stealc | 3fc816ea2ef66937e3c57f0a0196a2248ad3cccfbc22f693fa7bc4543d37a841

Resubmissions

27/11/2025, 16:01

251127-tgqqdsync110

26/11/2025, 23:16

251126-29lk5sgr7t10

Analysis

max time kernel
153s
max time network
159s
platform
windows11-21h2_x64
resource
win11-20251015-en
resource tags

arch:x64arch:x86image:win11-20251015-enlocale:en-usos:windows11-21h2-x64system
submitted
27/11/2025, 16:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
need for speed hot pursuit limited edition serial keygen.exe
Size 863.9MB
Sample251127-tgqqdsync1
SHA256 3fc816ea2ef66937e3c57f0a0196a2248ad3cccfbc22f693fa7bc4543d37a841
MD5 1d9259346e753743b72cc442c41e3e10
SHA1 fa158a69afd7dc83a23bfcac3932024e7ac1a7d9
SHA512 d7e1de52a12acd5ed631b74b72715c3a230dc89a4bd7cebb89df52a45a0ee56c8c31b37a2c40a04aad4bdb436e7eaed62cb3fb9248f149ceb8985e4b4fdaabc2
SSDEEP 393216:EefbYGTlRWkcUILP4ptXvOk0WSEwhp2+z8RExwYUpSCKA:EefMyWHU6P4vXWk/3w7Ud
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

3cba7d4634e0824669438afe97b73f93 pressf discovery stealc vidar spyware stealer

Malware Config

Extracted

Family

stealc

Botnet

pressf

http://45.149.154.97

Attributes

url_path
/a927e02a8d5e42df.php

rc4.plain

Extracted

Family

vidar

Version

16.8

Botnet

3cba7d4634e0824669438afe97b73f93

Signatures

Detects Vidar Stealer 2 IoCs

stealer

resource	yara_rule
behavioral2/memory/5088-65-0x0000000140000000-0x0000000140188000-memory.dmp	family_vidar_v15
behavioral2/memory/5088-186-0x0000000140000000-0x0000000140188000-memory.dmp	family_vidar_v15

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Custom signature

Vidar 2.0 1 IoCs

Vidar is an infostealer based on Arkei stealer.

stealer

resource	yara_rule
behavioral2/memory/5088-186-0x0000000140000000-0x0000000140188000-memory.dmp	Vidar

Vidar family
vidar

Executes dropped EXE 1 IoCs

pid	Process
5088	Yo0EWbtjlSmG.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	need for speed hot pursuit limited edition serial keygen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	need for speed hot pursuit limited edition serial keygen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Yo0EWbtjlSmG.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Yo0EWbtjlSmG.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 54 IoCs

