94189e4d1e03f3afac858be576cc0c1b0ab000dbccb8dcf988fb58059b5a12ff

Analysis

max time kernel
149s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/04/2026, 20:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Build3.exe
Size 337KB
Sample260425-yxcwpahs71
SHA256 94189e4d1e03f3afac858be576cc0c1b0ab000dbccb8dcf988fb58059b5a12ff
MD5 4db00b89de7e7c5721c59c50531b5d38
SHA1 e799cc0768b8a355084871eb4b4aaf840c26667d
SHA512 ee80c8b1f1ac575f0b5f8ae2bee0b4e9c6f70ac6044e4be3285a129e93d74c2b06a2c66860aff725c0e13280b0b744558dc71aff525b514aa46b95ea59a037d4
SSDEEP 6144:XvgEeOcmwvEL7fF1jTA659HSC8AVtZ5XlOHaoIhEFydyt:/8OcZ07bf0OtDlOHaoIndyt
TLSH
T18C747B86E7BB54B0D58B0938259FB33BDF3416294328CEC7DBF0DA4439672E25536A02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Build3.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4744	chrome.exe
2136	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134216213883939420"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-721190819-434563495-2007910846-1000\{D3031940-8F36-4852-AD9C-A7F96AFB51DC}	msedge.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
4580	Build3.exe
4580	Build3.exe
4580	Build3.exe
4580	Build3.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
4580	Build3.exe
4580	Build3.exe
4580	Build3.exe
4580	Build3.exe
4580	Build3.exe
4580	Build3.exe
4580	Build3.exe
4580	Build3.exe
4580	Build3.exe
4580	Build3.exe
4580	Build3.exe
4580	Build3.exe
4580	Build3.exe
4580	Build3.exe
4580	Build3.exe
4580	Build3.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3848	msedge.exe
3848	msedge.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3848	msedge.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 4580 wrote to memory of 3964	4580	Build3.exe	85
PID 3964 wrote to memory of 2036	3964	chrome.exe	86
PID 3964 wrote to memory of 4744	3964	chrome.exe	87
PID 3964 wrote to memory of 4892	3964	chrome.exe	88
PID 3964 wrote to memory of 4892	3964	chrome.exe	88
PID 3964 wrote to memory of 1628	3964	chrome.exe	89
PID 3964 wrote to memory of 1628	3964	chrome.exe	89
PID 3964 wrote to memory of 4956	3964	chrome.exe	90
PID 3964 wrote to memory of 4328	3964	chrome.exe	91
PID 3964 wrote to memory of 4956	3964	chrome.exe	90
PID 3964 wrote to memory of 4328	3964	chrome.exe	91
PID 3964 wrote to memory of 4432	3964	chrome.exe	92
PID 3964 wrote to memory of 4432	3964	chrome.exe	92
PID 3964 wrote to memory of 5496	3964	chrome.exe	94
PID 3964 wrote to memory of 5496	3964	chrome.exe	94
PID 3964 wrote to memory of 5504	3964	chrome.exe	95
PID 4580 wrote to memory of 3848	4580	Build3.exe	97
PID 3848 wrote to memory of 4004	3848	msedge.exe	98
PID 3848 wrote to memory of 2136	3848	msedge.exe	99
PID 3848 wrote to memory of 4488	3848	msedge.exe	100
PID 3848 wrote to memory of 4488	3848	msedge.exe	100
PID 3848 wrote to memory of 1624	3848	msedge.exe	101
PID 3848 wrote to memory of 4488	3848	msedge.exe	100
PID 3848 wrote to memory of 1624	3848	msedge.exe	101
PID 3848 wrote to memory of 2368	3848	msedge.exe	102
PID 3848 wrote to memory of 5960	3848	msedge.exe	103
PID 3848 wrote to memory of 2368	3848	msedge.exe	102
PID 3848 wrote to memory of 2368	3848	msedge.exe	102
PID 3848 wrote to memory of 5960	3848	msedge.exe	103
PID 3848 wrote to memory of 5960	3848	msedge.exe	103
PID 3848 wrote to memory of 2228	3848	msedge.exe	108
PID 3848 wrote to memory of 2228	3848	msedge.exe	108
PID 3848 wrote to memory of 3120	3848	msedge.exe	109
PID 3848 wrote to memory of 1592	3848	msedge.exe	110
PID 3848 wrote to memory of 3120	3848	msedge.exe	109
PID 3848 wrote to memory of 1592	3848	msedge.exe	110
PID 3848 wrote to memory of 5088	3848	msedge.exe	112

