d8bb97a2d453d659c9df7b10df2030f33dbc566da75184e312b148107ca906b0

Analysis

max time kernel
136s
max time network
124s
platform
windows11-21h2_x64
resource
win11-20250410-en
resource tags

arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system
submitted
17/04/2025, 00:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

alfa.exe
Size

137KB
MD5

510c893c3552e271cd3c407dae2c82b0
SHA1

5a30f8ec0137a4f26d160a7ff48f6ebe7dafc383
SHA256

d8bb97a2d453d659c9df7b10df2030f33dbc566da75184e312b148107ca906b0
SHA512

2598a9064d7b6866b82d5a7d433c8e3cea7ea03e340d5f8fe80a3878e68b6b2fb4bb6159f6ed80a5a148a40059f282f78586af4682a452f830c4b7755ddd2a30
SSDEEP

3072:aVvH8RuVrLyEj/S2CUGACcceJd/klDHa/R8mxu3s8QyPu:KH8RuRLlzgUd6a/AslyPu

Score

8^/10

credential_access discovery spyware stealer

Malware Config

Signatures

Uses browser remote debugging 2 TTPs 8 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
6076	chrome.exe
3976	chrome.exe
1436	msedge.exe
5156	msedge.exe
6140	msedge.exe
4032	chrome.exe
4976	chrome.exe
5072	chrome.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	alfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	alfa.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	alfa.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4012	timeout.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133893217433985477"	chrome.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1988	alfa.exe
1988	alfa.exe
1988	alfa.exe
1988	alfa.exe
4032	chrome.exe
4032	chrome.exe
1988	alfa.exe
1988	alfa.exe
1988	alfa.exe
1988	alfa.exe
1988	alfa.exe
1988	alfa.exe
1988	alfa.exe
1988	alfa.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
1436	msedge.exe
1436	msedge.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4032	chrome.exe
Token: SeCreatePagefilePrivilege	4032	chrome.exe
Token: SeShutdownPrivilege	4032	chrome.exe
Token: SeCreatePagefilePrivilege	4032	chrome.exe
Token: SeShutdownPrivilege	4032	chrome.exe
Token: SeCreatePagefilePrivilege	4032	chrome.exe
Token: SeShutdownPrivilege	4032	chrome.exe
Token: SeCreatePagefilePrivilege	4032	chrome.exe
Token: SeShutdownPrivilege	4032	chrome.exe
Token: SeCreatePagefilePrivilege	4032	chrome.exe
Token: SeShutdownPrivilege	4032	chrome.exe
Token: SeCreatePagefilePrivilege	4032	chrome.exe
Token: SeShutdownPrivilege	4032	chrome.exe
Token: SeCreatePagefilePrivilege	4032	chrome.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
1436	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 4032	1988	alfa.exe	78
PID 1988 wrote to memory of 4032	1988	alfa.exe	78
PID 4032 wrote to memory of 2464	4032	chrome.exe	79
PID 4032 wrote to memory of 2464	4032	chrome.exe	79
PID 4032 wrote to memory of 5188	4032	chrome.exe	80
PID 4032 wrote to memory of 5188	4032	chrome.exe	80
PID 4032 wrote to memory of 4900	4032	chrome.exe	81
PID 4032 wrote to memory of 4900	4032	chrome.exe	81
PID 4032 wrote to memory of 4900	4032	chrome.exe	81
PID 4032 wrote to memory of 4900	4032	chrome.exe	81
PID 4032 wrote to memory of 4900	4032	chrome.exe	81
PID 4032 wrote to memory of 4900	4032	chrome.exe	81
PID 4032 wrote to memory of 4900	4032	chrome.exe	81
PID 4032 wrote to memory of 4900	4032	chrome.exe	81
PID 4032 wrote to memory of 4900	4032	chrome.exe	81
PID 4032 wrote to memory of 4900	4032	chrome.exe	81
PID 4032 wrote to memory of 4900	4032	chrome.exe	81
PID 4032 wrote to memory of 4900	4032	chrome.exe	81
PID 4032 wrote to memory of 4900	4032	chrome.exe	81
PID 4032 wrote to memory of 4900	4032	chrome.exe	81
PID 4032 wrote to memory of 4900	4032	chrome.exe	81
PID 4032 wrote to memory of 4900	4032	chrome.exe	81
PID 4032 wrote to memory of 4900	4032	chrome.exe	81
PID 4032 wrote to memory of 4900	4032	chrome.exe	81
PID 4032 wrote to memory of 4900	4032	chrome.exe	81
PID 4032 wrote to memory of 4900	4032	chrome.exe	81
PID 4032 wrote to memory of 4900	4032	chrome.exe	81
PID 4032 wrote to memory of 4900	4032	chrome.exe	81
PID 4032 wrote to memory of 4900	4032	chrome.exe	81
PID 4032 wrote to memory of 4900	4032	chrome.exe	81
PID 4032 wrote to memory of 4900	4032	chrome.exe	81
PID 4032 wrote to memory of 4900	4032	chrome.exe	81
PID 4032 wrote to memory of 4900	4032	chrome.exe	81
PID 4032 wrote to memory of 4900	4032	chrome.exe	81
PID 4032 wrote to memory of 4900	4032	chrome.exe	81
PID 4032 wrote to memory of 4900	4032	chrome.exe	81
PID 4032 wrote to memory of 5028	4032	chrome.exe	82
PID 4032 wrote to memory of 5028	4032	chrome.exe	82
PID 4032 wrote to memory of 5028	4032	chrome.exe	82
PID 4032 wrote to memory of 5028	4032	chrome.exe	82
PID 4032 wrote to memory of 5028	4032	chrome.exe	82
PID 4032 wrote to memory of 5028	4032	chrome.exe	82
PID 4032 wrote to memory of 5028	4032	chrome.exe	82
PID 4032 wrote to memory of 5028	4032	chrome.exe	82
PID 4032 wrote to memory of 5028	4032	chrome.exe	82
PID 4032 wrote to memory of 5028	4032	chrome.exe	82
PID 4032 wrote to memory of 5028	4032	chrome.exe	82
PID 4032 wrote to memory of 5028	4032	chrome.exe	82
PID 4032 wrote to memory of 5028	4032	chrome.exe	82
PID 4032 wrote to memory of 5028	4032	chrome.exe	82
PID 4032 wrote to memory of 5028	4032	chrome.exe	82
PID 4032 wrote to memory of 5028	4032	chrome.exe	82
PID 4032 wrote to memory of 5028	4032	chrome.exe	82
PID 4032 wrote to memory of 5028	4032	chrome.exe	82
PID 4032 wrote to memory of 5028	4032	chrome.exe	82
PID 4032 wrote to memory of 5028	4032	chrome.exe	82
PID 4032 wrote to memory of 5028	4032	chrome.exe	82
PID 4032 wrote to memory of 5028	4032	chrome.exe	82
PID 4032 wrote to memory of 5028	4032	chrome.exe	82
PID 4032 wrote to memory of 5028	4032	chrome.exe	82
PID 4032 wrote to memory of 5028	4032	chrome.exe	82
PID 4032 wrote to memory of 5028	4032	chrome.exe	82
PID 4032 wrote to memory of 5028	4032	chrome.exe	82
PID 4032 wrote to memory of 5028	4032	chrome.exe	82

