deerstealer | 98df906d9b4b3caaf8bf153ca197f209cf1d746313fb33abd2f6855842874594

Analysis

max time kernel
149s
max time network
141s
platform
windows11-21h2_x64
resource
win11-20250619-en
resource tags

arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
submitted
02/07/2025, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Trojan.GenericKDZ.112036.12793.24150.exe
Size 2.3MB
Sample250702-e17exssn12
SHA256 98df906d9b4b3caaf8bf153ca197f209cf1d746313fb33abd2f6855842874594
MD5 2bae3892bffd8eb338529e9a90de769a
SHA1 651decf434fc8c2de6cefa0694048031a0fc57d2
SHA512 077d157e790a19de039218917dd5f01b914bafeae16848dc336fec027e48bfaefd249369c488278dfeb7edf44ddb5750fdbda466c382f0351abb970c6574d339
SSDEEP 49152:FlPhFMm+jN23QLOKefTnsOqfh9tN63hjviq9zoY0FiT5jaQ/6u+YGU9q:XuGY/w
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

deerstealer donutloader discovery loader spyware stealer

Malware Config

Signatures

DeerStealer
DeerStealer is a sophisticated information stealer written in C++.
stealer deerstealer
Deerstealer family
deerstealer

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral2/memory/2372-87-0x00007FF6B9340000-0x00007FF6B962F000-memory.dmp	family_donutloader

DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader
Donutloader family
donutloader

Detects DeerStealer 2 IoCs

stealer

resource	yara_rule
behavioral2/memory/2372-0-0x00007FF6B9340000-0x00007FF6B962F000-memory.dmp	family_deerstealer
behavioral2/memory/2372-87-0x00007FF6B9340000-0x00007FF6B962F000-memory.dmp	family_deerstealer

