deerstealer | f28ec66ea72ab255e028b98e3103070e0e412030352b9c66aaf696266fed38ca

Analysis

max time kernel
150s
max time network
142s
platform
windows11-21h2_x64
resource
win11-20250610-en
resource tags

arch:x64arch:x86image:win11-20250610-enlocale:en-usos:windows11-21h2-x64system
submitted
22/07/2025, 06:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
rw6eMTC.exe
Size 5.2MB
Sample250722-gxbvysswhy
SHA256 f28ec66ea72ab255e028b98e3103070e0e412030352b9c66aaf696266fed38ca
MD5 9c004138bea1f426fa43b6edbae46da0
SHA1 a7a56f18c067ce06762c335e471b500551683905
SHA512 d47adea1fe88abc847c5eb7b4678f5bdb143a071200f3473b98a7be5bf88bc14f72573d057e45f0b2e1335a437c3f3a526a80e8c0d81146dd16fdda1356fd4cf
SSDEEP 98304:+p4g1jNGVAjP3tZytkWWr42NZtQwR+r1gzAvtvPHyb2tbklDL0qnKVOqzCX/O84M:+p4g7sMPKtkWWrXmwMrFXSb0oCHCPO7M
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

deerstealer donutloader hijackloader discovery loader spyware stealer

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\gahPatch
inject_dll
%windir%\SysWOW64\pla.dll

xor.hex

Signatures

DeerStealer
DeerStealer is a sophisticated information stealer written in C++.
stealer deerstealer
Deerstealer family
deerstealer

Detects DeerStealer 5 IoCs

stealer

resource	yara_rule
behavioral2/memory/1016-77-0x00007FF70ADA0000-0x00007FF70B086000-memory.dmp	family_deerstealer
behavioral2/memory/1016-82-0x00007FF70ADA0000-0x00007FF70B086000-memory.dmp	family_deerstealer
behavioral2/memory/1016-83-0x00007FF70ADA0000-0x00007FF70B086000-memory.dmp	family_deerstealer
behavioral2/memory/1016-123-0x00007FF70ADA0000-0x00007FF70B086000-memory.dmp	family_deerstealer
behavioral2/memory/1016-170-0x00007FF70ADA0000-0x00007FF70B086000-memory.dmp	family_deerstealer

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral2/memory/1016-170-0x00007FF70ADA0000-0x00007FF70B086000-memory.dmp	family_donutloader

Detects HijackLoader (aka IDAT Loader) 1 IoCs

resource	yara_rule
behavioral2/files/0x002000000002b042-37.dat	family_hijackloader

DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader
Donutloader family
donutloader
HijackLoader
HijackLoader is a multistage loader first seen in 2023.
loader hijackloader
Hijackloader family
hijackloader

Executes dropped EXE 2 IoCs

pid	Process
5432	SwitchEnterprise.exe
1592	SwitchEnterprise.exe

Loads dropped DLL 15 IoCs

pid	Process
5432	SwitchEnterprise.exe
5432	SwitchEnterprise.exe
5432	SwitchEnterprise.exe
5432	SwitchEnterprise.exe
5432	SwitchEnterprise.exe
5432	SwitchEnterprise.exe
5432	SwitchEnterprise.exe
5432	SwitchEnterprise.exe
1592	SwitchEnterprise.exe
1592	SwitchEnterprise.exe
1592	SwitchEnterprise.exe
1592	SwitchEnterprise.exe
1592	SwitchEnterprise.exe
1592	SwitchEnterprise.exe
1016	FFramework64.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1592 set thread context of 1016	1592	SwitchEnterprise.exe	83