C:\Users\Admin\AppData\Local\Temp\alfa.exe
"C:\Users\Admin\AppData\Local\Temp\alfa.exe"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
  2⤵
  - Uses browser remote debugging
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4032
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe6db6dcf8,0x7ffe6db6dd04,0x7ffe6db6dd10
    3⤵
    PID:2464
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1496,i,10546053020039888978,13637818350164649396,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=2132 /prefetch:11
    3⤵
    PID:5188
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2096,i,10546053020039888978,13637818350164649396,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=2092 /prefetch:2
    3⤵
    PID:4900
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2420,i,10546053020039888978,13637818350164649396,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=2444 /prefetch:13
    3⤵
    PID:5028
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3276,i,10546053020039888978,13637818350164649396,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=3296 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:5072
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3316,i,10546053020039888978,13637818350164649396,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=3440 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:4976
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4344,i,10546053020039888978,13637818350164649396,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=4372 /prefetch:9
    3⤵
    - Uses browser remote debugging
    PID:6076
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4764,i,10546053020039888978,13637818350164649396,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=4704 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:3976
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5344,i,10546053020039888978,13637818350164649396,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=5356 /prefetch:14
    3⤵
    PID:3380
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5348,i,10546053020039888978,13637818350164649396,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=5488 /prefetch:14
    3⤵
    PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
  2⤵
  - Uses browser remote debugging
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  PID:1436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x268,0x7ffe5ce7f208,0x7ffe5ce7f214,0x7ffe5ce7f220
    3⤵
    PID:4844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1864,i,4728737776749807123,9046885341813681770,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:11
    3⤵
    PID:276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2136,i,4728737776749807123,9046885341813681770,262144 --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:2
    3⤵
    PID:5776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2468,i,4728737776749807123,9046885341813681770,262144 --variations-seed-version --mojo-platform-channel-handle=2488 /prefetch:13
    3⤵
    PID:1560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3440,i,4728737776749807123,9046885341813681770,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:6140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3460,i,4728737776749807123,9046885341813681770,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:5156
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c timeout /t 11 & rd /s /q "C:\ProgramData\vkng4" & exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6132
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 11
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:4012