pid	Process
2144	need for speed hot pursuit limited edition serial keygen.exe
2144	need for speed hot pursuit limited edition serial keygen.exe
5088	Yo0EWbtjlSmG.exe
5088	Yo0EWbtjlSmG.exe
5088	Yo0EWbtjlSmG.exe
5088	Yo0EWbtjlSmG.exe
5088	Yo0EWbtjlSmG.exe
5088	Yo0EWbtjlSmG.exe
5088	Yo0EWbtjlSmG.exe
5088	Yo0EWbtjlSmG.exe
5088	Yo0EWbtjlSmG.exe
5088	Yo0EWbtjlSmG.exe
5088	Yo0EWbtjlSmG.exe
5088	Yo0EWbtjlSmG.exe
5088	Yo0EWbtjlSmG.exe
5088	Yo0EWbtjlSmG.exe
5088	Yo0EWbtjlSmG.exe
5088	Yo0EWbtjlSmG.exe
5088	Yo0EWbtjlSmG.exe
5088	Yo0EWbtjlSmG.exe
5088	Yo0EWbtjlSmG.exe
5088	Yo0EWbtjlSmG.exe
5088	Yo0EWbtjlSmG.exe
5088	Yo0EWbtjlSmG.exe
5088	Yo0EWbtjlSmG.exe
4856	chrome.exe
4856	chrome.exe
5088	Yo0EWbtjlSmG.exe
5088	Yo0EWbtjlSmG.exe
5088	Yo0EWbtjlSmG.exe
5088	Yo0EWbtjlSmG.exe
5088	Yo0EWbtjlSmG.exe
5088	Yo0EWbtjlSmG.exe
5088	Yo0EWbtjlSmG.exe
5088	Yo0EWbtjlSmG.exe
5088	Yo0EWbtjlSmG.exe
5088	Yo0EWbtjlSmG.exe
5088	Yo0EWbtjlSmG.exe
5088	Yo0EWbtjlSmG.exe
5088	Yo0EWbtjlSmG.exe
5088	Yo0EWbtjlSmG.exe
5088	Yo0EWbtjlSmG.exe
5088	Yo0EWbtjlSmG.exe
5088	Yo0EWbtjlSmG.exe
5088	Yo0EWbtjlSmG.exe
5088	Yo0EWbtjlSmG.exe
5088	Yo0EWbtjlSmG.exe
5088	Yo0EWbtjlSmG.exe
5088	Yo0EWbtjlSmG.exe
5088	Yo0EWbtjlSmG.exe
5088	Yo0EWbtjlSmG.exe
5088	Yo0EWbtjlSmG.exe
5088	Yo0EWbtjlSmG.exe
5088	Yo0EWbtjlSmG.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
744	msedge.exe
744	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
744	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 5496	2144	need for speed hot pursuit limited edition serial keygen.exe	78
PID 2144 wrote to memory of 5496	2144	need for speed hot pursuit limited edition serial keygen.exe	78
PID 2144 wrote to memory of 5496	2144	need for speed hot pursuit limited edition serial keygen.exe	78
PID 2144 wrote to memory of 5672	2144	need for speed hot pursuit limited edition serial keygen.exe	80
PID 2144 wrote to memory of 5672	2144	need for speed hot pursuit limited edition serial keygen.exe	80
PID 2144 wrote to memory of 5672	2144	need for speed hot pursuit limited edition serial keygen.exe	80
PID 2144 wrote to memory of 5088	2144	need for speed hot pursuit limited edition serial keygen.exe	82
PID 2144 wrote to memory of 5088	2144	need for speed hot pursuit limited edition serial keygen.exe	82
PID 5088 wrote to memory of 4856	5088	Yo0EWbtjlSmG.exe	83
PID 5088 wrote to memory of 4856	5088	Yo0EWbtjlSmG.exe	83
PID 4856 wrote to memory of 5752	4856	chrome.exe	84
PID 4856 wrote to memory of 5752	4856	chrome.exe	84
PID 5088 wrote to memory of 4856	5088	Yo0EWbtjlSmG.exe	83
PID 5088 wrote to memory of 4856	5088	Yo0EWbtjlSmG.exe	83
PID 4856 wrote to memory of 4156	4856	chrome.exe	85
PID 4856 wrote to memory of 4156	4856	chrome.exe	85
PID 4856 wrote to memory of 1628	4856	chrome.exe	86
PID 4856 wrote to memory of 1628	4856	chrome.exe	86
PID 4856 wrote to memory of 4156	4856	chrome.exe	85
PID 4856 wrote to memory of 4156	4856	chrome.exe	85
PID 4856 wrote to memory of 4156	4856	chrome.exe	85
PID 4856 wrote to memory of 4156	4856	chrome.exe	85
PID 4856 wrote to memory of 4156	4856	chrome.exe	85
PID 4856 wrote to memory of 4156	4856	chrome.exe	85
PID 4856 wrote to memory of 4156	4856	chrome.exe	85
PID 4856 wrote to memory of 4156	4856	chrome.exe	85
PID 4856 wrote to memory of 4156	4856	chrome.exe	85
PID 4856 wrote to memory of 4156	4856	chrome.exe	85
PID 4856 wrote to memory of 4156	4856	chrome.exe	85
PID 4856 wrote to memory of 4156	4856	chrome.exe	85
PID 4856 wrote to memory of 4156	4856	chrome.exe	85
PID 4856 wrote to memory of 4156	4856	chrome.exe	85
PID 4856 wrote to memory of 4156	4856	chrome.exe	85
PID 4856 wrote to memory of 4156	4856	chrome.exe	85
PID 4856 wrote to memory of 4156	4856	chrome.exe	85
PID 4856 wrote to memory of 4156	4856	chrome.exe	85
PID 4856 wrote to memory of 4156	4856	chrome.exe	85
PID 4856 wrote to memory of 4156	4856	chrome.exe	85
PID 4856 wrote to memory of 4156	4856	chrome.exe	85
PID 4856 wrote to memory of 4156	4856	chrome.exe	85
PID 4856 wrote to memory of 4156	4856	chrome.exe	85
PID 4856 wrote to memory of 4156	4856	chrome.exe	85
PID 4856 wrote to memory of 4156	4856	chrome.exe	85
PID 4856 wrote to memory of 4156	4856	chrome.exe	85
PID 4856 wrote to memory of 4156	4856	chrome.exe	85
PID 4856 wrote to memory of 4156	4856	chrome.exe	85
PID 4856 wrote to memory of 1672	4856	chrome.exe	88
PID 4856 wrote to memory of 1672	4856	chrome.exe	88
PID 4856 wrote to memory of 1672	4856	chrome.exe	88
PID 4856 wrote to memory of 1672	4856	chrome.exe	88
PID 4856 wrote to memory of 1672	4856	chrome.exe	88
PID 4856 wrote to memory of 1672	4856	chrome.exe	88
PID 4856 wrote to memory of 1672	4856	chrome.exe	88
PID 4856 wrote to memory of 1672	4856	chrome.exe	88
PID 4856 wrote to memory of 1672	4856	chrome.exe	88
PID 4856 wrote to memory of 1672	4856	chrome.exe	88
PID 4856 wrote to memory of 1672	4856	chrome.exe	88
PID 4856 wrote to memory of 1672	4856	chrome.exe	88
PID 4856 wrote to memory of 1672	4856	chrome.exe	88
PID 4856 wrote to memory of 1672	4856	chrome.exe	88
PID 4856 wrote to memory of 1672	4856	chrome.exe	88
PID 4856 wrote to memory of 1672	4856	chrome.exe	88
PID 4856 wrote to memory of 1672	4856	chrome.exe	88
PID 4856 wrote to memory of 1672	4856	chrome.exe	88