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rw6eMTC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SwitchEnterprise.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SwitchEnterprise.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
5432	SwitchEnterprise.exe
1592	SwitchEnterprise.exe
1592	SwitchEnterprise.exe
1592	SwitchEnterprise.exe
1592	SwitchEnterprise.exe
1016	FFramework64.exe
1016	FFramework64.exe
1084	chrome.exe
1084	chrome.exe
1016	FFramework64.exe
1016	FFramework64.exe
1016	FFramework64.exe
1016	FFramework64.exe
1016	FFramework64.exe
1016	FFramework64.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1592	SwitchEnterprise.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1084	chrome.exe
Token: SeCreatePagefilePrivilege	1084	chrome.exe
Token: SeShutdownPrivilege	1084	chrome.exe
Token: SeCreatePagefilePrivilege	1084	chrome.exe
Token: SeShutdownPrivilege	1084	chrome.exe
Token: SeCreatePagefilePrivilege	1084	chrome.exe
Token: SeShutdownPrivilege	1084	chrome.exe
Token: SeCreatePagefilePrivilege	1084	chrome.exe
Token: SeShutdownPrivilege	1084	chrome.exe
Token: SeCreatePagefilePrivilege	1084	chrome.exe
Token: SeShutdownPrivilege	1084	chrome.exe
Token: SeCreatePagefilePrivilege	1084	chrome.exe
Token: SeShutdownPrivilege	1084	chrome.exe
Token: SeCreatePagefilePrivilege	1084	chrome.exe
Token: SeShutdownPrivilege	1084	chrome.exe
Token: SeCreatePagefilePrivilege	1084	chrome.exe
Token: SeShutdownPrivilege	1084	chrome.exe
Token: SeCreatePagefilePrivilege	1084	chrome.exe
Token: SeShutdownPrivilege	1084	chrome.exe
Token: SeCreatePagefilePrivilege	1084	chrome.exe
Token: SeShutdownPrivilege	1084	chrome.exe
Token: SeCreatePagefilePrivilege	1084	chrome.exe
Token: SeShutdownPrivilege	1084	chrome.exe
Token: SeCreatePagefilePrivilege	1084	chrome.exe
Token: SeShutdownPrivilege	1084	chrome.exe
Token: SeCreatePagefilePrivilege	1084	chrome.exe
Token: SeShutdownPrivilege	1084	chrome.exe
Token: SeCreatePagefilePrivilege	1084	chrome.exe
Token: SeShutdownPrivilege	1084	chrome.exe
Token: SeCreatePagefilePrivilege	1084	chrome.exe
Token: SeShutdownPrivilege	1084	chrome.exe
Token: SeCreatePagefilePrivilege	1084	chrome.exe
Token: SeShutdownPrivilege	1084	chrome.exe
Token: SeCreatePagefilePrivilege	1084	chrome.exe
Token: SeShutdownPrivilege	1084	chrome.exe
Token: SeCreatePagefilePrivilege	1084	chrome.exe
Token: SeShutdownPrivilege	1084	chrome.exe
Token: SeCreatePagefilePrivilege	1084	chrome.exe
Token: SeShutdownPrivilege	1084	chrome.exe
Token: SeCreatePagefilePrivilege	1084	chrome.exe
Token: SeShutdownPrivilege	1084	chrome.exe
Token: SeCreatePagefilePrivilege	1084	chrome.exe
Token: SeShutdownPrivilege	1084	chrome.exe
Token: SeCreatePagefilePrivilege	1084	chrome.exe
Token: SeShutdownPrivilege	1084	chrome.exe
Token: SeCreatePagefilePrivilege	1084	chrome.exe
Token: SeShutdownPrivilege	1084	chrome.exe
Token: SeCreatePagefilePrivilege	1084	chrome.exe
Token: SeShutdownPrivilege	1084	chrome.exe
Token: SeCreatePagefilePrivilege	1084	chrome.exe
Token: SeShutdownPrivilege	1084	chrome.exe
Token: SeCreatePagefilePrivilege	1084	chrome.exe
Token: SeShutdownPrivilege	1084	chrome.exe
Token: SeCreatePagefilePrivilege	1084	chrome.exe
Token: SeShutdownPrivilege	1084	chrome.exe
Token: SeCreatePagefilePrivilege	1084	chrome.exe
Token: SeShutdownPrivilege	1084	chrome.exe
Token: SeCreatePagefilePrivilege	1084	chrome.exe
Token: SeShutdownPrivilege	1084	chrome.exe
Token: SeCreatePagefilePrivilege	1084	chrome.exe
Token: SeShutdownPrivilege	1084	chrome.exe
Token: SeCreatePagefilePrivilege	1084	chrome.exe
