Cobalt Strike payload downloaded from C2 server to C:\windows\system32\up.exe, persisted via a service masquerading as 'ChromeUpdate'.