C:\Users\Admin\AppData\Local\Temp\Build3.exe
"C:\Users\Admin\AppData\Local\Temp\Build3.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" carytui.vu/api/set_agent?id=4E6EF274BD24956701AEC7B30ADF174C&token=7c6d9e1ac2be7bdf1b73b6d57288153212&description=0d5b0d6e95037f7d0d4d809554f3b6d0&agent=Chrome
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3964
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffda0bfc728,0x7ffda0bfc734,0x7ffda0bfc740
    3⤵
    PID:2036
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2032,i,15348473636745945208,11554373350179244765,524288 --field-trial-handle=2064,i,3716578370183487646,10357117600804212322,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2104 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4744
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1724,i,1789820025292513016,5889279649097366963,262144 --field-trial-handle=2064,i,3716578370183487646,10357117600804212322,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2060 /prefetch:2
    3⤵
    PID:4892
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2412,i,4701764702948502296,11381936996469880887,524288 --field-trial-handle=2064,i,3716578370183487646,10357117600804212322,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2580 /prefetch:8
    3⤵
    PID:1628
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3096,i,3731901454591192322,9220887447256410715,2097152 --field-trial-handle=2064,i,3716578370183487646,10357117600804212322,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3128 /prefetch:1
    3⤵
    PID:4956
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3120,i,13390492097678489177,408537257011033958,2097152 --field-trial-handle=2064,i,3716578370183487646,10357117600804212322,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3148 /prefetch:1
    3⤵
    PID:4328
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4224,i,13565292971706192710,5470626119390829783,2097152 --field-trial-handle=2064,i,3716578370183487646,10357117600804212322,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4236 /prefetch:2
    3⤵
    PID:4432
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4716,i,14056128943179801771,12947953205065308368,524288 --field-trial-handle=2064,i,3716578370183487646,10357117600804212322,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4696 /prefetch:8
    3⤵
    PID:5496
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5452,i,11237960686708829081,2822281390775068761,524288 --field-trial-handle=2064,i,3716578370183487646,10357117600804212322,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5456 /prefetch:8
    3⤵
    PID:5504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" carytui.vu/api/set_agent?id=4E6EF274BD24956701AEC7B30ADF174C&token=7c6d9e1ac2be7bdf1b73b6d57288153212&description=0d5b0d6e95037f7d0d4d809554f3b6d0&agent=Edge
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x29c,0x7ffda0a2c188,0x7ffda0a2c194,0x7ffda0a2c1a0
    3⤵
    PID:4004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,7803683019181899329,6403398962303488594,524288 --field-trial-handle=2868,i,16049800826300296171,14536006571424038259,262144 --variations-seed-version --mojo-platform-channel-handle=2984 /prefetch:3
    3⤵
    - System Time Discovery
    PID:2136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1768,i,6859866535351578141,12087316699566964033,262144 --field-trial-handle=2868,i,16049800826300296171,14536006571424038259,262144 --variations-seed-version --mojo-platform-channel-handle=2872 /prefetch:2
    3⤵
    PID:4488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2352,i,8035770063689615385,6735398026845485734,524288 --field-trial-handle=2868,i,16049800826300296171,14536006571424038259,262144 --variations-seed-version --mojo-platform-channel-handle=2968 /prefetch:8
    3⤵
    PID:1624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,3473342809102891278,15705524110215358901,2097152 --field-trial-handle=2868,i,16049800826300296171,14536006571424038259,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
    3⤵
    PID:2368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,598571048350292619,14039062942724239366,2097152 --field-trial-handle=2868,i,16049800826300296171,14536006571424038259,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
    3⤵
    PID:5960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4792,i,16002752092734952162,10931290003172095676,524288 --field-trial-handle=2868,i,16049800826300296171,14536006571424038259,262144 --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:8
    3⤵
    PID:2228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,9037122427801153412,9457158814013473268,524288 --field-trial-handle=2868,i,16049800826300296171,14536006571424038259,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:8
    3⤵
    PID:3120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,3039954052308699049,11142565494893116168,524288 --field-trial-handle=2868,i,16049800826300296171,14536006571424038259,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:8
    3⤵
    PID:1592
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,9058710465833268314,9510231362035064718,524288 --field-trial-handle=2868,i,16049800826300296171,14536006571424038259,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
    3⤵
    PID:2508
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,9058710465833268314,9510231362035064718,524288 --field-trial-handle=2868,i,16049800826300296171,14536006571424038259,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
    3⤵
    PID:5088

