43db1c8b806fcecdd4b752e8d093ff9c16c7ed7ee6333ff76807f2fe6c4c3ed4

Analysis

max time kernel
299s
max time network
300s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
31/10/2026, 23:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup_latest.exe
Size 16.8MB
Sample261031-216jysaf63
SHA256 43db1c8b806fcecdd4b752e8d093ff9c16c7ed7ee6333ff76807f2fe6c4c3ed4
MD5 9848d4ff3bc7bc943a3917bdf1fe2064
SHA1 5c603f43bc2efe5f4a73641a35a4887bbb6d6513
SHA512 9a29cdd6e0f6fa9dd4781150e452bd5fb0f8a4093e1e307e440deadf21ed7e21b8be91f99adb599f56bba570fb48caa5b082d8ab8294bff3e355894c6104e8ce
SSDEEP 393216:g/mf21cRxn2YD/c/ZUCFsafj2wWpraBUfmM2CZsg1N9Y34Ji:e421An2YLc/5FSvNayeM2CZssRJi
TLSH
T1E90733C87B0A6DFDED9D9D79C0865000C0622EAA57C861768F8D3B258B336CA79F5F50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence spyware

Malware Config

Signatures

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 16 IoCs

description	pid	Process	procid_target
PID 3112 set thread context of 1964	3112	Explorer.EXE	83
PID 3112 set thread context of 1964	3112	Explorer.EXE	83
PID 3112 set thread context of 1964	3112	Explorer.EXE	83
PID 3112 set thread context of 1964	3112	Explorer.EXE	83
PID 3112 set thread context of 1964	3112	Explorer.EXE	83
PID 3112 set thread context of 1964	3112	Explorer.EXE	83
PID 3112 set thread context of 1964	3112	Explorer.EXE	83
PID 3112 set thread context of 1964	3112	Explorer.EXE	83
PID 3112 set thread context of 1964	3112	Explorer.EXE	83
PID 3112 set thread context of 1964	3112	Explorer.EXE	83
PID 3112 set thread context of 1964	3112	Explorer.EXE	83
PID 3112 set thread context of 1964	3112	Explorer.EXE	83
PID 3112 set thread context of 1964	3112	Explorer.EXE	83
PID 3112 set thread context of 1964	3112	Explorer.EXE	83
PID 3112 set thread context of 1964	3112	Explorer.EXE	83
PID 3112 set thread context of 1964	3112	Explorer.EXE	83

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft SQL Server\friuftoord.txt	Setup_latest.exe
File opened for modification	C:\Program Files\LGHUB\uostsaiotz.inf	Explorer.EXE

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4540	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4077919521-2131189092-3796306753-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4077919521-2131189092-3796306753-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4077919521-2131189092-3796306753-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4077919521-2131189092-3796306753-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 54 IoCs