Token: SeShutdownPrivilege	1084	chrome.exe
Token: SeCreatePagefilePrivilege	1084	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5264 wrote to memory of 5432	5264	rw6eMTC.exe	81
PID 5264 wrote to memory of 5432	5264	rw6eMTC.exe	81
PID 5264 wrote to memory of 5432	5264	rw6eMTC.exe	81
PID 5432 wrote to memory of 1592	5432	SwitchEnterprise.exe	82
PID 5432 wrote to memory of 1592	5432	SwitchEnterprise.exe	82
PID 5432 wrote to memory of 1592	5432	SwitchEnterprise.exe	82
PID 1592 wrote to memory of 1016	1592	SwitchEnterprise.exe	83
PID 1592 wrote to memory of 1016	1592	SwitchEnterprise.exe	83
PID 1592 wrote to memory of 1016	1592	SwitchEnterprise.exe	83
PID 1592 wrote to memory of 1016	1592	SwitchEnterprise.exe	83
PID 1592 wrote to memory of 3316	1592	SwitchEnterprise.exe	84
PID 1592 wrote to memory of 3316	1592	SwitchEnterprise.exe	84
PID 1592 wrote to memory of 3316	1592	SwitchEnterprise.exe	84
PID 1016 wrote to memory of 1084	1016	FFramework64.exe	85
PID 1016 wrote to memory of 1084	1016	FFramework64.exe	85
PID 1084 wrote to memory of 2464	1084	chrome.exe	86
PID 1084 wrote to memory of 2464	1084	chrome.exe	86
PID 1084 wrote to memory of 3152	1084	chrome.exe	88
PID 1084 wrote to memory of 3152	1084	chrome.exe	88
PID 1084 wrote to memory of 2700	1084	chrome.exe	89
PID 1084 wrote to memory of 2700	1084	chrome.exe	89
PID 1084 wrote to memory of 3152	1084	chrome.exe	88
PID 1084 wrote to memory of 3152	1084	chrome.exe	88
PID 1084 wrote to memory of 3152	1084	chrome.exe	88
PID 1084 wrote to memory of 3152	1084	chrome.exe	88
PID 1084 wrote to memory of 3152	1084	chrome.exe	88
PID 1084 wrote to memory of 3152	1084	chrome.exe	88
PID 1084 wrote to memory of 3152	1084	chrome.exe	88
PID 1084 wrote to memory of 3152	1084	chrome.exe	88
PID 1084 wrote to memory of 3152	1084	chrome.exe	88
PID 1084 wrote to memory of 3152	1084	chrome.exe	88
PID 1084 wrote to memory of 3152	1084	chrome.exe	88
PID 1084 wrote to memory of 3152	1084	chrome.exe	88
PID 1084 wrote to memory of 3152	1084	chrome.exe	88
PID 1084 wrote to memory of 3152	1084	chrome.exe	88
PID 1084 wrote to memory of 3152	1084	chrome.exe	88
PID 1084 wrote to memory of 3152	1084	chrome.exe	88
PID 1084 wrote to memory of 3152	1084	chrome.exe	88
PID 1084 wrote to memory of 3152	1084	chrome.exe	88
PID 1084 wrote to memory of 3152	1084	chrome.exe	88
PID 1084 wrote to memory of 3152	1084	chrome.exe	88
PID 1084 wrote to memory of 3152	1084	chrome.exe	88
PID 1084 wrote to memory of 3152	1084	chrome.exe	88
PID 1084 wrote to memory of 3152	1084	chrome.exe	88
PID 1084 wrote to memory of 3152	1084	chrome.exe	88
PID 1084 wrote to memory of 3152	1084	chrome.exe	88
PID 1084 wrote to memory of 3152	1084	chrome.exe	88
PID 1084 wrote to memory of 3152	1084	chrome.exe	88
PID 1084 wrote to memory of 3152	1084	chrome.exe	88
PID 1084 wrote to memory of 2092	1084	chrome.exe	90
PID 1084 wrote to memory of 2092	1084	chrome.exe	90
PID 1084 wrote to memory of 2092	1084	chrome.exe	90
PID 1084 wrote to memory of 2092	1084	chrome.exe	90
PID 1084 wrote to memory of 2092	1084	chrome.exe	90
PID 1084 wrote to memory of 2092	1084	chrome.exe	90
PID 1084 wrote to memory of 2092	1084	chrome.exe	90
PID 1084 wrote to memory of 2092	1084	chrome.exe	90
PID 1084 wrote to memory of 2092	1084	chrome.exe	90
PID 1084 wrote to memory of 2092	1084	chrome.exe	90
PID 1084 wrote to memory of 2092	1084	chrome.exe	90
PID 1084 wrote to memory of 2092	1084	chrome.exe	90
PID 1084 wrote to memory of 2092	1084	chrome.exe	90
PID 1084 wrote to memory of 2092	1084	chrome.exe	90
PID 1084 wrote to memory of 2092	1084	chrome.exe	90

