e509431663ed1839770e56a17120afcb1692e25a1bf6633ba46c6e0a96155624

Analysis

max time kernel
149s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 17:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmpt2ykhw39.exe
Size 337KB
Sample260601-vpfe3aa16y
SHA256 e509431663ed1839770e56a17120afcb1692e25a1bf6633ba46c6e0a96155624
MD5 138266acae1fe8fb0446511546c39314
SHA1 21b436d25375e2f19cd69670fa04b18a60ee0ad2
SHA512 0eab7143459d4abcf2917fd3cb67fe86dafb72d6c0575ff579a4df3492e782dd9f02d4f653493ce83f5d80f7ec1d2fda5441ca44f9b468de7fd5efb0b9573df6
SSDEEP 6144:XvgEeOcmwvEL7fF1jTA659HSC8AVtZ5XlOHaoIhEFydXt:/8OcZ07bf0OtDlOHaoIndXt
TLSH
T1B1747B8AE7BB54B0D54B0938259FB33BDF3416294328CEC7DBF0DA4475672E21936A06
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpt2ykhw39.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5956	msedge.exe
3704	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134248073863515725"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-226940941-599731907-2645636698-1000\{3D85FABB-A9D4-404F-AECB-F2F75F5BC7FA}	msedge.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
424	tmpt2ykhw39.exe
424	tmpt2ykhw39.exe
424	tmpt2ykhw39.exe
424	tmpt2ykhw39.exe
4684	chrome.exe
4684	chrome.exe
424	tmpt2ykhw39.exe
424	tmpt2ykhw39.exe
424	tmpt2ykhw39.exe
424	tmpt2ykhw39.exe
424	tmpt2ykhw39.exe
424	tmpt2ykhw39.exe
424	tmpt2ykhw39.exe
424	tmpt2ykhw39.exe
424	tmpt2ykhw39.exe
424	tmpt2ykhw39.exe
424	tmpt2ykhw39.exe
424	tmpt2ykhw39.exe
424	tmpt2ykhw39.exe
424	tmpt2ykhw39.exe
424	tmpt2ykhw39.exe
424	tmpt2ykhw39.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
3384	msedge.exe
3384	msedge.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4684	chrome.exe
Token: SeCreatePagefilePrivilege	4684	chrome.exe
Token: SeShutdownPrivilege	4684	chrome.exe
Token: SeCreatePagefilePrivilege	4684	chrome.exe
Token: SeShutdownPrivilege	4684	chrome.exe
Token: SeCreatePagefilePrivilege	4684	chrome.exe
Token: SeShutdownPrivilege	4684	chrome.exe
Token: SeCreatePagefilePrivilege	4684	chrome.exe
Token: SeShutdownPrivilege	4684	chrome.exe
Token: SeCreatePagefilePrivilege	4684	chrome.exe
Token: SeShutdownPrivilege	4684	chrome.exe
Token: SeCreatePagefilePrivilege	4684	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
3384	msedge.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 424 wrote to memory of 4684	424	tmpt2ykhw39.exe	81
PID 4684 wrote to memory of 5364	4684	chrome.exe	82
PID 4684 wrote to memory of 3812	4684	chrome.exe	83
PID 4684 wrote to memory of 3812	4684	chrome.exe	83
PID 4684 wrote to memory of 3704	4684	chrome.exe	84
PID 4684 wrote to memory of 5536	4684	chrome.exe	85
PID 4684 wrote to memory of 5536	4684	chrome.exe	85
PID 4684 wrote to memory of 3540	4684	chrome.exe	86
PID 4684 wrote to memory of 3540	4684	chrome.exe	86
PID 4684 wrote to memory of 1276	4684	chrome.exe	87
PID 4684 wrote to memory of 1276	4684	chrome.exe	87
PID 4684 wrote to memory of 2584	4684	chrome.exe	89
PID 4684 wrote to memory of 2584	4684	chrome.exe	89
PID 4684 wrote to memory of 4032	4684	chrome.exe	90
PID 424 wrote to memory of 3384	424	tmpt2ykhw39.exe	92
PID 3384 wrote to memory of 3172	3384	msedge.exe	93
PID 3384 wrote to memory of 5956	3384	msedge.exe	94
PID 3384 wrote to memory of 3124	3384	msedge.exe	95
PID 3384 wrote to memory of 3124	3384	msedge.exe	95
PID 3384 wrote to memory of 3124	3384	msedge.exe	95
PID 3384 wrote to memory of 5892	3384	msedge.exe	96
PID 3384 wrote to memory of 5892	3384	msedge.exe	96
PID 3384 wrote to memory of 5624	3384	msedge.exe	99
PID 3384 wrote to memory of 2596	3384	msedge.exe	98
PID 3384 wrote to memory of 5624	3384	msedge.exe	99
PID 3384 wrote to memory of 5624	3384	msedge.exe	99
PID 3384 wrote to memory of 2596	3384	msedge.exe	98
PID 3384 wrote to memory of 2596	3384	msedge.exe	98
PID 3384 wrote to memory of 1724	3384	msedge.exe	100
PID 3384 wrote to memory of 5016	3384	msedge.exe	101
PID 3384 wrote to memory of 1724	3384	msedge.exe	100
PID 3384 wrote to memory of 5016	3384	msedge.exe	101
PID 3384 wrote to memory of 2172	3384	msedge.exe	102
PID 3384 wrote to memory of 4272	3384	msedge.exe	104
PID 2172 wrote to memory of 2920	2172	msedge.exe	105
PID 3384 wrote to memory of 3020	3384	msedge.exe	106
PID 3020 wrote to memory of 4448	3020	msedge.exe	107