pid	Process
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
3112	Explorer.EXE
1964	chrome.exe
1964	chrome.exe
4852	chrome.exe
4852	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3112	Explorer.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1964	chrome.exe
Token: SeCreatePagefilePrivilege	1964	chrome.exe
Token: SeShutdownPrivilege	1964	chrome.exe
Token: SeCreatePagefilePrivilege	1964	chrome.exe
Token: SeShutdownPrivilege	1964	chrome.exe
Token: SeCreatePagefilePrivilege	1964	chrome.exe
Token: SeShutdownPrivilege	1964	chrome.exe
Token: SeCreatePagefilePrivilege	1964	chrome.exe
Token: SeShutdownPrivilege	1964	chrome.exe
Token: SeCreatePagefilePrivilege	1964	chrome.exe
Token: SeShutdownPrivilege	1964	chrome.exe
Token: SeCreatePagefilePrivilege	1964	chrome.exe
Token: SeShutdownPrivilege	3112	Explorer.EXE
Token: SeCreatePagefilePrivilege	3112	Explorer.EXE
Token: SeShutdownPrivilege	1964	chrome.exe
Token: SeCreatePagefilePrivilege	1964	chrome.exe
Token: SeShutdownPrivilege	1964	chrome.exe
Token: SeCreatePagefilePrivilege	1964	chrome.exe
Token: SeShutdownPrivilege	1964	chrome.exe
Token: SeCreatePagefilePrivilege	1964	chrome.exe
Token: SeShutdownPrivilege	1964	chrome.exe
Token: SeCreatePagefilePrivilege	1964	chrome.exe
Token: SeShutdownPrivilege	1964	chrome.exe
Token: SeCreatePagefilePrivilege	1964	chrome.exe
Token: SeShutdownPrivilege	1964	chrome.exe
Token: SeCreatePagefilePrivilege	1964	chrome.exe
Token: SeShutdownPrivilege	3112	Explorer.EXE
Token: SeCreatePagefilePrivilege	3112	Explorer.EXE
Token: SeShutdownPrivilege	3112	Explorer.EXE
Token: SeCreatePagefilePrivilege	3112	Explorer.EXE
Token: SeShutdownPrivilege	1964	chrome.exe
Token: SeCreatePagefilePrivilege	1964	chrome.exe
Token: SeShutdownPrivilege	1964	chrome.exe
Token: SeCreatePagefilePrivilege	1964	chrome.exe
Token: SeShutdownPrivilege	1964	chrome.exe
Token: SeCreatePagefilePrivilege	1964	chrome.exe
Token: SeShutdownPrivilege	1964	chrome.exe
Token: SeCreatePagefilePrivilege	1964	chrome.exe
Token: SeShutdownPrivilege	1964	chrome.exe
Token: SeCreatePagefilePrivilege	1964	chrome.exe
Token: SeShutdownPrivilege	1964	chrome.exe
Token: SeCreatePagefilePrivilege	1964	chrome.exe
Token: SeShutdownPrivilege	1964	chrome.exe
Token: SeCreatePagefilePrivilege	1964	chrome.exe
Token: SeShutdownPrivilege	3112	Explorer.EXE
Token: SeCreatePagefilePrivilege	3112	Explorer.EXE
Token: SeShutdownPrivilege	1964	chrome.exe
Token: SeCreatePagefilePrivilege	1964	chrome.exe
Token: SeShutdownPrivilege	1964	chrome.exe
Token: SeCreatePagefilePrivilege	1964	chrome.exe
Token: SeShutdownPrivilege	1964	chrome.exe
Token: SeCreatePagefilePrivilege	1964	chrome.exe
Token: SeShutdownPrivilege	1964	chrome.exe
Token: SeCreatePagefilePrivilege	1964	chrome.exe
Token: SeShutdownPrivilege	1964	chrome.exe
Token: SeCreatePagefilePrivilege	1964	chrome.exe
Token: SeShutdownPrivilege	1964	chrome.exe
Token: SeCreatePagefilePrivilege	1964	chrome.exe
Token: SeShutdownPrivilege	3112	Explorer.EXE
Token: SeCreatePagefilePrivilege	3112	Explorer.EXE
Token: SeShutdownPrivilege	1964	chrome.exe
Token: SeCreatePagefilePrivilege	1964	chrome.exe
Token: SeShutdownPrivilege	1964	chrome.exe
Token: SeCreatePagefilePrivilege	1964	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
3936	Setup_latest.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 3936 wrote to memory of 3112	3936	Setup_latest.exe	54
PID 3936 wrote to memory of 3112	3936	Setup_latest.exe	54
PID 3936 wrote to memory of 3112	3936	Setup_latest.exe	54
PID 3936 wrote to memory of 3112	3936	Setup_latest.exe	54
PID 3936 wrote to memory of 3112	3936	Setup_latest.exe	54
PID 3936 wrote to memory of 3112	3936	Setup_latest.exe	54
PID 1964 wrote to memory of 3904	1964	chrome.exe	84
PID 1964 wrote to memory of 3700	1964	chrome.exe	85
PID 1964 wrote to memory of 3700	1964	chrome.exe	85
PID 1964 wrote to memory of 4540	1964	chrome.exe	86
PID 1964 wrote to memory of 4768	1964	chrome.exe	90
PID 1964 wrote to memory of 4768	1964	chrome.exe	90
PID 1964 wrote to memory of 3292	1964	chrome.exe	89
PID 1964 wrote to memory of 3292	1964	chrome.exe	89
PID 1964 wrote to memory of 2528	1964	chrome.exe	88
PID 1964 wrote to memory of 2528	1964	chrome.exe	88
PID 1964 wrote to memory of 672	1964	chrome.exe	92
PID 1964 wrote to memory of 672	1964	chrome.exe	92
PID 1964 wrote to memory of 3784	1964	chrome.exe	93
PID 1964 wrote to memory of 3784	1964	chrome.exe	93
PID 1964 wrote to memory of 1232	1964	chrome.exe	94
PID 1964 wrote to memory of 1232	1964	chrome.exe	94
PID 1964 wrote to memory of 2944	1964	chrome.exe	95
