6f4ccc1718eddb12fab554f0c19e908f0486fd734bb02c706534ad92860d5df2

Analysis

max time kernel
300s
max time network
300s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
14/11/2026, 01:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 703KB
Sample261114-cd8ncsby2x
SHA256 6f4ccc1718eddb12fab554f0c19e908f0486fd734bb02c706534ad92860d5df2
MD5 5fff315917c102d44430d45cdb48c926
SHA1 194f4b38b5cd11c5115af97b46156c156286d661
SHA512 d57b40096589e3045490fae3f631dc8029602d25ef2b90a8a4fa8dec803943bbd9e3979a168eadd551f52b3d07121d9f35368127b96c254c7339bbef4b262db0
SSDEEP 12288:eDksJMjSezLbXkOivYmuaT3OVEVYkbY0EO8me+xk0ZUOEyMt6AcU:WJqSjOKBuVQls0Cm2OctrcU
TLSH
T152E4F1A2F69A89FCD027C13886125502FA797C15472069FB5384AB7E1F366D6CF3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery spyware

Malware Config

Signatures

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 8 IoCs

description	pid	Process	procid_target
PID 3144 set thread context of 668	3144	Explorer.EXE	82
PID 3144 set thread context of 668	3144	Explorer.EXE	82
PID 3144 set thread context of 668	3144	Explorer.EXE	82
PID 3144 set thread context of 668	3144	Explorer.EXE	82
PID 3144 set thread context of 668	3144	Explorer.EXE	82
PID 3144 set thread context of 668	3144	Explorer.EXE	82
PID 3144 set thread context of 668	3144	Explorer.EXE	82
PID 3144 set thread context of 668	3144	Explorer.EXE	82

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\relish\screuhlendash.dat	Explorer.EXE
File opened for modification	C:\Program Files (x86)\bulbous\uiehlairr.inf	Explorer.EXE
File opened for modification	C:\Program Files\nodejs\aiadsoidy.inf	Explorer.EXE