C:\Users\Admin\AppData\Local\Temp\rw6eMTC.exe
"C:\Users\Admin\AppData\Local\Temp\rw6eMTC.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5264
- C:\Users\Admin\AppData\Local\Temp\SwitchEnterprise.exe
  "C:\Users\Admin\AppData\Local\Temp\SwitchEnterprise.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5432
- - C:\ProgramData\gahPatch\SwitchEnterprise.exe
    C:\ProgramData\gahPatch\SwitchEnterprise.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:1592
  - - C:\Users\Admin\AppData\Local\FFramework64.exe
      C:\Users\Admin\AppData\Local\FFramework64.exe
      4⤵
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1016
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1084
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffce95ddcf8,0x7ffce95ddd04,0x7ffce95ddd10
        6⤵
        
        PID:2464
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2176,i,7040667295627222969,15828182660145174067,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=2172 /prefetch:2
        6⤵
        
        PID:3152
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1904,i,7040667295627222969,15828182660145174067,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=2160 /prefetch:11
        6⤵
        
        PID:2700
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2384,i,7040667295627222969,15828182660145174067,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=2444 /prefetch:13
        6⤵
        
        PID:2092
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3220,i,7040667295627222969,15828182660145174067,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=3244 /prefetch:1
        6⤵
        
        PID:5608
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3268,i,7040667295627222969,15828182660145174067,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=3404 /prefetch:1
        6⤵
        
        PID:6136
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4296,i,7040667295627222969,15828182660145174067,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=4352 /prefetch:9
        6⤵
        
        PID:4000
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4700,i,7040667295627222969,15828182660145174067,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=3364 /prefetch:1
        6⤵
        
        PID:1556
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=212,i,7040667295627222969,15828182660145174067,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=5476 /prefetch:14
        6⤵
        
        PID:5352
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5448,i,7040667295627222969,15828182660145174067,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=5516 /prefetch:14
        6⤵
        
        PID:5848
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5452,i,7040667295627222969,15828182660145174067,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=5552 /prefetch:14
        6⤵
        
        PID:1132
  - - C:\Users\Admin\AppData\Roaming\gahPatch\XPFix.exe
      "C:\Users\Admin\AppData\Roaming\gahPatch\XPFix.exe" "C:\Users\Admin\AppData\Roaming\gahPatch\XPFix.exe" /u
      4⤵
      PID:3316

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:3872

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:2852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FFramework64.exe

