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe	85
PID 2632 set thread context of 1564	2632	2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe	85
PID 2632 set thread context of 1564	2632	2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe	85
PID 2632 set thread context of 1564	2632	2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe	85
PID 2632 set thread context of 1564	2632	2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe	85
PID 2632 set thread context of 1564	2632	2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe	85
PID 2632 set thread context of 1564	2632	2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe	85
PID 2632 set thread context of 1564	2632	2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe	85
PID 2632 set thread context of 1564	2632	2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe	85
PID 2632 set thread context of 1564	2632	2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe	85

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\algerian\eortsaxeum.txt	2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe
File opened for modification	C:\Program Files\thesis\ulsauerg.cfg	2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5044	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 40 IoCs

pid	Process
2632	2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe
2632	2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe
2632	2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe
2632	2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe
2632	2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe
2632	2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe
2632	2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe
2632	2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe
2632	2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe
2632	2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe
2632	2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe
2632	2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe
2632	2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe
2632	2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe
2632	2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe
2632	2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe
2632	2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe
2632	2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe
2632	2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe
2632	2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe
2632	2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe
1564	chrome.exe
1564	chrome.exe
1564	chrome.exe
2632	2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe
2632	2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe
2632	2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe
2632	2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe
2632	2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe
2632	2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe
2632	2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe
2632	2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe
2632	2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe
2632	2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe
2632	2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe
2632	2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe
1564	chrome.exe
1564	chrome.exe
2928	chrome.exe
2928	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1564	chrome.exe
1564	chrome.exe
1564	chrome.exe
1564	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1564	chrome.exe
Token: SeCreatePagefilePrivilege	1564	chrome.exe
Token: SeShutdownPrivilege	1564	chrome.exe
Token: SeCreatePagefilePrivilege	1564	chrome.exe
Token: SeShutdownPrivilege	1564	chrome.exe
Token: SeCreatePagefilePrivilege	1564	chrome.exe
Token: SeShutdownPrivilege	1564	chrome.exe
Token: SeCreatePagefilePrivilege	1564	chrome.exe
Token: SeShutdownPrivilege	1564	chrome.exe
Token: SeCreatePagefilePrivilege	1564	chrome.exe
Token: SeShutdownPrivilege	1564	chrome.exe
Token: SeCreatePagefilePrivilege	1564	chrome.exe
Token: SeShutdownPrivilege	1564	chrome.exe
Token: SeCreatePagefilePrivilege	1564	chrome.exe
Token: SeShutdownPrivilege	1564	chrome.exe
Token: SeCreatePagefilePrivilege	1564	chrome.exe
Token: SeShutdownPrivilege	1564	chrome.exe
Token: SeCreatePagefilePrivilege	1564	chrome.exe
Token: SeShutdownPrivilege	1564	chrome.exe
Token: SeCreatePagefilePrivilege	1564	chrome.exe
Token: SeShutdownPrivilege	1564	chrome.exe
Token: SeCreatePagefilePrivilege	1564	chrome.exe
Token: SeShutdownPrivilege	1564	chrome.exe
Token: SeCreatePagefilePrivilege	1564	chrome.exe
Token: SeShutdownPrivilege	1564	chrome.exe
Token: SeCreatePagefilePrivilege	1564	chrome.exe
Token: SeShutdownPrivilege	1564	chrome.exe
Token: SeCreatePagefilePrivilege	1564	chrome.exe
Token: SeShutdownPrivilege	1564	chrome.exe
Token: SeCreatePagefilePrivilege	1564	chrome.exe
Token: SeShutdownPrivilege	1564	chrome.exe
Token: SeCreatePagefilePrivilege	1564	chrome.exe
Token: SeShutdownPrivilege	1564	chrome.exe
Token: SeCreatePagefilePrivilege	1564	chrome.exe
Token: SeShutdownPrivilege	1564	chrome.exe
Token: SeCreatePagefilePrivilege	1564	chrome.exe
Token: SeShutdownPrivilege	1564	chrome.exe
Token: SeCreatePagefilePrivilege	1564	chrome.exe
Token: SeShutdownPrivilege	1564	chrome.exe
Token: SeCreatePagefilePrivilege	1564	chrome.exe
Token: SeShutdownPrivilege	1564	chrome.exe
Token: SeCreatePagefilePrivilege	1564	chrome.exe
Token: SeShutdownPrivilege	1564	chrome.exe
Token: SeCreatePagefilePrivilege	1564	chrome.exe
Token: SeShutdownPrivilege	1564	chrome.exe
Token: SeCreatePagefilePrivilege	1564	chrome.exe
Token: SeShutdownPrivilege	1564	chrome.exe
Token: SeCreatePagefilePrivilege	1564	chrome.exe
Token: SeShutdownPrivilege	1564	chrome.exe
Token: SeCreatePagefilePrivilege	1564	chrome.exe