C:\Users\Admin\AppData\Local\Temp\tmpt2ykhw39.exe
"C:\Users\Admin\AppData\Local\Temp\tmpt2ykhw39.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" pomflgf.vu/api/set_agent?id=01C531B6BD24956701AEC7B30ADF174C&token=66fe2163fd0f5368de392187ff587a12ed&description=0d5b0d6e95037f7d0d4d809554f3b6d0&agent=Chrome
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4684
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xe4,0x108,0x7ffcacaec728,0x7ffcacaec734,0x7ffcacaec740
    3⤵
    PID:5364
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1720,i,14791462674124102752,6159393287814570813,262144 --field-trial-handle=1996,i,5703465049818383123,17806131408582408502,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=1992 /prefetch:2
    3⤵
    PID:3812
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1520,i,14914811363685595379,1281354954083466601,524288 --field-trial-handle=1996,i,5703465049818383123,17806131408582408502,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2288 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3704
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2396,i,6054209679623703695,431002806708011217,524288 --field-trial-handle=1996,i,5703465049818383123,17806131408582408502,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2368 /prefetch:13
    3⤵
    PID:5536
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3088,i,14245980893990119396,15806613274632033313,2097152 --field-trial-handle=1996,i,5703465049818383123,17806131408582408502,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3196 /prefetch:1
    3⤵
    PID:3540
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3096,i,6680421244183061344,16231280458769901618,2097152 --field-trial-handle=1996,i,5703465049818383123,17806131408582408502,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3232 /prefetch:1
    3⤵
    PID:1276
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4260,i,1083650012705227793,7198715797670384717,2097152 --field-trial-handle=1996,i,5703465049818383123,17806131408582408502,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4276 /prefetch:9
    3⤵
    PID:2584
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5244,i,5373905045093630788,9093505293223506537,524288 --field-trial-handle=1996,i,5703465049818383123,17806131408582408502,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5252 /prefetch:14
    3⤵
    PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" pomflgf.vu/api/set_agent?id=01C531B6BD24956701AEC7B30ADF174C&token=66fe2163fd0f5368de392187ff587a12ed&description=0d5b0d6e95037f7d0d4d809554f3b6d0&agent=Edge
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f0,0x7ffcac91c188,0x7ffcac91c194,0x7ffcac91c1a0
    3⤵
    PID:3172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1780,i,16412435935384449253,10406095812448674642,524288 --field-trial-handle=2148,i,447890114074694267,9210840158129708897,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,5198197221150188534,11116235629894259657,262144 --field-trial-handle=2148,i,447890114074694267,9210840158129708897,262144 --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:2
    3⤵
    PID:3124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2520,i,6129697746679471040,15125926416717294191,524288 --field-trial-handle=2148,i,447890114074694267,9210840158129708897,262144 --variations-seed-version --mojo-platform-channel-handle=2724 /prefetch:13
    3⤵
    PID:5892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,9951852024598233116,448624298692959175,2097152 --field-trial-handle=2148,i,447890114074694267,9210840158129708897,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
    3⤵
    PID:2596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,2947128507424019963,4255012886161868337,2097152 --field-trial-handle=2148,i,447890114074694267,9210840158129708897,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
    3⤵
    PID:5624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4864,i,13575483335870747800,14197801971725107773,524288 --field-trial-handle=2148,i,447890114074694267,9210840158129708897,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:14
    3⤵
    PID:1724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,5944260678098494489,4222395065116416644,524288 --field-trial-handle=2148,i,447890114074694267,9210840158129708897,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:14
    3⤵
    PID:5016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,18349850917470041121,125295579203914388,524288 --field-trial-handle=2148,i,447890114074694267,9210840158129708897,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1128
      4⤵
      PID:2920
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,14948221429680977774,2264332482035778234,524288 --field-trial-handle=2148,i,447890114074694267,9210840158129708897,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:14
    3⤵
    PID:3160
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,14948221429680977774,2264332482035778234,524288 --field-trial-handle=2148,i,447890114074694267,9210840158129708897,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:14
    3⤵
    PID:4272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,2422806079809882602,13050883509213483749,524288 --field-trial-handle=2148,i,447890114074694267,9210840158129708897,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=596
      4⤵
      PID:4448