PID 1964 wrote to memory of 3536	1964	chrome.exe	97
PID 1964 wrote to memory of 4956	1964	chrome.exe	98
PID 1964 wrote to memory of 4884	1964	chrome.exe	99
PID 1964 wrote to memory of 4852	1964	chrome.exe	100
PID 1964 wrote to memory of 3400	1964	chrome.exe	101
PID 1964 wrote to memory of 3400	1964	chrome.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3112
- C:\Users\Admin\AppData\Local\Temp\Setup_latest.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup_latest.exe"
  2⤵
  - Drops file in Program Files directory
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1964
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc5120c728,0x7ffc5120c734,0x7ffc5120c740
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3904
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1596,i,4546565760639018326,11717007649957676166,262144 --field-trial-handle=1936,i,7851805235241226734,9050209401776938991,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1932 /prefetch:2
    3⤵
    PID:3700
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1448,i,9832180572344793208,15339517344986721659,524288 --field-trial-handle=1936,i,7851805235241226734,9050209401776938991,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2056 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4540
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,18112539149930275513,15178639445749206421,524288 --field-trial-handle=1936,i,7851805235241226734,9050209401776938991,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2640 /prefetch:13
    3⤵
    PID:2528
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3164,i,15597054041445791944,13440104443279206091,2097152 --field-trial-handle=1936,i,7851805235241226734,9050209401776938991,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3216 /prefetch:1
    3⤵
    PID:3292
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3168,i,11117542800933828819,13927468606920084536,2097152 --field-trial-handle=1936,i,7851805235241226734,9050209401776938991,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3236 /prefetch:1
    3⤵
    PID:4768
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4504,i,18249369288914826006,14832687143490241093,2097152 --field-trial-handle=1936,i,7851805235241226734,9050209401776938991,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4484 /prefetch:1
    3⤵
    PID:672
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4644,i,9413405471474218086,118740572517938342,524288 --field-trial-handle=1936,i,7851805235241226734,9050209401776938991,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4660 /prefetch:14
    3⤵
    PID:3784
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4652,i,17537644750542866509,8856184387748976483,524288 --field-trial-handle=1936,i,7851805235241226734,9050209401776938991,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4812 /prefetch:14
    3⤵
    PID:1232
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5256,i,12218755612424162902,6418692851001048664,524288 --field-trial-handle=1936,i,7851805235241226734,9050209401776938991,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5220 /prefetch:14
    3⤵
    PID:2944
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5348,i,12760542805617702975,15035271676759873910,524288 --field-trial-handle=1936,i,7851805235241226734,9050209401776938991,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5256 /prefetch:14
    3⤵
    PID:3536
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5292,i,8584654709140383097,18160814217005844752,524288 --field-trial-handle=1936,i,7851805235241226734,9050209401776938991,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5536 /prefetch:14
    3⤵
    PID:4956
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5268,i,6107077659031657485,9138546390566601002,524288 --field-trial-handle=1936,i,7851805235241226734,9050209401776938991,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5572 /prefetch:14
    3⤵
    PID:4884
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5536,i,4330617135627124808,926959193841302586,262144 --field-trial-handle=1936,i,7851805235241226734,9050209401776938991,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5576 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4852
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5444,i,11333506347551125939,11947420713043549711,524288 --field-trial-handle=1936,i,7851805235241226734,9050209401776938991,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2848 /prefetch:14
    3⤵
    PID:3400