Token: SeShutdownPrivilege	1564	chrome.exe
Token: SeCreatePagefilePrivilege	1564	chrome.exe
Token: SeShutdownPrivilege	1564	chrome.exe
Token: SeCreatePagefilePrivilege	1564	chrome.exe
Token: SeShutdownPrivilege	1564	chrome.exe
Token: SeCreatePagefilePrivilege	1564	chrome.exe
Token: SeShutdownPrivilege	1564	chrome.exe
Token: SeCreatePagefilePrivilege	1564	chrome.exe
Token: SeShutdownPrivilege	1564	chrome.exe
Token: SeCreatePagefilePrivilege	1564	chrome.exe
Token: SeShutdownPrivilege	1564	chrome.exe
Token: SeCreatePagefilePrivilege	1564	chrome.exe
Token: SeShutdownPrivilege	1564	chrome.exe
Token: SeCreatePagefilePrivilege	1564	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1564	chrome.exe
1564	chrome.exe
1564	chrome.exe
1564	chrome.exe
1564	chrome.exe
1564	chrome.exe
1564	chrome.exe
1564	chrome.exe
1564	chrome.exe
1564	chrome.exe
1564	chrome.exe
1564	chrome.exe
1564	chrome.exe
1564	chrome.exe
1564	chrome.exe
1564	chrome.exe
1564	chrome.exe
1564	chrome.exe
1564	chrome.exe
1564	chrome.exe
1564	chrome.exe
1564	chrome.exe
1564	chrome.exe
1564	chrome.exe
1564	chrome.exe
1564	chrome.exe
1564	chrome.exe
1564	chrome.exe
1564	chrome.exe
1564	chrome.exe
1564	chrome.exe
1564	chrome.exe
1564	chrome.exe
1564	chrome.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1564 wrote to memory of 4216	1564	chrome.exe	86
PID 1564 wrote to memory of 3524	1564	chrome.exe	87
PID 1564 wrote to memory of 3524	1564	chrome.exe	87
PID 1564 wrote to memory of 5044	1564	chrome.exe	88
PID 1564 wrote to memory of 2760	1564	chrome.exe	89
PID 1564 wrote to memory of 2760	1564	chrome.exe	89
PID 1564 wrote to memory of 2484	1564	chrome.exe	90
PID 1564 wrote to memory of 3340	1564	chrome.exe	91
PID 1564 wrote to memory of 2484	1564	chrome.exe	90
PID 1564 wrote to memory of 3340	1564	chrome.exe	91
PID 1564 wrote to memory of 4992	1564	chrome.exe	93
PID 1564 wrote to memory of 4992	1564	chrome.exe	93
PID 1564 wrote to memory of 4228	1564	chrome.exe	94
PID 1564 wrote to memory of 4228	1564	chrome.exe	94
PID 1564 wrote to memory of 3292	1564	chrome.exe	97
PID 1564 wrote to memory of 3964	1564	chrome.exe	105
PID 1564 wrote to memory of 5064	1564	chrome.exe	106
PID 1564 wrote to memory of 5108	1564	chrome.exe	107
PID 1564 wrote to memory of 2928	1564	chrome.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_f3a52ef1e498c22c5212864cc2e7852e_cobalt-strike_icedid_ryuk.exe"
1⤵
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:2632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1564
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffa3013c728,0x7ffa3013c734,0x7ffa3013c740
    3⤵
    PID:4216
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1668,i,15056947064512054722,10617892443781270100,262144 --field-trial-handle=1992,i,3846247405861208549,18008730681692033947,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1984 /prefetch:2
    3⤵
    PID:3524
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2248,i,11366223618781408064,15144707900117271205,524288 --field-trial-handle=1992,i,3846247405861208549,18008730681692033947,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2252 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5044
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2376,i,17137677772652666979,1641648260316031755,524288 --field-trial-handle=1992,i,3846247405861208549,18008730681692033947,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2296 /prefetch:8
    3⤵
    PID:2760
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3168,i,10768592934398938331,17235138716036051583,2097152 --field-trial-handle=1992,i,3846247405861208549,18008730681692033947,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3172 /prefetch:1
    3⤵
    PID:2484
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3192,i,1342645081595281102,11930670714850945690,2097152 --field-trial-handle=1992,i,3846247405861208549,18008730681692033947,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3216 /prefetch:1
    3⤵
    PID:3340
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4244,i,7254733865280889412,14046240118326020560,2097152 --field-trial-handle=1992,i,3846247405861208549,18008730681692033947,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4268 /prefetch:2
    3⤵
    PID:4992
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4604,i,4818565644081217211,14313570771556932152,2097152 --field-trial-handle=1992,i,3846247405861208549,18008730681692033947,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4624 /prefetch:1
    3⤵
    PID:4228
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5356,i,6986922602382120374,35382189228682046,524288 --field-trial-handle=1992,i,3846247405861208549,18008730681692033947,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5364 /prefetch:8
    3⤵
    PID:3292
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5640,i,4024140113190147183,18324308942802556249,524288 --field-trial-handle=1992,i,3846247405861208549,18008730681692033947,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5428 /prefetch:8
    3⤵
    PID:3964
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5740,i,513465330232601072,17437511019586552955,524288 --field-trial-handle=1992,i,3846247405861208549,18008730681692033947,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5676 /prefetch:8
    3⤵
    PID:5064
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5416,i,17550867392326463912,7882207142815198301,524288 --field-trial-handle=1992,i,3846247405861208549,18008730681692033947,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5668 /prefetch:8
    3⤵
    PID:5108
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5296,i,5499789980040377988,3616059363402827036,262144 --field-trial-handle=1992,i,3846247405861208549,18008730681692033947,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=836 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2928