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1596	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
668	chrome.exe
668	chrome.exe
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
668	chrome.exe
668	chrome.exe
4332	chrome.exe
4332	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3144	Explorer.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
668	chrome.exe
668	chrome.exe
668	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	668	chrome.exe
Token: SeCreatePagefilePrivilege	668	chrome.exe
Token: SeShutdownPrivilege	668	chrome.exe
Token: SeCreatePagefilePrivilege	668	chrome.exe
Token: SeShutdownPrivilege	668	chrome.exe
Token: SeCreatePagefilePrivilege	668	chrome.exe
Token: SeShutdownPrivilege	668	chrome.exe
Token: SeCreatePagefilePrivilege	668	chrome.exe
Token: SeShutdownPrivilege	668	chrome.exe
Token: SeCreatePagefilePrivilege	668	chrome.exe
Token: SeShutdownPrivilege	668	chrome.exe
Token: SeCreatePagefilePrivilege	668	chrome.exe
Token: SeShutdownPrivilege	3144	Explorer.EXE
Token: SeCreatePagefilePrivilege	3144	Explorer.EXE
Token: SeShutdownPrivilege	3144	Explorer.EXE
Token: SeCreatePagefilePrivilege	3144	Explorer.EXE
Token: SeShutdownPrivilege	668	chrome.exe
Token: SeCreatePagefilePrivilege	668	chrome.exe
Token: SeShutdownPrivilege	668	chrome.exe
Token: SeCreatePagefilePrivilege	668	chrome.exe
Token: SeShutdownPrivilege	668	chrome.exe
Token: SeCreatePagefilePrivilege	668	chrome.exe
Token: SeShutdownPrivilege	668	chrome.exe
Token: SeCreatePagefilePrivilege	668	chrome.exe
Token: SeShutdownPrivilege	668	chrome.exe
Token: SeCreatePagefilePrivilege	668	chrome.exe
Token: SeShutdownPrivilege	668	chrome.exe
Token: SeCreatePagefilePrivilege	668	chrome.exe
Token: SeShutdownPrivilege	668	chrome.exe
Token: SeCreatePagefilePrivilege	668	chrome.exe
Token: SeShutdownPrivilege	3144	Explorer.EXE
Token: SeCreatePagefilePrivilege	3144	Explorer.EXE
Token: SeShutdownPrivilege	668	chrome.exe
Token: SeCreatePagefilePrivilege	668	chrome.exe
Token: SeShutdownPrivilege	668	chrome.exe
Token: SeCreatePagefilePrivilege	668	chrome.exe
Token: SeShutdownPrivilege	668	chrome.exe
Token: SeCreatePagefilePrivilege	668	chrome.exe
Token: SeShutdownPrivilege	668	chrome.exe
Token: SeCreatePagefilePrivilege	668	chrome.exe
Token: SeShutdownPrivilege	668	chrome.exe
Token: SeCreatePagefilePrivilege	668	chrome.exe
Token: SeShutdownPrivilege	668	chrome.exe
Token: SeCreatePagefilePrivilege	668	chrome.exe
Token: SeShutdownPrivilege	3144	Explorer.EXE
Token: SeCreatePagefilePrivilege	3144	Explorer.EXE
Token: SeShutdownPrivilege	3144	Explorer.EXE
Token: SeCreatePagefilePrivilege	3144	Explorer.EXE
Token: SeShutdownPrivilege	668	chrome.exe
Token: SeCreatePagefilePrivilege	668	chrome.exe
Token: SeShutdownPrivilege	668	chrome.exe
Token: SeCreatePagefilePrivilege	668	chrome.exe
Token: SeShutdownPrivilege	668	chrome.exe
Token: SeCreatePagefilePrivilege	668	chrome.exe
Token: SeShutdownPrivilege	668	chrome.exe
Token: SeCreatePagefilePrivilege	668	chrome.exe
Token: SeShutdownPrivilege	668	chrome.exe
Token: SeCreatePagefilePrivilege	668	chrome.exe
Token: SeShutdownPrivilege	668	chrome.exe
Token: SeCreatePagefilePrivilege	668	chrome.exe
Token: SeShutdownPrivilege	668	chrome.exe
Token: SeCreatePagefilePrivilege	668	chrome.exe
Token: SeShutdownPrivilege	3144	Explorer.EXE
Token: SeCreatePagefilePrivilege	3144	Explorer.EXE

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
3304	Setup.exe
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
668	chrome.exe
668	chrome.exe
668	chrome.exe
668	chrome.exe
668	chrome.exe
668	chrome.exe
668	chrome.exe
668	chrome.exe
668	chrome.exe
668	chrome.exe
668	chrome.exe
668	chrome.exe
668	chrome.exe
668	chrome.exe
668	chrome.exe
668	chrome.exe
668	chrome.exe
668	chrome.exe
668	chrome.exe
668	chrome.exe
668	chrome.exe
668	chrome.exe
668	chrome.exe
668	chrome.exe
668	chrome.exe
668	chrome.exe
668	chrome.exe
668	chrome.exe
668	chrome.exe
668	chrome.exe
668	chrome.exe
668	chrome.exe
668	chrome.exe
668	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE
3144	Explorer.EXE

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3304 wrote to memory of 3144	3304	Setup.exe	54
PID 3304 wrote to memory of 3144	3304	Setup.exe	54
PID 668 wrote to memory of 920	668	chrome.exe	83
PID 668 wrote to memory of 2100	668	chrome.exe	84
PID 668 wrote to memory of 1596	668	chrome.exe	85
PID 668 wrote to memory of 2100	668	chrome.exe	84
PID 668 wrote to memory of 1136	668	chrome.exe	89
PID 668 wrote to memory of 1136	668	chrome.exe	89
PID 668 wrote to memory of 2356	668	chrome.exe	87
PID 668 wrote to memory of 2356	668	chrome.exe	87
PID 668 wrote to memory of 4100	668	chrome.exe	88
PID 668 wrote to memory of 4100	668	chrome.exe	88
PID 668 wrote to memory of 3836	668	chrome.exe	91
PID 668 wrote to memory of 3836	668	chrome.exe	91
PID 668 wrote to memory of 5344	668	chrome.exe	92
PID 668 wrote to memory of 2512	668	chrome.exe	94
PID 668 wrote to memory of 3176	668	chrome.exe	95
PID 668 wrote to memory of 1672	668	chrome.exe	96
PID 668 wrote to memory of 4332	668	chrome.exe	97
PID 668 wrote to memory of 5852	668	chrome.exe	98
PID 668 wrote to memory of 5852	668	chrome.exe	98