Path C:\Users\Admin\AppData\Local\FFramework64.exe
Size 72KB
SHA256 30e29e655b10f50fcb55a14970bfdb7da56655023ea89df752e14abcce8d2740
MD5 a72bbfeebe485506e930d35f95463319
SHA1 e7c4c7c417874611d7cbf5146f8e8808a10afa44
SHA512 4e39d6c2195f7b8853ddbdf28bc7395c12202e0917a19a262dfaa82bb8ec8fbf7b1a0107f3ccd235590d59d51b018e59aa4949c11b466d434fa5a87741ac7a65
SSDEEP 1536:3ZT7olo3MlJYsQhmrqJaXBZ48tqsWN5RRGTdJNGU:3ZT0lo3MTYsZrqJadETCJP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f5c317aa3822b8c3c6ee904bbb232d7f6981843f43021261af1516b68be01958
MD5 57bc3c89bd9043368de68617c485b492
SHA1 2026f8d0dd7366d2bc0dcef77a97597869b3263f
SHA512 fd140823982ecfb236502a5b72d5525cb9d7c8f792c9eaba9a9af1a20ed6d56870462f7a6da2d307281d1e486e5bf8e01cd6bfb018015db56f90b3633e5f1fff
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 6283e58aad7c3ea3a39d38e754026f3b397b73de810609a0a0ba341d1c21accf
MD5 2a756c8e286be3f5c388d4af3ef77804
SHA1 e8baec5de2542e95c409fbaa30ddc8e8825bae01
SHA512 9883c253efd9ea80eb9af3c88a014a9b2cad87459ee74bea2329c518358bdbf686e571047acac8f54d96215d3d8de0e92f3f99cdff1ce813e8aaf06a22ba23d8
SSDEEP 192:ssYyBXXxVeG/S85Z78kyHz72Z8PRpMKHS+WNnzLoCz0zUqokwg8FpQyIsnA/g4:ssYyBXXxoSX78kyHz73XMecn3oCzMU7Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 15KB
SHA256 7e0348d8187ed56e1073dc505da43bc12c82c0b5d95edfb65b03d84c4e23f760
MD5 9e8ef01f5a1cab34ea4ab831fef343bf
SHA1 ebc3633e024813f854e85568b45d3542dc0827b0
SHA512 885e17717544abe82cc8779aa7b39be2faa5b292b53a3836fc88a5426a7f40c2892454fa530ad9cfbf86f004d1a0be446f52d778292516a42de2305c527020c2
SSDEEP 384:Oy9s7pLuLcgh2zXcNPkXqKf/pUZNCgVLH2Hf1iTrUjwHGsP/n6Py:Oms7pLuLpIbcNPkXqKf/pUZNCgVLH2H8
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 48B
SHA256 2e9dbc815f3d3e23ab6a02c02229b5163fb2f8cfdb043ad7e996ef7321c2c3de
MD5 c08a0bb48522085722c3047fb2c01ee8
SHA1 05b432dcbba19f0ec91b9d8734ebcc270ca2c65b
SHA512 4703ec995614c7e5e3a3a3b22a7c37a31180666f2a2637177e143bf445ec5363a014146d81a4a1a9ef1b98bf0e876f91a8b21c7ed12454819f0cb7ef427d680c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 2e847710bf22e2bb16410a8b450cb74e53f95bd61edddacf5c8b0e0bb01e1975
MD5 d0e3ec23877d88d01e4b45d7ac0062a0
SHA1 a133b1bcd983b8a6fd6505b7892583f933045ca6
SHA512 5db6e6c22549f45f45efd1ad981aeea54bee95ecf2a56a2a4ea09f8a92ba6733db5a09688a9f9986f328524e16a5abd50699a2dae41c6f28ffa864e7afff0bd5
MD5 SHA1 SHA512