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133959039379415806"	chrome.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2372	SecuriteInfo.com.Trojan.GenericKDZ.112036.12793.24150.exe
2372	SecuriteInfo.com.Trojan.GenericKDZ.112036.12793.24150.exe
6056	chrome.exe
6056	chrome.exe
2372	SecuriteInfo.com.Trojan.GenericKDZ.112036.12793.24150.exe
2372	SecuriteInfo.com.Trojan.GenericKDZ.112036.12793.24150.exe
2372	SecuriteInfo.com.Trojan.GenericKDZ.112036.12793.24150.exe
2372	SecuriteInfo.com.Trojan.GenericKDZ.112036.12793.24150.exe
2372	SecuriteInfo.com.Trojan.GenericKDZ.112036.12793.24150.exe
2372	SecuriteInfo.com.Trojan.GenericKDZ.112036.12793.24150.exe
6056	chrome.exe
6056	chrome.exe
5756	chrome.exe
5756	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
6056	chrome.exe
6056	chrome.exe
6056	chrome.exe
6056	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	6056	chrome.exe
Token: SeCreatePagefilePrivilege	6056	chrome.exe
Token: SeShutdownPrivilege	6056	chrome.exe
Token: SeCreatePagefilePrivilege	6056	chrome.exe
Token: SeShutdownPrivilege	6056	chrome.exe
Token: SeCreatePagefilePrivilege	6056	chrome.exe
Token: SeShutdownPrivilege	6056	chrome.exe
Token: SeCreatePagefilePrivilege	6056	chrome.exe
Token: SeShutdownPrivilege	6056	chrome.exe
Token: SeCreatePagefilePrivilege	6056	chrome.exe
Token: SeShutdownPrivilege	6056	chrome.exe
Token: SeCreatePagefilePrivilege	6056	chrome.exe
Token: SeShutdownPrivilege	6056	chrome.exe
Token: SeCreatePagefilePrivilege	6056	chrome.exe
Token: SeShutdownPrivilege	6056	chrome.exe
Token: SeCreatePagefilePrivilege	6056	chrome.exe
Token: SeShutdownPrivilege	6056	chrome.exe
Token: SeCreatePagefilePrivilege	6056	chrome.exe
Token: SeShutdownPrivilege	6056	chrome.exe
Token: SeCreatePagefilePrivilege	6056	chrome.exe
Token: SeShutdownPrivilege	6056	chrome.exe
Token: SeCreatePagefilePrivilege	6056	chrome.exe
Token: SeShutdownPrivilege	6056	chrome.exe
Token: SeCreatePagefilePrivilege	6056	chrome.exe
Token: SeShutdownPrivilege	6056	chrome.exe
Token: SeCreatePagefilePrivilege	6056	chrome.exe
Token: SeShutdownPrivilege	6056	chrome.exe
Token: SeCreatePagefilePrivilege	6056	chrome.exe
Token: SeShutdownPrivilege	6056	chrome.exe
Token: SeCreatePagefilePrivilege	6056	chrome.exe
Token: SeShutdownPrivilege	6056	chrome.exe
Token: SeCreatePagefilePrivilege	6056	chrome.exe
Token: SeShutdownPrivilege	6056	chrome.exe
Token: SeCreatePagefilePrivilege	6056	chrome.exe
Token: SeShutdownPrivilege	6056	chrome.exe
Token: SeCreatePagefilePrivilege	6056	chrome.exe
Token: SeShutdownPrivilege	6056	chrome.exe
Token: SeCreatePagefilePrivilege	6056	chrome.exe
Token: SeShutdownPrivilege	6056	chrome.exe
Token: SeCreatePagefilePrivilege	6056	chrome.exe
Token: SeShutdownPrivilege	6056	chrome.exe
Token: SeCreatePagefilePrivilege	6056	chrome.exe
Token: SeShutdownPrivilege	6056	chrome.exe
Token: SeCreatePagefilePrivilege	6056	chrome.exe
Token: SeShutdownPrivilege	6056	chrome.exe
Token: SeCreatePagefilePrivilege	6056	chrome.exe
Token: SeShutdownPrivilege	6056	chrome.exe
Token: SeCreatePagefilePrivilege	6056	chrome.exe
Token: SeShutdownPrivilege	6056	chrome.exe
Token: SeCreatePagefilePrivilege	6056	chrome.exe
Token: SeShutdownPrivilege	6056	chrome.exe
Token: SeCreatePagefilePrivilege	6056	chrome.exe
Token: SeShutdownPrivilege	6056	chrome.exe
Token: SeCreatePagefilePrivilege	6056	chrome.exe
Token: SeShutdownPrivilege	6056	chrome.exe
Token: SeCreatePagefilePrivilege	6056	chrome.exe
Token: SeShutdownPrivilege	6056	chrome.exe
Token: SeCreatePagefilePrivilege	6056	chrome.exe
Token: SeShutdownPrivilege	6056	chrome.exe
Token: SeCreatePagefilePrivilege	6056	chrome.exe
Token: SeShutdownPrivilege	6056	chrome.exe
Token: SeCreatePagefilePrivilege	6056	chrome.exe
Token: SeShutdownPrivilege	6056	chrome.exe
Token: SeCreatePagefilePrivilege	6056	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
6056	chrome.exe
6056	chrome.exe
6056	chrome.exe
6056	chrome.exe
6056	chrome.exe
6056	chrome.exe
6056	chrome.exe
6056	chrome.exe
6056	chrome.exe
6056	chrome.exe
6056	chrome.exe
6056	chrome.exe
6056	chrome.exe
6056	chrome.exe
6056	chrome.exe
6056	chrome.exe
6056	chrome.exe
6056	chrome.exe
6056	chrome.exe
6056	chrome.exe
6056	chrome.exe
6056	chrome.exe
6056	chrome.exe
6056	chrome.exe
6056	chrome.exe
6056	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
6056	chrome.exe
6056	chrome.exe
6056	chrome.exe
6056	chrome.exe
6056	chrome.exe
6056	chrome.exe
6056	chrome.exe
6056	chrome.exe
6056	chrome.exe
6056	chrome.exe
6056	chrome.exe
6056	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 6056	2372	SecuriteInfo.com.Trojan.GenericKDZ.112036.12793.24150.exe	78
PID 2372 wrote to memory of 6056	2372	SecuriteInfo.com.Trojan.GenericKDZ.112036.12793.24150.exe	78
PID 6056 wrote to memory of 3020	6056	chrome.exe	79
PID 6056 wrote to memory of 3020	6056	chrome.exe	79
PID 6056 wrote to memory of 3716	6056	chrome.exe	80
PID 6056 wrote to memory of 3716	6056	chrome.exe	80
PID 6056 wrote to memory of 3908	6056	chrome.exe	81
PID 6056 wrote to memory of 3908	6056	chrome.exe	81
PID 6056 wrote to memory of 3716	6056	chrome.exe	80
PID 6056 wrote to memory of 3716	6056	chrome.exe	80
PID 6056 wrote to memory of 3716	6056	chrome.exe	80
PID 6056 wrote to memory of 3716	6056	chrome.exe	80
PID 6056 wrote to memory of 3716	6056	chrome.exe	80
PID 6056 wrote to memory of 3716	6056	chrome.exe	80
PID 6056 wrote to memory of 3716	6056	chrome.exe	80
PID 6056 wrote to memory of 3716	6056	chrome.exe	80
PID 6056 wrote to memory of 3716	6056	chrome.exe	80
PID 6056 wrote to memory of 3716	6056	chrome.exe	80
PID 6056 wrote to memory of 3716	6056	chrome.exe	80
PID 6056 wrote to memory of 3716	6056	chrome.exe	80
PID 6056 wrote to memory of 3716	6056	chrome.exe	80
PID 6056 wrote to memory of 3716	6056	chrome.exe	80
PID 6056 wrote to memory of 3716	6056	chrome.exe	80
PID 6056 wrote to memory of 3716	6056	chrome.exe	80
PID 6056 wrote to memory of 3716	6056	chrome.exe	80
PID 6056 wrote to memory of 3716	6056	chrome.exe	80
PID 6056 wrote to memory of 3716	6056	chrome.exe	80
PID 6056 wrote to memory of 3716	6056	chrome.exe	80
PID 6056 wrote to memory of 3716	6056	chrome.exe	80
PID 6056 wrote to memory of 3716	6056	chrome.exe	80
PID 6056 wrote to memory of 3716	6056	chrome.exe	80
PID 6056 wrote to memory of 3716	6056	chrome.exe	80
PID 6056 wrote to memory of 3716	6056	chrome.exe	80
PID 6056 wrote to memory of 3716	6056	chrome.exe	80
PID 6056 wrote to memory of 3716	6056	chrome.exe	80
PID 6056 wrote to memory of 3716	6056	chrome.exe	80
PID 6056 wrote to memory of 3284	6056	chrome.exe	83
PID 6056 wrote to memory of 3284	6056	chrome.exe	83
PID 6056 wrote to memory of 4644	6056	chrome.exe	84
PID 6056 wrote to memory of 4644	6056	chrome.exe	84
PID 6056 wrote to memory of 3284	6056	chrome.exe	83
PID 6056 wrote to memory of 3284	6056	chrome.exe	83
PID 6056 wrote to memory of 3284	6056	chrome.exe	83
PID 6056 wrote to memory of 3284	6056	chrome.exe	83
PID 6056 wrote to memory of 3284	6056	chrome.exe	83
PID 6056 wrote to memory of 3284	6056	chrome.exe	83
PID 6056 wrote to memory of 3284	6056	chrome.exe	83
PID 6056 wrote to memory of 3284	6056	chrome.exe	83
PID 6056 wrote to memory of 3284	6056	chrome.exe	83
PID 6056 wrote to memory of 3284	6056	chrome.exe	83
PID 6056 wrote to memory of 3284	6056	chrome.exe	83
PID 6056 wrote to memory of 3284	6056	chrome.exe	83
PID 6056 wrote to memory of 3284	6056	chrome.exe	83
PID 6056 wrote to memory of 3284	6056	chrome.exe	83
PID 6056 wrote to memory of 3284	6056	chrome.exe	83
PID 6056 wrote to memory of 3284	6056	chrome.exe	83
PID 6056 wrote to memory of 3284	6056	chrome.exe	83
PID 6056 wrote to memory of 3284	6056	chrome.exe	83
PID 6056 wrote to memory of 3284	6056	chrome.exe	83
PID 6056 wrote to memory of 3284	6056	chrome.exe	83
PID 6056 wrote to memory of 3284	6056	chrome.exe	83
PID 6056 wrote to memory of 3284	6056	chrome.exe	83
PID 6056 wrote to memory of 3284	6056	chrome.exe	83
PID 6056 wrote to memory of 3284	6056	chrome.exe	83