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

011b510e-bd2a-420a-877e-a6e5b93e2f8b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\011b510e-bd2a-420a-877e-a6e5b93e2f8b.tmp
Size 270KB
SHA256 c8a8ee80fc1a91949a693100e59ff2c67778f0297de1d8bbc25a3d909141aaba
MD5 a83464f0dc37ac04c4680e6da0595238
SHA1 f336b3af8bd847e2a240e08d7b2c24e279b04818
SHA512 6d1fa22aba9ff2da80891cf7db0df4c663ee654bd5102b52223b70b9a97b28c40498a43825053768b111ec1d464a0a4072469637419d81d8a47391e5499ef994
SSDEEP 6144:SFHhYbFusKYrxbyvK3uWEPr+hFD+7t56OD9ZfSApprL:MbsKcbyvyIryFSXD9ZfS4N
TLSH
T1D34423367650BC77C7FA9701E0077B06CE7AD9DE82C9446881456E8BA05F91E0BF3D62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0a1fe854-f779-4627-8896-f95c55da6bcc.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\0a1fe854-f779-4627-8896-f95c55da6bcc.tmp
Size 130KB
SHA256 a69f6a0aff113d6d8f653643c799816a95677fbc9dd723b6f458a3aa6e88f24e
MD5 866909132ce2d4b23908036e9c2d798a
SHA1 8a219d5e49ea7a5f98902d7d27e9b47551c3bef2
SHA512 bb5e58bf1f7c5414aed57d74c665448d5a5cb0f61350e7082be64f37e100701a2dbe13dadea314f38dea26a044cd18d50fe25918514e337ee1c2f2d02b509aae
SSDEEP 3072:e+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+g2:e+hFD+7t56OD9ZfSAppr2
TLSH
T1EFD31232AA91D8BB89FC6541B157A304DE62ACED81DE3A0944495F8EE09FC4D0773A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