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3144
- C:\Users\Admin\AppData\Local\Temp\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:668
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffffbe6c728,0x7ffffbe6c734,0x7ffffbe6c740
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:920
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1596,i,15138485168846145822,7703579021708491849,262144 --field-trial-handle=1980,i,5682162437656816537,11817367433126126985,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1976 /prefetch:2
    3⤵
    PID:2100
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1460,i,8396821831386437177,10506678145392524383,524288 --field-trial-handle=1980,i,5682162437656816537,11817367433126126985,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2152 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1596
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2404,i,17085276760755290595,16262476291513062575,524288 --field-trial-handle=1980,i,5682162437656816537,11817367433126126985,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2416 /prefetch:13
    3⤵
    PID:2356
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3032,i,1584469351350650753,2462056619527528586,2097152 --field-trial-handle=1980,i,5682162437656816537,11817367433126126985,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3068 /prefetch:1
    3⤵
    PID:4100
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3036,i,16296349814206417851,3942849735829379685,2097152 --field-trial-handle=1980,i,5682162437656816537,11817367433126126985,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3092 /prefetch:1
    3⤵
    PID:1136
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4428,i,16914098677090648221,13736217738984679171,2097152 --field-trial-handle=1980,i,5682162437656816537,11817367433126126985,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4464 /prefetch:1
    3⤵
    PID:3836
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5224,i,13082925739052369267,6436570442507256351,524288 --field-trial-handle=1980,i,5682162437656816537,11817367433126126985,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5228 /prefetch:14
    3⤵
    PID:5344
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5448,i,9611257670265362830,2810035817553259831,524288 --field-trial-handle=1980,i,5682162437656816537,11817367433126126985,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5488 /prefetch:14
    3⤵
    PID:2512
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5420,i,10997403431795649259,4527577618126107693,524288 --field-trial-handle=1980,i,5682162437656816537,11817367433126126985,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5572 /prefetch:14
    3⤵
    PID:3176
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5480,i,2031779710220342036,2165864725874457787,524288 --field-trial-handle=1980,i,5682162437656816537,11817367433126126985,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5612 /prefetch:14
    3⤵
    PID:1672
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5112,i,17278774523799004467,11695447979227804453,262144 --field-trial-handle=1980,i,5682162437656816537,11817367433126126985,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5616 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4332
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=1508,i,5410973666355794590,11480694849196666217,524288 --field-trial-handle=1980,i,5682162437656816537,11817367433126126985,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4380 /prefetch:14
    3⤵
    PID:5852

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1084

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

07c2ed54-a032-4288-923a-6080067aa04a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\07c2ed54-a032-4288-923a-6080067aa04a.tmp
Size 276KB
SHA256 f361cf66f2ed66bdcda553c515509f02d9251556bd711b86d54f8b0dc904a13a
MD5 b55ce51e7c8f04aeda2ec7d864b845bb
SHA1 76d61ece4be4782c68a0483bd79ceabe571a53cf
SHA512 72620d033d79f1333910aff2a7c537733d2b11437140091d85a735733bcd30fcaa045c9d1fbd801b7b4abb501f01a1d5062f6f41173e0198407b10bd5108cfeb
SSDEEP 6144:9Ese0X9rDVgfqxXePtKCO2h4rrMxmX/B5UgKf2ne1utLQ:i2tSqNatskGGOw2npLQ
TLSH
T1B154237B8CA6AFD2A952721BA81E1B6FC97237DD4115DA40C6F8508B405F3EE8376903
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