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKDZ.112036.12793.24150.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKDZ.112036.12793.24150.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:6056
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffecec1dcf8,0x7ffecec1dd04,0x7ffecec1dd10
    3⤵
    PID:3020
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1968,i,16595165219687736163,16925052932661533027,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=1900 /prefetch:2
    3⤵
    PID:3716
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1492,i,16595165219687736163,16925052932661533027,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=2148 /prefetch:11
    3⤵
    PID:3908
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2380,i,16595165219687736163,16925052932661533027,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=2392 /prefetch:13
    3⤵
    PID:4224
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3052,i,16595165219687736163,16925052932661533027,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3104 /prefetch:1
    3⤵
    PID:3284
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3060,i,16595165219687736163,16925052932661533027,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3124 /prefetch:1
    3⤵
    PID:4644
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4212,i,16595165219687736163,16925052932661533027,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=2308 /prefetch:9
    3⤵
    PID:4992
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4668,i,16595165219687736163,16925052932661533027,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=4684 /prefetch:1
    3⤵
    PID:4908
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4824,i,16595165219687736163,16925052932661533027,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=4800 /prefetch:14
    3⤵
    PID:5812
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4940,i,16595165219687736163,16925052932661533027,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=4952 /prefetch:14
    3⤵
    PID:3548
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5324,i,16595165219687736163,16925052932661533027,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5332 /prefetch:14
    3⤵
    PID:4212
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5540,i,16595165219687736163,16925052932661533027,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5552 /prefetch:14
    3⤵
    PID:4600
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5548,i,16595165219687736163,16925052932661533027,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5572 /prefetch:14
    3⤵
    PID:2668
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5456,i,16595165219687736163,16925052932661533027,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5732 /prefetch:14
    3⤵
    PID:1560
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5452,i,16595165219687736163,16925052932661533027,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5760 /prefetch:14
    3⤵
    PID:4112
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=5772,i,16595165219687736163,16925052932661533027,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5560 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5756