C:\Users\Admin\AppData\Local\Temp\need for speed hot pursuit limited edition serial keygen.exe
"C:\Users\Admin\AppData\Local\Temp\need for speed hot pursuit limited edition serial keygen.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:5496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:5672
- C:\Users\Admin\AppData\Local\Yo0EWbtjlSmG.exe
  "C:\Users\Admin\AppData\Local\Yo0EWbtjlSmG.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5088
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4856
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb257edcf8,0x7ffb257edd04,0x7ffb257edd10
      4⤵
      PID:5752
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1960,i,5225650635988841197,5526921808505799684,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=1956 /prefetch:2
      4⤵
      PID:4156
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1484,i,5225650635988841197,5526921808505799684,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=2120 /prefetch:11
      4⤵
      PID:1628
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2320,i,5225650635988841197,5526921808505799684,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=2236 /prefetch:13
      4⤵
      PID:1672
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3220,i,5225650635988841197,5526921808505799684,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=3284 /prefetch:1
      4⤵
      PID:3652
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3228,i,5225650635988841197,5526921808505799684,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=3304 /prefetch:1
      4⤵
      PID:3564
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4244,i,5225650635988841197,5526921808505799684,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=4184 /prefetch:9
      4⤵
      PID:3608
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4600,i,5225650635988841197,5526921808505799684,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=4632 /prefetch:1
      4⤵
      PID:248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory="Default"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    PID:744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f4,0x7ffb257cf208,0x7ffb257cf214,0x7ffb257cf220
      4⤵
      PID:1420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1780,i,3681355910712507530,2451238427667588561,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:11
      4⤵
      PID:5980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2144,i,3681355910712507530,2451238427667588561,262144 --variations-seed-version --mojo-platform-channel-handle=2100 /prefetch:2
      4⤵
      PID:1788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2540,i,3681355910712507530,2451238427667588561,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:13
      4⤵
      PID:5872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3436,i,3681355910712507530,2451238427667588561,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
      4⤵
      PID:5768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3428,i,3681355910712507530,2451238427667588561,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
      4⤵
      PID:5004