252b13e3-8b6a-4063-9962-d108c6e4a308.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\252b13e3-8b6a-4063-9962-d108c6e4a308.tmp
Size 277KB
SHA256 212c1f762ecd8c077edd8d2fc2264fe9c74eb13d3859e77a633f67bab3752be8
MD5 16a0f1e9e292ab2f7eaa05c5df6b624a
SHA1 6c9d80eb102ac52d4f77fa017abdabf581cc9bbf
SHA512 4b798ae3244964693dbc8b89acbe7474976705a272d3b47cdf8a00d65ec51daa429eef4ef6319b7b9e7e9a9f13673388264a2e50857a082e6358096659f73a4e
SSDEEP 6144:MSEse0X9rDVgfqxXePtKCO2h4rrMxmX/B5UgKf2ne1utLQ:O2tSqNatskGGOw2npLQ
TLSH
T12254237B8C965FC2A962661FA41D2A3FCDB17B9E4115DE40D6FC608B401F2ED873A903
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

35710270-51d2-412c-9cf0-d63edfc18ceb.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\35710270-51d2-412c-9cf0-d63edfc18ceb.tmp
Size 276KB
SHA256 5905e881f32c6b76293dc6bf8ad94d2ae1d4ba960a92569a3f2ee06d36df1c5d
MD5 645ace35391befbad50dd505e574b003
SHA1 6bad8711d3471b53bfd1472911e20e1692724fac
SHA512 3ee8d8bcb7f710e593f9e920e5d3c387f08403b08d339e6aaeba75ffdfd11d637bbb5df8fba07051ceb5d880a23b25dbc47b09662934e1318855736d27fc8258
SSDEEP 6144:AEse0X9rDVgfqxXePtKCO2h4rrMxmX/B5UgKf2ne1utLQ:z2tSqNatskGGOw2npLQ
TLSH
T15154237B8CA6AFD2A952721BA81E1B6FCD7237DD4115DA40C6F8508B405F3EE8376903
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e80534bf-693b-4fdd-a3a2-083c581aa25c.dmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\reports\e80534bf-693b-4fdd-a3a2-083c581aa25c.dmp
Size 104KB
SHA256 5b623a4233348d593fe6205963a5d56d50ae14e5ef0d630af67411047ba7db9b
MD5 9aea3c32cf2d0fe6e04627fd606db4ed
SHA1 8f1af79d723c51b455dfaa6e72b61912523b56a5
SHA512 d14ee8b21cedef19b5090fbfc9a62c763347106a9047da3fd270ee65d2e3a407f41eb187dbb05046586f24143e61f583ac251d54ebb957334fd949782584921d
SSDEEP 768:3QKLXeAIMswl27XNvD6BF2UCHSzQuE1rD16EZ/UeKIUxK77ZWOMm:NXeAIrFY2UCHRpD16oUrm
TLSH
T168A3DF16A396056AF16B4E7609E3E770F7FBF8316B22471B16041A7A2C5B7406F32E13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 7c6e2ff2cdb09e3d8d75fdb570270093f07e5e0a43f0e61e4fb2778ae54aada0
MD5 9a55c891d32d99029a871b7231664647
SHA1 0a7ff2067c1292bce3cf69e91bbbda26dc4c0914
SHA512 2293d8dcdd27570365aaf77fbb1762154f8de366d55bf8d4e8f69cec850d94e4067f4f80f018d02279ad49ea03ce6d1e9bbd226cb423dca66bd9a7c6b142c2ed
MD5 SHA1 SHA512