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5956

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4384

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 085905cc5b3da322c3df9b6eff589a51eb7c65b4cee8969012121aa5f9a618a1
MD5 235242ec7ba66524a00b593eb986f655
SHA1 70f1a84a26bbf99747249742348553aa41c9b284
SHA512 7acfbc0362089a090bb54beff31496d8feef6e4e5624f4f325dcb05201a548d7239d6574a31882b82f8415663b40a65859ce7f6da384fe2fc26b64b4458680ef
SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2OrRK1fVumCnY:1nbZeMrv/hGtrROenY
TLSH
T111D3764B3A747102DDE69A721CE054BB5E3CB16D4F51A5D428B620688EF2863B23D4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 a8a854f60814bc2caf98af6a122d3cc6e609cc1f250617bfc87c0330ca8765b9
MD5 2e8e7665e001bdd121289f47029d9224
SHA1 37990ef89ff98db14477f2089d42cbcf1faa7991
SHA512 17ec2803f2de782ce4bdb9b9d9f4244ca6c4954bc70588ae8e1a376232860a359b8b575186a316dd061f2f2b091595125705fa14a8a7be882e5e99764c9cf5fc
SSDEEP 1536:0NIcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEB:II3Qw/xLANk0mUW5GmRntSFCjEEN3
TLSH
T18B9302BA4E1A46E7997E46C176AD7808CE22130D70AFA9CC316C639D61941C92B73F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 030978901609c12837a9b1afdcd1ee9f12ef19339fd94725f17a7cdb1e945f36
MD5 35e76198d1c2c61d3c2a49119ba65747
SHA1 a5ae8329c9e762bed0a3d6bc5584e8faf6d26a77
SHA512 8b21ab6c5e29ab0ea7652b7adadb04a05eb734a52faa779252fbec4acd45079c7ad3f83f36227a419f0a59fc94eb1cf408bcd782459cf4691b6eb727be746fd3
TLSH
T136D0800925B7DC74D059847018977B4D7555CD6B4D4657163473283D1C4B4504D911DB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 827caedd6ba67a465e2378da508ebf9f7e5dc38b9ff3d1086fe8a0b10ad23634
MD5 6a7649ad8529021b8a0bf012adb69564
SHA1 bc6cb8e64c0f5c84a887a19005280de2e2ff95dd
SHA512 316ecd29696eeae0002f91778818c1c4166e5bbf8440eddea3560a6ea0fb49f25e4e33c48c2d7c73eb08507c015f5aa7eb4187e6558ebdc4cd44c5bd980d8c3a
TLSH
T133D0800529B3DC74D055847018D77B4D7665CD6B4D4657163473283D1C4B4504D911DB
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 abc1d907c48055ae0003d3decc76421d227131531d108d3fd76d476224bd5ab9
MD5 212844ae4e887a5d73165134874824cf
SHA1 10e38c395288c68718866ceedadaca7e6334eea7
SHA512 bc2273db82eb0a9ad6370a777eec735584b63f15fbd4f5791b53ff145f8d5da06cda75d017f70f112cd78f20ab23d349f85370858c08a4556f351dd73511e76b
SSDEEP 24:TL68LbXYFpFNYbatqn1kweka6za6UwpQ9YH8PATZ6HfB:T2SLopFMatSaw/auUOt8B
TLSH
T171928C4E5F346220C0F04B36EDD185672F7C211CD3A72A99DE5410F3DE9259BF1155AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 251413090eeaabcce980b3e1bc7fe63b6003cd7c2648acc98ceb5125c4e8cc46
MD5 a6aed9c55fafc310a6d51f50fd34de97
SHA1 6fe1be7a07e4fb73e9124faf2b41228cfa8a0cf4
SHA512 10033581622d9705fcc522fb795f80f4fc5943c83b801d0c458fb674afa70670269769cca4b47130c64655d5262a8f13468ea4cff0ab2ccde13d6fed70eaadaa
SSDEEP 192:kBhNHfIVfhRXF4B6W4KqV2j6Ok4pYLQobOyzcp/KLNz3BL+xD:krN/INhx+kcxKBzxLaD
TLSH
T10AB25C11327A02813A7E299E8595B41F76C270633098F93B7BB954A60F6BE20DDFD4CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 45c52c5250c48aae70fcf9771b96f2e88e27201522c1e6bcda56b3d6618361d0
MD5 cb7069cb178f0da19ff196164fc547a9
SHA1 cc6853ef6d27cf509047cb5226843945004a30d6
SHA512 8b3280118cd93d89a494e19ef4354a231ff1455b9b9842971541712d495194cde9c03160db62e2a67840ed0dae9eb8b4d13b7346dedf7eab318a84e5114d2898
SSDEEP 192:P+xWN1CIfT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mxZIfQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T17724840A7B747001EDE6D9725CB080771E3CB1ADCF22A6915DB254698DB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 6cbbde39058db8125d42da8598f25ef166ff4ec7075f446da0426fc186bf77b0
MD5 21c955d188dee212a4736b0d86232fe9
SHA1 23b7574d2b2a17fb166fb1f5c257debb54c37d50
SHA512 72f2fdd0af6128b1297dd70f96593d8117bb51803ebd6d3603448d79bb38cef1ebde8aa33f7ced9d07eb6ff17d9a514aa728df3b74e8a0c06b63ff2e68a72216
SSDEEP 384:nviFavqMg3sNQ8TUNTUlIm2ZTPENj6OEfjYAibQs3KzRYV/Vw1mR6dU5rN1k+5vx:6Fayv39wgHgyYl8s3uRYk1m8sB
TLSH
T1C0C23A36EC94DAABEEE68FD9A7097A02EEF0116BD58C49D4DAD81E0D00D719E1307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 4ed5741270b0c043b63782ad8b7e323f66125830bf8403ff6161a0e6ad3d7b9b
MD5 e2bbce6efad23d6b6689e5383eaaa0cc
SHA1 aea33e3dd41a207dae7d6bf26d600b914b893673
SHA512 b9bd9a144bf99348902605b31eeb13d532f39537df715ec68a765d8aed37fef16508dc2de897f2fb0459f65b391745db5def31efac9cbb1976addf62ac053039
SSDEEP 384:n9iFavqMg3sN18TUNTUlIm2ZTPRiNOEfjYAibQsClIVRYV/Vw1mR6dU5rN1k+5vx:0Fayv3swgHUvYl8s1VRYk1m8sB
TLSH
T10EC25A76D894DD6BEEEA8FD9B7093642EEF011A7C58C4ED4EAD81E0D00971DE170B812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a3cc61d54ad540d2a3349ec134674ef3eff25a886a61b330f61ba92ff4646a7f
MD5 6c1026ac82224699b4a517f2dd7c805a
SHA1 8c7108d7de8ecece91e43a55b27912fb3f2b9b55
SHA512 5f5218a4e66e9977f9e50b1fd8010758d568cdb0fc3bf805d85f7ebcb562a67f57d897b9ac7277339b87f080f357fb9a8a05be3c4d26e02def210b4e051dd419
TLSH
T1BF412A58B6F91144B3B76E5A9BF7B46E447FB9372F46849E20110E4F0622E00C871737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4580-41-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