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:5060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5568

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:3468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
414B

MD5
4c7740ea9663e9dcb87aae7d46368ce7

SHA1
9ec4b1629d1e6342be792bd80e16521b79434667

SHA256
1c41fc8d859e1830a6b2a1203343b24be08dadfb343cc3402bc74e1054641820

SHA512
7fcb240b02f424267a8f0b70b1cb1be0e3f9bb33215902e5bebfc7756e9a09bc6a63073b93b0a6d4e826a1841568b3ee969c8065d6bfa3c8b830954edfbe3e32

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
78KB

MD5
0302fb9da35ca3d4d2b96858ca0331f5

SHA1
532f54f808717d032a0f017e47d39607e7751ef2

SHA256
1fe4b383753002082e2c80ec0b4844d826b2b17fa622bed40d7344fd8ff1bf1b

SHA512
fd430c84715a3819de7fa7f52ba36942941e110456f31d58e51d26cf7b67b9531c4db1bdcb07bb5e1bc19ab1453e06ce9ac28d420f9a885debc364193a5ed621

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
7fb3fa445a601487229c7cdc376dfd17

SHA1
44cad52edf339fcaa132e8e53325402b190101d8

SHA256
2f49d43250b5a1ee2e5cbbaf2ca97ae05a8dad5bd2df93495fe3f95ef0e493e9

SHA512
86f0852a8ed838c227f73149c22b315cd4cc0045716ef2170a493a52c8b9ce3efb5c9ea9a1a0a83e4fe07f7b5b32d7782935722695fcb33a378f5e33a970908f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\28482b1b-86f8-4651-b35b-504d5ac7596a\index-dir\the-real-index

Filesize
2KB

MD5
b80353fab4700fae4593c98b97973ae4

SHA1
243a43ed1e5eed81ba4fccd3d66d719790b83ed9

SHA256
a5ca7dc023de0686ee1e1a538fbc76c93d6143e39f0a9122fda56958118b7a93

SHA512
051148f81978e64468d98d64107fa9d9803a0d6e0daf4266039dab904283ba2d4d2db3c2f2aaec4c768da0abf9aa7283274ba849ef9bc587bb7aac480fbd12db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\28482b1b-86f8-4651-b35b-504d5ac7596a\index-dir\the-real-index~RFe57cb01.TMP

Filesize
2KB

MD5
4fdaf5a4e6f8231fa4def4e26420e250

SHA1
ad7fe1c02a3acdf07da217e82995ca99abd78bce

SHA256
23216820948a75bef4a59d00e7227979d639179b5d6bdc78dacb5b8ee2af829f

SHA512
f2ba63fe6bee5ae7385b6d971227fe2f142b435afb9fbb35cbfce42259ef91f567c970458da8586cfd809eb5925c24d883124763c146b6ac37a74fc17777cb7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
f9f76074ec51860534e6d92b54072505

SHA1
07fd5ce30bd4cdda06cdecbfaa1dd18b7175c09c

SHA256
13266737c3cae85c58a8f0a1ddc8593b914b4e5a5a3c6414a66b7077679c0fe6

SHA512
3e60b97a9257f2708716cfabfe4eb20b3dbb7d0c84f797ef2800f22867bf4a97e56092f070ab2f8137e3579d0f5684d05cffd60293bfac67f43a0200916dd6f6

Download Submit