Submit Download

3d535314-a8d1-488b-b059-d7635a4057fe.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\3d535314-a8d1-488b-b059-d7635a4057fe.tmp
Size 13KB
SHA256 cbcfbe27999bbf1c38c32cf734dbc58c0c74e8fb94cebfe52fc4ac99ec4b2c4e
MD5 2687abbcac7af17c0b616b501e486b1d
SHA1 baf57c5410325446dd74e61be138853be50fcccc
SHA512 d6063c76c0f9513dcd556327052394a8fbae929daff68178795f4017c88a3a038bc8b09526fadfd4132488a9d51a09e3cd9ab6243430667f2c455f48c796d43f
SSDEEP 384:3hjb67KxkXqKf/pUZNCgVLH2HfgslxwXODb++ErU3l6HGjOoAWI8n:3hb67KxkXqKf/pUZNCgVLH2HfgsP6OPJ
TLSH
T19152F867A84D9A7F0FD8C94DD8266F4FACB5015766680C6893FB5C0803E5BCB114A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4052feb9-befa-488c-92df-89109de95cfd.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\4052feb9-befa-488c-92df-89109de95cfd.tmp
Size 12KB
SHA256 52c952660154eb7daa431561852eec315ab119fd4b6fff56202fc209aaff56b9
MD5 a34019acf9e8144fd1423ff2619dc46f
SHA1 5e20dcf645516aef08d2a943e5c8ef2c578e0228
SHA512 54e98b4172ef32d5f2b972c1de0e0591ac5eed1b10728242c03e9b32f13b4ecfceded9c05f0ed33e63fc5cd7e4402d1977a2447c3aa3cba58e4fa51e9b322afd
SSDEEP 192:URqy4ifv7+7pEPRp2R9ZHsb+WNn3U03++JDeF/+VyIsnAUgraJ:URqyV3S7UXybwk03BJc2e
TLSH
T16242B62DEA00797B5CEBD21AF9627B97D3F5102224912E84E6FC8D3C25E7ACC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4e1923e6-8f7f-419d-bd2c-f83a14a4a189.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\4e1923e6-8f7f-419d-bd2c-f83a14a4a189.tmp
Size 11KB
SHA256 64c77b98902976d968844aa11cd353edbdb9abe1957f5f3a1c5c41046fceb8ca
MD5 1a76efd6d416258541e44358e6c9f94b
SHA1 d70382799fb327293782a10277e5856ccb4513b7
SHA512 7adcd607978bf7bd63b8710bd3399f5b8e675547c28cc9591c92bf306dd4c3e4bd250528d6773d4520c65b9dcaf189225dfe080778243640f8bb5e6b8d63099a
SSDEEP 192:URqysifv7+7pAPRp2R9ZHsb+WNn3U0U+JDeFu+VyIsnAUgtaJ:URqyB3S7UXybwk0/JD28
TLSH
T15042A42DEE10757B5CEBD21AF9627B87D3F5102224952E84E6FC8C2C25E7ACC221B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

52faea0e-53d3-41e7-9d7a-b5e6701d7140.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\52faea0e-53d3-41e7-9d7a-b5e6701d7140.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

127a2b96-6548-4a73-9a9d-3543dbacb2fd.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\127a2b96-6548-4a73-9a9d-3543dbacb2fd.tmp
Size 3KB
SHA256 76b95b023013981d5dea43dee9b953d6709f177270d6b849e9a4cbf3b3fc72b2
MD5 84c7b1f687bf64bdc8cf89c2f036bb82
SHA1 500713afd600ad93a074fcf77fab85a6530e638f
SHA512 a0f48f939ac43c770b1241c3640f7d17cb57527c2c1e2f226b41838acb4aada1ca880c0f1bec85d8d4f972458eed4a415eb6f97b26d6530ed614b77b48f54d57
TLSH
T1BA618AF3D7E88A7E891156F49A216E1FCD7D0A25022C3C628CD4EE4B53F2872D24078E
MD5 SHA1 SHA512 TLSH