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3820

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

381c0790-345a-473e-b986-1367ebfda31f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\381c0790-345a-473e-b986-1367ebfda31f.tmp
Size 269KB
SHA256 c73a852afdff50bd9702f618bf8540346100cc3d8dd48eddc4ca543b2c436824
MD5 fbf0f7d9ec470f84c83b083c37ce121d
SHA1 c50b6ee05b859fb7eb07f468f9a94333bbf31f7d
SHA512 4c30b1758b978f85a7a89b409bdcf965b51ac336823e50e1f6915574bf8d567f6661d223b0212aa3aa73728a7506a08faac9cbeed209cfd65af1a74f2b5292ed
SSDEEP 6144:rkTl4HWhci2pWUxyq5pt4fLJ0L6nGJxi3bzqapJjM:rkTlCVyq5pWXUx8zvpJo
TLSH
T1604412F3A6D50D1BC77BD685847AAF4C0E31D8928D8E6DD801E98A9A25C87700C27F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3e77af92-f2b7-49c7-a09a-84f4d6578042.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\3e77af92-f2b7-49c7-a09a-84f4d6578042.tmp
Size 269KB
SHA256 1d9e4ff746e39738afb06e39fb79a8f55d41a45ae737ff13e4740f63d37ef266
MD5 038d53a6e8f97460ddb660d623d01e38
SHA1 1b1f943cdb5ad2c429f3b56244ae808ea0e12ecc
SHA512 472a4964a8fadd6df9b2542e42c76da2e20f86d806dff3685d9d30544981833c2223294ca34f5a8f3dad81737eed4692515d21a99a4a5b64775b8f452b671a50
SSDEEP 6144:YkTl4HWhci2pWUxyq5pt4fLJ0L6nGJxi3bzqapJjM:YkTlCVyq5pWXUx8zvpJo
TLSH
T1EA4412F3A6D50D1BC77BD685847AAF4C1E31D8928D8E6DD801E98A9A25C87700C27F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

61797ad6-bb35-4f35-87b3-af27419b16b0.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\61797ad6-bb35-4f35-87b3-af27419b16b0.tmp
Size 270KB
SHA256 c84a9a47c09e0b001a62203c85ef5f7af64722068daadee6f9c5a9d8cbe71dec
MD5 4ea56af3423c2dd57c219066663f4480
SHA1 cd0350db535c5112389d34330864f277ee15731d
SHA512 7a60d1917c706533cb6c0b715db95f988a70afbdbd290d833a1b021c360cb481a6bded101ef0d518a19d46e1e5e4b530ea6cce5cd62591b3146acfaf2418ddad
SSDEEP 6144:zgkTl4HWhci2pWUxyq5pt4fLJ0L6nGJxi3bzqapJjM:kkTlCVyq5pWXUx8zvpJo
TLSH
T13F4413F3A6950C1BCB7BDA89847ABE480E70D9928D8D7DD801E94D9A25C97700C27F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8c120849-157f-4a2e-b3af-0c2877baa79c.dmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\reports\8c120849-157f-4a2e-b3af-0c2877baa79c.dmp
Size 104KB
SHA256 f56808b0712575dd0e87035792c0fc9d389d739bb7e851a1a96acb7b1b3ed327
MD5 5ee56915d433410c11d7c4d12925909e
SHA1 8cf4ceb4c07bd7c082e0a86f6b4e9f90e0c7e1a3
SHA512 020217d3f4eb4576d0ba5bfcae2eb69cdab987b5d99825151e32516a05af60988534c30ffb60149a953a4292de279a32edccc407675922bece0e91b18f2961d0
SSDEEP 768:R3KLQK6HgcY/c2NYIK4QkX6ZhbcHUkFWhSY/lT3dnkJtZWOML:R4QcH/c2NYIK4QkGhkfkhSUkJAL
TLSH
T171A3B51293D58076F1A6CB3988D76722F7F2F4E3976A4B8B0619427A2C63350BF35E05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 5c33d81edb42b9bc60251921f9ff8379c84009189a411e2ab5f7e486385151ad
MD5 77a5d1dbcb66101d25a256b22dea17ee
SHA1 2e1aa94950db913a1f7c6a0f022d7bdf9991b1d2
SHA512 533d5fc30e3d04605c77ef4478f316f1cc48574400e8972924f241d4bc6d8af3f45ca16b7c0913da9b851a5ac8c273f0e99ce28e149dd5169c9a1c72344ed674
MD5 SHA1 SHA512