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:2940

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:4008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 b2f9998a704d07fe05a8f89d0c88102cddafad3c0f5406e472c66aaf4a832ddc
MD5 964401243fcd013100b7b6047efbb05c
SHA1 4dc3b119178d5e4eab6e0827b44234844dd03158
SHA512 f48f3d780677627d227a57ea00babad75ebd1c6684ce825ad90175d3e69a5b8f32d795f801ac2055489fe72369172c30dd6f85db36f59d00f7231e19fa7f5ad3
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 413ebc2151b6225c9accc429e2d979ea7da07442a2da6a4ec5d8b7b72e850466
MD5 2e5e16c48d7e7fd5a43aef35faa8ded1
SHA1 cf29eca0436d433e46311ff4352c6a9d9cac84b6
SHA512 6d37d71fdd37099a751cf394122aa52c73ef8286abb58240650319ae767cb7e692ef8f120c789e4c4fb1f149f98256d732f50d3c98efb653afc8ef2c05e7700b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 9654229f3f01c45d1c29899f6c6f4c2748b3d170c7d7b9b06e0e2f94a148fe40
MD5 92fe216dc4f1ff7702f46fe822f89686
SHA1 9741ead4ce1ce25eea1270b799fef76df4dccaaa
SHA512 6f02b53cd1ad27e964d56291611d0dcd12cd49f16a3e2bc61a1d4eda769f9e55e865dab6e8e35c777496ccc06e568e4d117c5cd153433616f47f2f15a93f5486
SSDEEP 192:dYkX+D7YaZ8Z8PRpI3HS+WNinoT1re+2R8ydpQyIsnA/g4:dYkX+f/XIXc6oTh25Z4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 15KB
SHA256 81f04db80747f79d72609b91b498cd398950f324d96b311b2b6adcc9237f57e1
MD5 2c5464602344c1bb08ff348e155f5c49
SHA1 432fd82bc3e71458a0f98bd50facfd2909a617e6
SHA512 d68673f5dc1b83af2c19cb14c7a99f49e0d58baffed93ac62865dcd0361e38e4dbd4963890e5fdf0178a63db6ce2b7996c6187a2565e8554d5f8f2e5fc6e85d3
SSDEEP 384:+KDv7pLuLcei2bXoVPkXqKf/pUZNCgVLH2Hf1KLrUf1HGpWz3cna:+gv7pLuL7vDoVPkXqKf/pUZNCgVLH2Hj
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 575d8d9a6c6a4de32d1bd8691b49cf8edcb4fcb4c93bbcaeae9c42f6195cfeb3
MD5 3f682f31fce2ec3730bad7c56c732350
SHA1 ce883e9ed98ec245f5f2baa755e026ab88b6d6d4
SHA512 17963c60106c9e3723100b6d815ecc6877bf8fd718168d06e54da6459566f486e8c89b2e332a44ee2035270ff31f042ffb6bc46a9121116bdf44bf601516de57
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe57cf17.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57cf17.TMP
Size 48B
SHA256 cd8fa57c94f0c14d9b4f2d2c8bb687816640423cbcd50083787e8eaee47b6020
MD5 22f8709d4ad897ac4d889bd9ad75aac9
SHA1 1a9744abb2eb4b9d417794b1f74bd05262ea923a
SHA512 c9fa38539a9bd68cab9ac74e83bfa2ab6b6f9caf5b18ed1b29a615acc42afb0cb9a2be3c41c870e58e00ce491f5598b40f3f0eb0a883dfe15b3ab05f847b2b09
MD5 SHA1 SHA512