Submit Download

4ad1154c-a820-4796-b578-fcab0ae10045.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\4ad1154c-a820-4796-b578-fcab0ae10045.tmp
Size 2KB
SHA256 ef27bb9f1ba9fafe68a14cec30470218fed2613b1e833d67b8111d6172a83668
MD5 78705b2685ebee26f5627ea2f5042d07
SHA1 7b813ff8c24b82a4d8caeeb4d4875ca8804b9d7d
SHA512 acdbb9815fb21e785edf959d439e8372d84091a1b993cc9dbf5a2e6bc999577cf5fa857f0377ecf57da98f56b5f3806e8d18d684f12fe12892bd955d70edbdad
TLSH
T14C519BF3D7E8867E891156F4AB216E1FCD6D0A15432C3C628CD4AE4B53E2872D24138E
MD5 SHA1 SHA512 TLSH

Submit Download

4e6ed30b-cd6d-4802-97ac-a2605115eaa8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\4e6ed30b-cd6d-4802-97ac-a2605115eaa8.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

e4783089-c082-4767-a999-b0d491657c64.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\e4783089-c082-4767-a999-b0d491657c64.tmp
Size 3KB
SHA256 7b58ebd3cd53a1bbb783a8ca6e97ce842b48921729c81bf67145291b0fe520d1
MD5 dc96fe289978c3629cb32a742abfb262
SHA1 9e445cefecda515ee7e393ce39c7b4826803ad88
SHA512 ce0b2ecb7239270bd48aad7fdb12fab631ca1b2b2b85c6742db128fdafc0af6d78ae8b2ca67dafcd5365a79ce41ff81aca54ddc3b9836d31912747eb8a2acc5b
TLSH
T1B96178F3D7E88A7E891156F49A256E1EDD6D0A25122C3C628CD4EE4B53F2872D20138E
MD5 SHA1 SHA512 TLSH

Submit Download

c2cc8cea-84c7-4887-8a8d-53c3b1a91b07.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c2cc8cea-84c7-4887-8a8d-53c3b1a91b07.tmp
Size 414B
SHA256 4116cd0311fa523e44ce99e6ade764b8d19c6f49008bb253d3c25319f2aa593a
MD5 615ae15cda66a521b50b48c1876a999a
SHA1 c4423d8a2845ab2edba409847e9b4c77bf2290ff
SHA512 73bee35fd2175f5bac9182ec4631b24daf385674ffdf122e4160412ec29178009f76f6491e2e3ad93c3454da73965cecec51074dd5cd3c2c98d68e12e21edb58
TLSH
T1CDE02BAEC925AC2715FC1F6992149746E74013162A51998F373DC1098F7162A4585D1C
MD5 SHA1 SHA512 TLSH

Submit Download

b191e247-220e-4b35-86ba-ab3debb29d6e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\b191e247-220e-4b35-86ba-ab3debb29d6e.tmp
Size 130KB
SHA256 c05682842605ea1ebc75e1f1424e3fb349851fa3c870d9acbab9bc26ab04db45
MD5 a2f954a7e2bd991613761ee30cf3baef
SHA1 6313884ef4eb94186994bc76db8b0e13003fe2eb
SHA512 733950651bc2b80438d9d34c26fc027cab115c45e97f87926e77bf728b427553d2d9562106cd5ccf0685c4563ca681ea4fa457fe256f75af79025ae14e34edd4
SSDEEP 3072:QhgYVmX/M9F03bZTGnbgKfHWuoJqrAKrpQpbOYg3xC1:QxmX/B5UgKf2ne1utL1
TLSH
T130D302BF9DD9DFE36361B026B9A95B6EC9F67FC8A160DA4080F41085009F1FD4399A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c83419b7-88c1-4b6d-80c9-948ebc1cae7b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\c83419b7-88c1-4b6d-80c9-948ebc1cae7b.tmp
Size 316KB
SHA256 732f25dba398119f81e31a06702efc0fb6b50eec407517c6c58df58f7ece11b7
MD5 8a54442faf8269535d7f26d07f63c95e
SHA1 834e0d26b3776887d5e5864c2863cf4cf83fea55
SHA512 39475c103afa0dfeef1c34a8cfc3ab4bb86fa9fcbc1de6117a9de438f573472bd094fba50a9ae3423d4ffef99154c9cadfe4d83be4fefcc3a733139cc532ed47
SSDEEP 6144:sw4yNKHHstEse0X9rDVgfqxXePtKCO2h4rrMxmX/B5UgKf2ne1utLQ:N4yNKv2tSqNatskGGOw2npLQ
TLSH
T1A064237E8C925E925961B72F541E1A7E8DB23BDED219DE40D5FC208F004F2ED8726A43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3144-18-0x0000000002CA0000-0x0000000002D4C000-memory.dmp