Submit Download

0d4c8678-1c02-4663-ae05-7d3bb0bedfdc.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0d4c8678-1c02-4663-ae05-7d3bb0bedfdc.tmp
Size 13KB
SHA256 183080ab87b58b695e03979ec4d826a874606e28a558a00578c46ede242e7bf3
MD5 39a15f899b72a397b11f40acfbc1cab5
SHA1 54ea4d4be93f1b6a15ebebef9ff229a0e0838199
SHA512 ae62798f9b7b81e80405e993f6a7544bedbadc35071157fe0803ce0777504d53675849ce53ae3c5baed5676cd4fd0e8f6fd749ac3f569ce5cb24b1aa748ea364
SSDEEP 384:FPjxk7KxkXqKf/pUZNCgVLH2Hfgsli2XODxM+ErU3ucHG4YiBknjE:F7xk7KxkXqKf/pUZNCgVLH2HfgsgcOdJ
TLSH
T13752F827684C9A7F4FC8CA8DE8536F4FADF50147A168093856FB9C0903957CE124A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9f9346df-b8cb-448c-ae59-af6a7f39821a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\9f9346df-b8cb-448c-ae59-af6a7f39821a.tmp
Size 12KB
SHA256 e25495101250a20b9eac43bc1956b0e62d3713e6e1acbd38d247190dec41860b
MD5 3319932c361f4dd9f004f2fa1b00c056
SHA1 38a150e79d9d936c6b8a9ff0edf4348e5da75983
SHA512 829f2e5c62904cfd31ef673e658eda5c83df9e2e35d20034b6d2d99d5ce6d47816feae152526191dc85536ddf0ada03879d020935434f24650c7322901f5c59d
SSDEEP 192:ThRwPRGSv7A3p6PRpcY9mHsb+WNnZR0ykG3/a4rmMf+VyIsnAUgraJ:ThRwPs+k3mXFgwb07Gvayf2e
TLSH
T10542E72DBD24397B6DDBC21AFA617B53D6F9102620912E94E6FC892C25E76CC221700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3fcbe04f-6cfb-47dd-ba08-ad4065ba83db.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\3fcbe04f-6cfb-47dd-ba08-ad4065ba83db.tmp
Size 2KB
SHA256 abda149bbb13a446b51c1361f685eb86b89112d0f8ce5e9a31e9b7f77ede22b0
MD5 fd64c6f4251a5f159b9bee8767f49d5e
SHA1 48eb1660bcf577c58e00c596a452b2a3a4d4debc
SHA512 47af0f15e5c606156cbaaa1bb62d4639b5bea4b9b89678e9ccd344dc817da534652d2bf68b26418d69b0a35e9a8dd5c2a6839af9d0c06c9813e3c99080a0d7e7
TLSH
T17551ABF7D3E48A7D891596F4DA216E2FCD3D1A28121C3C6689D4EE0B53F2972D20138E
MD5 SHA1 SHA512 TLSH

Submit Download

8e6649ab-da1d-4695-a764-e8d65c28a559.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\8e6649ab-da1d-4695-a764-e8d65c28a559.tmp
Size 2KB
SHA256 5f95d6a28436d3ba3488642a1dfdb07c30b3bf993756d463e3ccd26dfb633c5c
MD5 895d87b946a96592f8651672c7e19cef
SHA1 7efd7e9ba8027583d89c0d01d7b8e69f025e900a
SHA512 3091bbd876ace20878342a2b57127198d25f27c9592fdd34599352d377bda46bad63a72be60737206fe7a5a3ef328361544955b1e35563c6f9ed84780f699995
TLSH
T12441ACF7D3E4857D891596F4DA21AE2FCE3D1A28121C3C6689D4EE0B53F2972D20178E
MD5 SHA1 SHA512 TLSH