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:572

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5972

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:3576

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:3076

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5732

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:3012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2FFE4C56-9461-ADDA-0D3E-598245A6D1AA.txt

Path C:\ProgramData\2FFE4C56-9461-ADDA-0D3E-598245A6D1AA.txt
Size 64B
SHA256 ea143677a6ff51b69e084240afde40fe2d55cbe073d925296ee11b9c2cf74f1e
MD5 6b436c3f98390dbfed4372e28f05205a
SHA1 47c0206c23e45ee2ee0c9cc5288cc7b891bd9110
SHA512 12a39bda509ac670eee962875f41ffe5f20f64c6a229bbc427a34f0ba35e0760df6d11f41af5dac89611089fb0a3a1cae2a2c2fb89736a6fc8db90a70026c9ba
MD5 SHA1 SHA512

Submit Download

2FFE4C56-9461-ADDA-0D3E-598245A6D1AA.txt

Path C:\ProgramData\2FFE4C56-9461-ADDA-0D3E-598245A6D1AA.txt
Size 64B
SHA256 a41f2f5d0691c89ce2d8cb2e20c02bb440fac7d7ecfccf1519dec7b005033a2a
MD5 755263ab423e87f7bd7783b69c75dd6f
SHA1 3ebb3909faddf2b5e3235f55e3177c5c475c7baf
SHA512 f3d65761f55b068ccdf764a7eb0a7ca811c0f82c836c3ce82826730f8bd70dd1f820b2972db0d0bbdee2d88760c717991a41103a6d08734a072cedd3fd028672
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 9343f04c90c5cbf99093ec86cd521f750c6bda6a09c9f1503b4937c497ca03a2
MD5 0c7d9a9e929c2870b0d1c5e4a696795f
SHA1 0a99647155bd8e833346c4bed39617bd441da64f
SHA512 c4b39d5342ac76a00bec38dbb45a748252995037e6361f0fa077f03c6e1a7637c0a1f686238457aaa6996887ffa78b57b054c00d9bbaf02762c1de75cb5af7cb
SSDEEP 3072:DXGx6i79xko7HWrQvhLK1PTEsbWRtHqldg+G/cTP:DWMExki2KL64sbWRtHqldg+G/MP
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 21ddfb155455e1b2bd1e291250ea47e49ffa970172e8ad0bb0eb9e1724cfd0a5
MD5 41e61c453b8182f1c16003e05e93feb3
SHA1 224dee6a422a7559c312cda15f7ecd2899f52d27
SHA512 5256aac6545bcd432d9c38facd8da427ba442bb3e2d6762a33a63ee77e49b50a43f19ef57540ba2b4e677e905febac6afc18ce5657bfacef7599b84d22dbba34
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 68a3a683e790b79943ae7278d33f27a78ed2fc087d21ded552b38d5c87b6b919
MD5 cc0b2f27277b65e6b3a17096fe633def
SHA1 1ca790fea0d78afb8ede14158005b680cd1dec8d
SHA512 7441adf7a1fc3b480d4342a5b5993a822fc6a06dde5dc591c8a99f8b999a142ea890eac2d21ef188ed026b5b5adf81323a6548dc82d4dd90e74974decf0df986
SSDEEP 768:2F5BLv7I5wCPFdV6Zi63UCgbAwHP8EgBJUyT3focjja:+JUV6ZL3cEpU23Njja
MD5 SHA1 SHA512 SSDEEP