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 7114eaf0a021d2eb098b1e9f56f3500dc4f74ac68a87f5256922e4a4b9fa66b7
MD5 a4710a30ca124ef24daf2c2462a1da92
SHA1 96958e2fe60d71e08ea922dfd5e69a50e38cc5db
SHA512 43878e3bc6479df9e4ebd11092be61a73ab5a1441cd0bc8755edd401d37032c44a7279bab477c01d563ab4fa5d8078c0ba163a9207383538e894e0a7ff5a3e15
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 83KB
SHA256 e3369760e3d4434669e18cb069458df5d0f47d0cd1b285149a993cc63d3dcc05
MD5 db8656aae43f45f5fef85301810d7d50
SHA1 9781566a304b125736698fb647d84e3c0bea05bb
SHA512 f29e48304f8203802974190e7425da05001bb28e1e82ec7edd8c8d2104b5ec51f2868d20a534cd9946e82fb6d700a14334aa2e53951b5344d04ca4ef50a380e5
SSDEEP 1536:5NksxljC0EBdn5OpSEwcrySR05w5haVHhhd/TyezEHMT5QhLA/oWjIm0myq:o3d5OdDrPMw/I9TymEsdQRA/jUu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 82KB
SHA256 23a80bbc3c83f4c2bfa572dc6c6dc3d23360edf758715fa8d0852ff805fefc18
MD5 234ed6bd61230743a161e7f23c3c9d73
SHA1 3740f88039adb8ef55aac13dd23ca1fa3e085998
SHA512 bbf7742576e10189f2c5c59c60fd936c7565b5fbde5b07e21fbd55a49004bce166d5295bf2b56327481dd2a838a78e0fd7cf05f3702459ad4dd1c86be708c227
SSDEEP 1536:sksq+jbdn5OpSEwcrySR05w5haVHhhd/TyezEHMT5QhLA/oWjIm0myR:vcd5OdDrPMw/I9TymEsdQRA/jUl
MD5 SHA1 SHA512 SSDEEP

Submit Download

dc714332-780f-4ae8-802b-9310753713ee.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\dc714332-780f-4ae8-802b-9310753713ee.tmp
Size 83KB
SHA256 0414cab44b88d4812fe3495db2e30aaf8cc19ffa1e8b8782bb4e40c4b12d51a9
MD5 31bcd8199b2b2ebc8e912953ea8e0e10
SHA1 5546e04109dcdd44ab37cd4f2b5a93b41b5fd75a
SHA512 09d48fb9accbacb934a45152beb8ca0e5ce974f5d72d544568c0ab3fb0f476a1e22204593b3e6dc74e3a4d1b27e8b87e20bfa1e676fed973c5850f98af1d1379
SSDEEP 1536:5aksxljC0EBdn5OpSEwcrySR05w5haVHhhd/TyezEHMT5QhLA/oWjIm0myq:/3d5OdDrPMw/I9TymEsdQRA/jUu
MD5 SHA1 SHA512 SSDEEP

Submit Download

ADB858B.tmp

Path C:\Users\Admin\AppData\Local\Temp\ADB858B.tmp
Size 3.1MB
SHA256 1ed3aa8284dfdf1711b3630bab6948479b6a17d226815fa6b617ae1700c9d698
MD5 cf40822ae199f2b45cff2a3e6a8477bb
SHA1 0372165c97230bc26adfc984c1ac31cab64378d3
SHA512 f16a69a9f17dfe6c2d1eea8b29acb1facda5e0df3e686e95c5868b8761ad38618a25d99fc557b364a94f56105b81d182c5f104b97e3da3ccdb788ca25314cd9d
SSDEEP 98304:GMRWFyV34FUD60NFA0QDOyKABcHp20fyBS4koiQN3ncWGK:fkwVki6synKABcVyBruWGK
MD5 SHA1 SHA512 SSDEEP

Submit Download

EC8AEC0.tmp

Path C:\Users\Admin\AppData\Local\Temp\EC8AEC0.tmp
Size 40B
SHA256 cad2daa67838cbd4210152f6ab348323bd3b14bd14c48d11f670fc3cd1b4045c
MD5 fda02cd46a8c210f4c01823514fd49e2
SHA1 4da8ba66f9f8be0cb771e5bc613fc469045ffe62
SHA512 2dfddf940fdada706c306b49029ad9d2ca568d804f1af3805823550f3733ced9d66571eb03dfa858ae0e292d0801ecb579ec44d9a714270e85d96c9c1a4880e6
MD5 SHA1 SHA512