Submit Download

aa71186f-911c-497c-b1f8-324b41ba5aa5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\aa71186f-911c-497c-b1f8-324b41ba5aa5.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

e9b22311-c3fb-4b3f-8407-69097bfbb9a8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\e9b22311-c3fb-4b3f-8407-69097bfbb9a8.tmp
Size 2KB
SHA256 71bcb27cf2c87937348935f37686730b0fac5c36e8c978cc197fb29b1eb1d8ac
MD5 4199a5a229982f57e5efc75b906f8aa7
SHA1 af179a20999e6b97fe64961b0ea1b83af7ceffba
SHA512 cffd12f18c34866c3a1dcd199d8be6c8a4ee09de8ff4c28bee09ab29ed0e1fcca77cd2700b6ded5afc3a4d1b36e3848af4b4d1fa6adb15d66fdfc98b684ddc13
TLSH
T12A519BF7D3E48A7D851596F49A21AE2FCD3D1A28121C3C2289D4AE4B53F2972D20138E
MD5 SHA1 SHA512 TLSH

Submit Download

ebdf4d87-ab9a-46cb-84de-73f9b1c50c0f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ebdf4d87-ab9a-46cb-84de-73f9b1c50c0f.tmp
Size 11KB
SHA256 b49719b65d048a67344ca31a107c52bac92a70e5d35de13ca45c9623d94a4266
MD5 dda2857bee24b6558a764ae14fd473c1
SHA1 2e69ae50461c61e6d60d9dbcff80513904b40063
SHA512 c1d61592c64fee0c78d47e873a98ee6a2c6a035b92d5b4f68b38bc5e30254d7e326d6210a2afe3e0159524dbc455a43a443829ff4391423e91d687a1d61c5ede
SSDEEP 192:ThRwPRGSv7A3pAPRp2Y9mHsb+WNnZR0lkG3/a4rmHf+VyIsnAUgtaJ:ThRwPs+k3UXngwb0aGvaJf28
TLSH
T10C42E62DBD24797F6CDBC21AFA617B53D6F9102620912ED4E6FC882C25E75CC222740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f9c72098-2a5c-47fc-a3db-bd925ccaba35.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f9c72098-2a5c-47fc-a3db-bd925ccaba35.tmp
Size 414B
SHA256 3e4bd79e26649f6565d171c01b7607a4cba5051158a20d73479daee245f05d96
MD5 dc7502d774c5568df332ea80abd6f1c9
SHA1 2703086b6617fb2f5851b6c005f92c13ebf5aa43
SHA512 01379fc7d5cdcc4bcb005100880e11e47ce7d3043ff9a9778699d41f9e57ddf54c2819f1b223454e31a996d653be822209f884913ec09f9499d25f09f2ae078d
TLSH
T188E02B95D820AC373CFD0B9D5064074AEA10135B6A8197DF3A3CA5084F71A3B06C5C5C
MD5 SHA1 SHA512 TLSH

Submit Download

ff0382fc-960e-4fe7-8b9a-8788a11fa2fd.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ff0382fc-960e-4fe7-8b9a-8788a11fa2fd.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