Submit Download

c395ba5d-f948-4e96-8d13-48c565869faf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c395ba5d-f948-4e96-8d13-48c565869faf.tmp
Size 35KB
SHA256 b769f8ff163d2ce669ebb92f9598a3d348af975b65e60ac16e91d312e6d8c355
MD5 4312870e49279eba5ee475a0e5391c73
SHA1 e354e69d130b815b59549a0c63273bed1d1e4d34
SHA512 21184846088bb44bcc368570b05b6263ed866c33c7e7b6fe9b2cc91b9cc6366fb0ac0cf30f1b54572f2c6c7abc6526345303a3c8d2ee7eb828f2dc27f948b26e
SSDEEP 768:7F5BLv7I5wCPFdV6Zi63UCgbAwxSJ8EgBxqKfM9Gxfocjja:7JUV6ZL3cxpgKxjjja
MD5 SHA1 SHA512 SSDEEP

Submit Download

V5fOpNHggo1A

Path C:\Users\Admin\AppData\Local\Temp\V5fOpNHggo1A
Size 40KB
SHA256 c007da2e5fd780008f28336940b427c3bfd509c72a40bfb7759592149ff3606e
MD5 dfd4f60adc85fc874327517efed62ff7
SHA1 f97489afb75bfd5ee52892f37383fbc85aa14a69
SHA512 d76f75b1b5b23aa4f87c53ce44c3d3b7e41a44401e53d89f05a114600ea3dcd8beda9ca1977b489ac6ea5586cf26e47396e92d4796c370e89fab0aa76f38f3c4
SSDEEP 96:iLSQCn8MouB6w9f/8iZqmvJKLPeymwil:iLSQG7Iw9fEiSi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Yo0EWbtjlSmG.exe

Path C:\Users\Admin\AppData\Local\Yo0EWbtjlSmG.exe
Size 3.5MB
SHA256 6bca02839862bb2942f412e3707a35fa2ecbccfc4731222da6f85102511c28b3
MD5 9c184eafe2a554e1410ab7838de1380b
SHA1 2c1bf183bc6b4c790a91d5bebfa4c142eb383489
SHA512 c33109669014f3b98c5f753927f3ab7b0e77a014bd8c50549bc2c6c8ea2a2df2f9c087db04b9a0cc9f93e48ba26421ef6a6fe46ea16413cdd0088b560771544b
SSDEEP 49152:QdyF9H+dv6oWMS8bwn5rPZ7hFUYGhGeb5w4ZFq8jkhTQ3:QA6Qr7NGhGGF9jk5Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2144-7-0x0000000140000000-0x00000001400C3000-memory.dmp

Download

memory/2144-63-0x0000000140000000-0x00000001400C3000-memory.dmp

Download

memory/2144-0-0x0000000140000000-0x00000001400C3000-memory.dmp

Download

memory/2144-1-0x0000000140000000-0x00000001400C3000-memory.dmp

Download

memory/2144-4-0x0000000140000000-0x00000001400C3000-memory.dmp

Download

memory/2144-16-0x0000000140000000-0x00000001400C3000-memory.dmp

Download

memory/2144-5-0x0000000140000000-0x00000001400C3000-memory.dmp

Download

memory/2144-33-0x0000000140000000-0x00000001400C3000-memory.dmp

Download

memory/2144-6-0x0000000140000000-0x00000001400C3000-memory.dmp

Download

memory/2144-3-0x0000000140000000-0x00000001400C3000-memory.dmp

Download

memory/2144-64-0x0000000140000000-0x00000001400C3000-memory.dmp

Download

memory/2144-13-0x0000000140000000-0x00000001400C3000-memory.dmp

Download

memory/2144-2-0x0000000140000000-0x00000001400C3000-memory.dmp

Download

memory/2144-8-0x0000000140000000-0x00000001400C3000-memory.dmp

Download

memory/2144-9-0x0000000140000000-0x00000001400C3000-memory.dmp

Download

memory/2144-10-0x0000000140000000-0x00000001400C3000-memory.dmp

Download

memory/2144-12-0x0000000140000000-0x00000001400C3000-memory.dmp

Download

memory/2144-11-0x0000000140000000-0x00000001400C3000-memory.dmp

Download

memory/5088-65-0x0000000140000000-0x0000000140188000-memory.dmp

Download

memory/5088-186-0x0000000140000000-0x0000000140188000-memory.dmp

Download