05bb67e7-bae5-4a47-ab70-8ac40187d07a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\05bb67e7-bae5-4a47-ab70-8ac40187d07a.tmp
Size 414B
SHA256 12468ff22db4b1f16ca4d52fc47502a99f976d11c17acdd37bdf61e6999536b6
MD5 2f6359e213dc520783515af48724dd33
SHA1 0bd09be1abac75c3df723d5c1f60b8b51184fbf9
SHA512 07f12c31fa06b672e8cdd840331c7ac72a6e0fa55bd006b05532167cdbe8732b922d5da99870c12165a7ed5e759e77fb3a99ee9bae3775e48b82295e952b764f
TLSH
T173E02BEACA23EC273CFE0B6A1050064AEB4513572E41494F3F3D41088FF163702C596C
MD5 SHA1 SHA512 TLSH

Submit Download

451fc834-4314-4d22-a181-e67ceddbd3ff.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\451fc834-4314-4d22-a181-e67ceddbd3ff.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

5cd8b1d3-660a-4d08-aa4d-5e1eb515af27.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\5cd8b1d3-660a-4d08-aa4d-5e1eb515af27.tmp
Size 12KB
SHA256 584295257599299b38499c3f32cd9049e23a1e49c703ee40623c590373f9758a
MD5 3fa1888585b1943ca67af18724091d85
SHA1 6e0bddcc6500e0426e602816785528f6dc030465
SHA512 0375cb088e85897c8d0effd682c1377c5f3e1cdbceab746247a8bc6cf753adb2e130799165f0eec00853658461b14ba7141bc7fb239a8f93b414a6d1ee8966b6
SSDEEP 192:NuRu9z0rqxmGv7+pAPRp289THsb+WNnOL04ger2KMaLVyIsnAUgtaJ:URu9pPaUX79wY0I2xaN8
TLSH
T19942852DBE60797B5CEBC32AEA217B57D7F9103161942E84E6FC892C15EB5CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

75e680ca-97d3-4903-b7a7-fe3012c9039c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\75e680ca-97d3-4903-b7a7-fe3012c9039c.tmp
Size 17KB
SHA256 f7e0a7036b9bf87d18941afe0a0039bacd2a6a85b55115963a1d3bb3d3d25ed8
MD5 f5dea701d1a456a3a13710f824722a0b
SHA1 61f3bdb433c2dbd53fdfbd02fb2c0b467fc8f51a
SHA512 57ad41f970191f2aefbe4c358b9171c2932649453a5d90e4b2377a9c358a9d2f45247433f41a6836a315424d66459abb42a476e472641e65c9e0855795e04ac4
SSDEEP 384:nNjzO7KxkXqKf/pUZNCgVLH2HfgslYk7pLuLceSZkXODzq+ErU3yTHG3E5TZ64:nNzO7KxkXqKf/pUZNCgVLH2Hfgsik7p6
TLSH
T17A72F9A7BC4C9E3B4FE4C99CDC167B4FADB5024755E9886442FA582903C5BCB11062FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8737834a-8609-47aa-b12d-3e18dc6eb22d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\8737834a-8609-47aa-b12d-3e18dc6eb22d.tmp
Size 2KB
SHA256 85d39e5b5db6fb42a817373e36edff737fbfa8c0e30833bcf3f15ea6e541619a
MD5 d3f335630d460cf6efb29be6e0516547
SHA1 b56d158bbd2a2587788fc7bf511554ab4aa1ae2f
SHA512 51e882fb7287b67c71dbbc6c6ff558f5a9be936d351c888f9c54aed15d200256d767ed1390a95ec82a7da46f32ec09ae4654a1b7dd2be7280352d93820270a60
TLSH
T19D518DF7D3E8856EC51156F49A216E1FCD7D0A14132C3C6289D8AE5B53F2972D24138E
MD5 SHA1 SHA512 TLSH