Download

memory/3144-29-0x0000000002CA0000-0x0000000002D4C000-memory.dmp

Download

memory/3144-24-0x0000000002CA0000-0x0000000002D4C000-memory.dmp

Download

memory/3144-22-0x0000000002CA0000-0x0000000002D4C000-memory.dmp

Download

memory/3144-21-0x0000000002CA0000-0x0000000002D4C000-memory.dmp

Download

memory/3144-20-0x0000000002CA0000-0x0000000002D4C000-memory.dmp

Download

memory/3144-19-0x0000000002CA0000-0x0000000002D4C000-memory.dmp

Download

memory/3144-5-0x0000000002CA0000-0x0000000002D4C000-memory.dmp

Download

memory/3144-17-0x0000000002CA0000-0x0000000002D4C000-memory.dmp

Download

memory/3144-32-0x0000000002CA0000-0x0000000002D4C000-memory.dmp

Download

memory/3144-16-0x0000000002CA0000-0x0000000002D4C000-memory.dmp

Download

memory/3144-13-0x0000000002CA0000-0x0000000002D4C000-memory.dmp

Download

memory/3144-11-0x0000000002CA0000-0x0000000002D4C000-memory.dmp

Download

memory/3144-23-0x0000000002CA0000-0x0000000002D4C000-memory.dmp

Download

memory/3144-36-0x0000000002CA0000-0x0000000002D4C000-memory.dmp

Download

memory/3144-27-0x0000000002CA0000-0x0000000002D4C000-memory.dmp

Download

memory/3144-28-0x0000000002CA0000-0x0000000002D4C000-memory.dmp

Download

memory/3144-25-0x0000000002CA0000-0x0000000002D4C000-memory.dmp

Download

memory/3144-66-0x0000000002CA0000-0x0000000002D4C000-memory.dmp

Download

memory/3144-30-0x0000000002CA0000-0x0000000002D4C000-memory.dmp

Download

memory/3144-73-0x0000000002CA0000-0x0000000002D4C000-memory.dmp

Download

memory/3144-26-0x0000000002CA0000-0x0000000002D4C000-memory.dmp

Download

memory/3144-8-0x0000000002CA0000-0x0000000002D4C000-memory.dmp

Download

memory/3144-9-0x0000000002CA0000-0x0000000002D4C000-memory.dmp

Download

memory/3144-10-0x0000000002CA0000-0x0000000002D4C000-memory.dmp

Download

memory/3144-15-0x0000000002CA0000-0x0000000002D4C000-memory.dmp

Download

memory/3144-12-0x0000000002CA0000-0x0000000002D4C000-memory.dmp

Download

memory/3144-6-0x0000000002CA0000-0x0000000002D4C000-memory.dmp

Download

memory/3144-0-0x0000000002CA0000-0x0000000002D4C000-memory.dmp

Download

memory/3144-1-0x0000000002CA0000-0x0000000002D4C000-memory.dmp

Download

memory/3144-3-0x0000000002CA0000-0x0000000002D4C000-memory.dmp

Download

memory/3144-4-0x0000000002CA0000-0x0000000002D4C000-memory.dmp

Download

memory/3144-7-0x0000000002CA0000-0x0000000002D4C000-memory.dmp

Download

memory/3144-2-0x0000000002CA0000-0x0000000002D4C000-memory.dmp

Download