Download

memory/4580-62-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

Download

memory/4580-52-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

Download

memory/4580-51-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

Download

memory/4580-50-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

Download

memory/4580-49-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

Download

memory/4580-48-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

Download

memory/4580-47-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

Download

memory/4580-46-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

Download

memory/4580-45-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

Download

memory/4580-44-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

Download

memory/4580-43-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

Download

memory/4580-42-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

Download

memory/4580-54-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

Download

memory/4580-40-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

Download

memory/4580-39-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

Download

memory/4580-55-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

Download

memory/4580-56-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

Download

memory/4580-57-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

Download

memory/4580-58-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

Download

memory/4580-59-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

Download

memory/4580-60-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

Download

memory/4580-61-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

Download

memory/4580-53-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

Download

memory/4580-63-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

Download

memory/4580-64-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

Download

memory/4580-38-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

Download

memory/4580-37-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

Download

memory/4580-250-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

Download

memory/4580-251-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

Download

memory/4580-261-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

Download

memory/4580-253-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

Download

memory/4580-254-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

Download

memory/4580-255-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

Download

memory/4580-257-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

Download

memory/4580-256-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

Download

memory/4580-65-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

Download

memory/4580-66-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

Download

memory/4580-67-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

Download

memory/4580-268-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

Download

memory/4580-267-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

Download

memory/4580-266-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

Download

memory/4580-265-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

Download

memory/4580-264-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

Download

memory/4580-263-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

Download

memory/4580-262-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

Download

memory/5088-252-0x0000022C83380000-0x0000022C833EB000-memory.dmp

Download