Submit Download

FileAssociation.dll

Path C:\Users\Admin\AppData\Local\Temp\FileAssociation.dll
Size 584KB
SHA256 95d51ee9c58f789213cedac7e82c7ba064364d9e5c8ca76ad27a5e53537f9fdf
MD5 ea728eeea179f3ef8a80a03ae84378c9
SHA1 1afd6e8aa977bf75a6c76f4fbd21c5ca2d765658
SHA512 212058ffc067cda2143a2ccfe8ad22c2254334f6a83090237d8f55c9028e8209bb2b52bfea7ac8aaf29ebfdd3633ca0802ae5dfa5790ade9285a46065f77e593
SSDEEP 12288:X5v6LSfcaS28r5qyLxzQhFEcTEyX2k8YStmejph0lhSMXleYjA9q+3K0:X5HcZ28DpiEcTEymk8YXeVh0lhSMXl9S
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kredcheb.tj

Path C:\Users\Admin\AppData\Local\Temp\Kredcheb.tj
Size 31KB
SHA256 3531b384b01f1f7e58899585e2002af7f1b3e9a93677eecacd45166cd8db593b
MD5 b148e717bf56a103eddaef56f74ae2f3
SHA1 a7978c9c5bf05eddced1322aada2e7be7accb4b8
SHA512 a9550df25bd592338c9be4cbd9f110734381850d5703209ac7d92409352689549e2949b438f4529bc2ff00e326c4698228eb5899df573f18d0987bceda45583c
SSDEEP 768:dqREw7u8DakNIdJEDFgXSPPRxJlvi+ybQ4KnBjWh6q:dqCwCkajQISnJ6GNW3
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSVCP140.dll

Path C:\Users\Admin\AppData\Local\Temp\MSVCP140.dll
Size 439KB
SHA256 718812adb0d669eea9606432202371e358c7de6cdeafeddad222c36ae0d3f263
MD5 4d157073a891d0832b9b05fb8aca73a8
SHA1 551efcdd93ecafc6b54ebb6f8f38c505d42d61ca
SHA512 141563450e4cdf44315270360414f339fc3c96ebdaa46e28a1f673237c30f5e94e6da271db67547499c14dc3bd10e39767c3b6a2a3c9cec0a64a11f0263e0c5d
SSDEEP 12288:6rK6LQK2R9Y9huTJzNa/LNE4Qclv5wDAb0qhUgiW6QR7t5s03Ooc8dHkC2esjaoq:ANZ2R9Y9huTJzNcNE4Qclv5wDA0p03O4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Prol.uw

Path C:\Users\Admin\AppData\Local\Temp\Prol.uw
Size 2.9MB
SHA256 bf63ee45a7d4e0e84d3834af32ac3488c5b2e8709ae4b4b638e6b4ab7f16fdb8
MD5 f431909cd7e4ea732a47d4d45951d576
SHA1 686a96aa41a50ecf9e385c95891569eefe9499f0
SHA512 7bf30b31b736cb0f70484d168862e59535747a7d2ce572fe2744c6bd68233ca10f34de326473fde3083190a5e98c9090b335a6a81c9e273674d8cf7953784f0d
SSDEEP 49152:nY3LBUnTT+xupmPSwOlK9l8+xYxzddGzaWvuRP6RkG5cWmhii7h:sqnTTDcawOlYY1ddGHvueAiiF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qt5Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Qt5Core.dll
Size 5.1MB
SHA256 9c16c4f43abb1ef6bdbb07c241f32d51530b018bdce9f6a574f8534c96dfa12d
MD5 b8a0e5a71b2ecbd110c1bef9f0cb7be7
SHA1 0ee8cee1f231bb95587fc542b27c19dfba6917e8
SHA512 278946feae9bf0e0edd93e2f0db948d19db4ee03c634560b3263f440fbf977cf294e7208e8bec0323411cf1ec4974729d701e53a54d2d27da419758c1b0d1050
SSDEEP 98304:h3QkIHj14FdDTqJsv6tWKFdu9CjzHveRnZyxEdGK:hgdxJsv6tWKFdu9CjzHe1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qt5Network.dll