Submit Download

95ff4619-e11b-4ca9-971c-39ad0031264c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\95ff4619-e11b-4ca9-971c-39ad0031264c.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 f073877ed2f9e2d2750f14a0042e3f670cf40d955ae7dc029837dd1057ea21dd
MD5 48fbbb3e1c5eca7a6305b1d537395dfe
SHA1 24a04d94228e8fd4e2fc20ce48f117d9fc5e3ccd
SHA512 ef48687cff80f5e17b7fa4a0fd881520fcacc4150d88b200d61c5c1f32f7ee9ce672fca3631b22fd561ec03220e79fcade8f9ef89cad3abc9f413602382113dd
TLSH
T1F6B0120C80815312C84206B015B1689837A49F11A605274941F02E12C835161801B095
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 23ff10539f147f79514a4ef07e7258353ca14a132b9869640d812276f8ccafea
MD5 94490fd91cb9ca24e326af3b2afa797d
SHA1 65b02f5ec84ddf5669e7478bc431993eeff95682
SHA512 6f94ef66cc36ba20144bda9454ac502859877b19f95cd5381ebd620a77aa7562afaec4c4af9d8bed6e9a4eb5ea510806ababdcc065a776816ac54986da7e198a
TLSH
T1C0B02220C2822202C00203B8228080E8B030EF20C3032302C2F02E33CCB82300A32020
MD5 SHA1 SHA512 TLSH

Submit Download

d048beec-aec6-43a7-95f7-16e9723a7e83.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\d048beec-aec6-43a7-95f7-16e9723a7e83.tmp
Size 269KB
SHA256 4f3a6a3b7c4c4465587d6097be002ee6f93d9b706b31bfd553f2ac7455b1408b
MD5 94b8c1ba0fe3737038aa98e96ef26dd3
SHA1 a1a2cc73af20354035ed1533d56ccd8842e5b228
SHA512 2a298c5eece064f5322db61349c6855baddd9fff9c9452c75d3106bea0400d65c2a76b8730c90915ee9d24b56fa1951295e56bdcd36f9eb4ba4baba9a991fde2
SSDEEP 6144:G5RHhYbFusKYrxbyvK3uWEPr+hFD+7t56OD9ZfSApprL:G5RbsKcbyvyIryFSXD9ZfS4N
TLSH
T1284423267250BC77C7FA9701E0077B06DE7A9DD881CA40658245AECBA19F94E0BF3D63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ef394541-b541-45af-950b-22c0876e3b0c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ef394541-b541-45af-950b-22c0876e3b0c.tmp
Size 269KB
SHA256 950d258f4291c3a00a2f3a614527cc4c6d12e13b8bc70f48ca5c671d9899283d
MD5 38792f6b630872fb64b38d7fa00647c1
SHA1 51db0856a4046cd41a8073b69c8bdb8d7f82b2c9
SHA512 4bcd144fd16d825c6b3c9a7bfe33ed9c6cbe92910f496d3b050a7a5033592bd5b81bd35572606b689ebd2e83a5c0cc1d29b456ef85756d2cb845b4c82073baa8
SSDEEP 6144:D5RHhYbFusKYrxbyvK3uWEPr+hFD+7t56OD9ZfSApprL:D5RbsKcbyvyIryFSXD9ZfS4N
TLSH
T1DF4423267250BC77C7FA9701E0077B06DE7A9DD881CA40658245AECBA19F94E0BF3D63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download