e5bd7890-f8de-4769-b8f5-50b8e8c4d824.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\e5bd7890-f8de-4769-b8f5-50b8e8c4d824.tmp
Size 130KB
SHA256 c7c688a298f22b5aa2915eef742f52a80c894627913b289d1b82f4b4a7573558
MD5 498953566d6f1b0da3a999d2dd4cd9a4
SHA1 5622c86c33a6897eb11bddbaca62b4d7a7ba5fbb
SHA512 068897e65fcb3690468fccfc7a2cf21679cfca1dfc5f37ea5e7bf639dbd120b02596a7d09c1a21b0e9aabc0ff343a3bd2023824474237a22ca2ac6b9292c6297
SSDEEP 3072:mH2By3RJD4diWs9aJ0xN6nGvw8xUNTfd3OUhLHfS60ApJjv:Gt4fLJ0L6nGJxi3bzqapJjv
TLSH
T1A1D312F0C2A06C7ACBB7EE8145745E948EB1E5C689CDBE2004FD8C18068AA740D17EA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ee47ec13-b980-4abb-82d5-80f8e35fc1f2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ee47ec13-b980-4abb-82d5-80f8e35fc1f2.tmp
Size 270KB
SHA256 47f96046f4cd9612305a79034b2a307a8711e238048296753f1fd767e40da3fb
MD5 edba81ce6deb006e690b3ffc34cbc6cd
SHA1 6c504e114d07b40da616c0e6e61e34760be115d2
SHA512 437525e6f7b19832b8786cc8682ed998c219603fd22c0a2543032cbe47551392ce74c1d1532dd02b806189b8fcb6bba66efd53ba71eca4a23805509730cdfc19
SSDEEP 6144:fgkTl4HWhci2pWUxyq5pt4fLJ0L6nGJxi3bzqapJjM:IkTlCVyq5pWXUx8zvpJo
TLSH
T1394413F3A6950C1BCB7BDA89847ABE480E70D9928D8D7DD801E94D9A25C97700C27F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3112-10-0x0000000004B90000-0x0000000004C3D000-memory.dmp

Download

memory/3112-26-0x0000000004B90000-0x0000000004C3D000-memory.dmp

Download

memory/3112-18-0x0000000004B90000-0x0000000004C3D000-memory.dmp

Download

memory/3112-14-0x0000000004B90000-0x0000000004C3D000-memory.dmp

Download

memory/3112-13-0x0000000004B90000-0x0000000004C3D000-memory.dmp

Download

memory/3112-2-0x0000000004B90000-0x0000000004C3D000-memory.dmp

Download

memory/3112-9-0x0000000004B90000-0x0000000004C3D000-memory.dmp

Download

memory/3112-16-0x0000000004B90000-0x0000000004C3D000-memory.dmp

Download

memory/3112-17-0x0000000004B90000-0x0000000004C3D000-memory.dmp

Download

memory/3112-11-0x0000000004B90000-0x0000000004C3D000-memory.dmp

Download

memory/3112-21-0x0000000004B90000-0x0000000004C3D000-memory.dmp

Download

memory/3112-23-0x0000000004B90000-0x0000000004C3D000-memory.dmp

Download

memory/3112-32-0x0000000004B90000-0x0000000004C3D000-memory.dmp

Download

memory/3112-71-0x0000000004B90000-0x0000000004C3D000-memory.dmp

Download

memory/3112-25-0x0000000004B90000-0x0000000004C3D000-memory.dmp

Download

memory/3112-19-0x0000000004B90000-0x0000000004C3D000-memory.dmp

Download

memory/3112-84-0x0000000004B90000-0x0000000004C3D000-memory.dmp

Download

memory/3112-27-0x0000000004B90000-0x0000000004C3D000-memory.dmp

Download

memory/3112-28-0x0000000004B90000-0x0000000004C3D000-memory.dmp

Download

memory/3112-31-0x0000000004B90000-0x0000000004C3D000-memory.dmp

Download

memory/3112-12-0x0000000004B90000-0x0000000004C3D000-memory.dmp

Download

memory/3112-8-0x0000000004B90000-0x0000000004C3D000-memory.dmp

Download

memory/3112-0-0x0000000004B90000-0x0000000004C3D000-memory.dmp

Download

memory/3112-1-0x0000000004B90000-0x0000000004C3D000-memory.dmp

Download

memory/3112-153-0x0000000004B90000-0x0000000004C3D000-memory.dmp

Download

memory/3112-3-0x0000000004B90000-0x0000000004C3D000-memory.dmp

Download

memory/3112-4-0x0000000004B90000-0x0000000004C3D000-memory.dmp

Download

memory/3112-5-0x0000000004B90000-0x0000000004C3D000-memory.dmp

Download

memory/3112-7-0x0000000004B90000-0x0000000004C3D000-memory.dmp

Download

memory/3112-6-0x0000000004B90000-0x0000000004C3D000-memory.dmp

Download