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 7114eaf0a021d2eb098b1e9f56f3500dc4f74ac68a87f5256922e4a4b9fa66b7
MD5 a4710a30ca124ef24daf2c2462a1da92
SHA1 96958e2fe60d71e08ea922dfd5e69a50e38cc5db
SHA512 43878e3bc6479df9e4ebd11092be61a73ab5a1441cd0bc8755edd401d37032c44a7279bab477c01d563ab4fa5d8078c0ba163a9207383538e894e0a7ff5a3e15
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 164KB
SHA256 c9806c1f6b4771e9d36c74794fb58cc51850f4b7ea44d5c3ce59d630d97fa9b4
MD5 f114b48d68240274d1fd67a780d9c19b
SHA1 5026ed1f496bcc53c17bb7bd99224f2de8ceb779
SHA512 7d4977ef1298eb64ba65b1a85d45b318980c68f3bea82911a9dfb66d2296470adf96c9e21d26372b6879d06c7854a37e2d492678f8bceb81d2fd8ab7ca3db1e4
SSDEEP 3072:jcOJD18iH3y3p2LRakBYd03iInKCXjM4rTmN5eWvStRNoV8cWK7XF+TwMM:IOV18pkVFGZInKSJrTnGfzF+TwMM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 164KB
SHA256 ef73d672b23a9fb70722c789c3a4246e5395adf2d8b355cb5e1e6fb615dbc8fa
MD5 c31fbe83a51e534e764ee4f1a97d7f78
SHA1 147a73bd5ffd1db11e05bfce6c4258f58ce7eb41
SHA512 74b2078b8d93de938183f05d63879d530714dc1845e793f101d7bb8f85f6eaaf7c163c858679b26312cebb51df2a187d3b4826d93c01f98cd9f3d27d5aa963e7
SSDEEP 3072:KcOJD18iH3y3p2LRakBYd03iInKCXjM4rTmN5eWvStRNoV8cWK7XF+TwMM:fOV18pkVFGZInKSJrTnGfzF+TwMM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 83KB
SHA256 0cc4798ddd2c515f9954c305c6dfa4688dc750cb5ab973b9b17dc5d10d7daef4
MD5 a437455e875982ee69ef6c868d442331
SHA1 b3590a5001a46c70e8020e8b05e59d5f6926e406
SHA512 bd10a9c8922ad92efb8fe973f5c277e5ecec20d4c1278fbc4e04c36a2e7cb680e24e393c1cb05a88c828eca0dbcb62637dabadffd367e739300c4528f74e1c17
SSDEEP 1536:4FaXj8V43bjn6ldz5eU1vkHzZYiVNoV8cWKNR+K7i9U39SK17W5HvTwMB:DXjM4rTmN5eWvStRNoV8cWK7XF+TwMB
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2372-87-0x00007FF6B9340000-0x00007FF6B962F000-memory.dmp

Download

memory/2372-0-0x00007FF6B9340000-0x00007FF6B962F000-memory.dmp

Download