Path C:\Users\Admin\AppData\Local\Temp\Qt5Network.dll
Size 1.1MB
SHA256 ddc9894e36231d749265155ba02f2d70ec5e006cea34010750b220ce49ce391a
MD5 a00d38af148cc8a6481ef182f86b77ed
SHA1 76b401ee60ca094d3da04524401e5d6eb80d3bb6
SHA512 0bfc7d1ad67d8ba837a76f91876ab4cf452712017d0698bdc4e4c6496b084829bd03d93f76ab6a9bc0793b8ba1216fef9de927b849842ed362e135715ef5b9fd
SSDEEP 24576:TNfY4/b8d22Gmou3ZjRkjZgUPiV69DrOMxpqDc0EGQVzKa+:7Ad22GrziVaSDckf
MD5 SHA1 SHA512 SSDEEP

Submit Download

SwitchEnterprise.exe

Path C:\Users\Admin\AppData\Local\Temp\SwitchEnterprise.exe
Size 239KB
SHA256 79384ef76740962757d617bc056bf8a45b2ef8f1e1587632b36830e2fc6ab21a
MD5 a0b05f899a022110debaf359f4c8e000
SHA1 e8ea8b05a99337bc82403ecfc8a5dbd507112ad7
SHA512 113191932b1fd55acfb09a7fcb1ab30bdeaa2b9de04f9fdfa9a7f4a70805becea7a8e2dbb0d971abae85c93602f73a951609c6f0f10907eedb5c74702bf58185
SSDEEP 3072:ppmxSLq48zrTM3AlCCngq004MWgMc46YSn2lDdiCbIcRQNPkydL051ELKrEmIC:pUxSLb8zrTM5qp/wJdMcRQGydQ5iefH
MD5 SHA1 SHA512 SSDEEP

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\VCRUNTIME140.dll
Size 88KB
SHA256 09d1e604e8cdd06176fcc3d3698861be20638a4391f9f2d9e23f868c1576ca94
MD5 e4ed441f0f6afb0d8d55af87900ec48f
SHA1 ac5bd77fd06ed29bebceb65371387555658870d9
SHA512 dec6d693aa2d6c043ef8ae35f7f613cf9366aeb8a5903e8e0c54644f799262229b91953c65d39f8535ce464c75bf34b3b23ddb50a9fc5f171d36d6bfa1e4d7dd
SSDEEP 1536:obiyVUrqIQsn1xtg6RxkkBGCGHDWbWzaecbGaBLL9Qzv6mzm:yiyLyt/xcRjWazaecbGCWba
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1016-83-0x00007FF70ADA0000-0x00007FF70B086000-memory.dmp

Download

memory/1016-170-0x00007FF70ADA0000-0x00007FF70B086000-memory.dmp

Download

memory/1016-82-0x00007FF70ADA0000-0x00007FF70B086000-memory.dmp

Download

memory/1016-77-0x00007FF70ADA0000-0x00007FF70B086000-memory.dmp

Download

memory/1016-123-0x00007FF70ADA0000-0x00007FF70B086000-memory.dmp

Download

memory/1592-72-0x0000000072CE0000-0x0000000072E5D000-memory.dmp

Download

memory/1592-74-0x0000000072CE0000-0x0000000072E5D000-memory.dmp

Download

memory/1592-70-0x0000000072CE0000-0x0000000072E5D000-memory.dmp

Download

memory/1592-75-0x0000000072CE0000-0x0000000072E5D000-memory.dmp

Download

memory/1592-69-0x0000000072CF5000-0x0000000072CF6000-memory.dmp

Download

memory/1592-65-0x00007FFCF88C0000-0x00007FFCF8AC9000-memory.dmp

Download

memory/1592-64-0x0000000072CE0000-0x0000000072E5D000-memory.dmp

Download

memory/5432-38-0x0000000072B20000-0x0000000072C9D000-memory.dmp

Download

memory/5432-39-0x00007FFCF88C0000-0x00007FFCF8AC9000-memory.dmp

Download