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2812

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2504

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4780

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 1b872e82f98894475728551c8068203ed4653bb009f482c27e9daa96bad0686b
MD5 e05d192d02dbeca0dd9c53db10267565
SHA1 a264b9d69557984211739890b58af942d400ba1d
SHA512 0af35854b4a7ecfb44db45c51d62a304cbdeef75ac17ca2e8e3bce1d7e62fa5c0a09e79526d24c6a34f17123e20ae50a68b7472ab3cf1a1c462f391139ee5797
TLSH
T1D7F059A7E6B9B027407945EBAD04BC0A75B6A830039078E5DFAB426FD0A65E71B02453
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 745dc7ad58c14aed481cea4ecf48ae2b857c34839658b02bd173316659d3c1d8
MD5 91c5137e54b2800fa3486baa749f7e67
SHA1 be47db43572ef9b71fc29dc5baa1ede9d1706221
SHA512 e7e7d013f80d11870158aad487814d82280cbedea40cfc5bb395002304156d43dc506d38333953da7e6598a3cde5338b105fe18be7176a17bdc43ec563c0cf85
SSDEEP 192:tB+XuvBnl3JsueMEGvIW1/rcP2O5pX6ZqKVumAwkP:jeuvBnhJsueMEGvIW1DcP2OXGVumAnP
TLSH
T10ED3974B3A743102EDE59A721CE050BB4E3CB16D8F5195D428B620688EF2963B23D4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 1b4f9b96040f68e6980fa68a807aba05ac5a8827bfce96c389c3645a0807a539
MD5 7f8981a1abeea040e42b04f8adf94a9c
SHA1 921e7a3ee85068b4351ee6b2ec6b9021afa74090
SHA512 e0335064e27810dddef4d890938bc284896f1f09b1c0707edf4d9291fb21bc78194167f2de8c4d4e6d441e9fb109cf75c0ee069303ddbbcca5d98591a09a4483
SSDEEP 1536:niueL6TFpmkUjlTArhJ+vgVuFM8r51TRB+BsJYuRZa8pSgeDAkwdqf8Wg+95h6mq:tDFpmzNA9J+zfAsJDREge7oWg+95hy
TLSH
T11FB30212CAABCE9BE4A45C79A4C413F3BEBE5F9523F1BA424166E4023DCE7042395770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c17dc8315075bb661bddf6b1efa879b9a3c39af13982f986bd287f5bc861cbdf
MD5 9573474710d1de6302a0d98890d2faae
SHA1 618b9f2079a97625be399f6137e46655659ecff9
SHA512 a345b915a4191d30d0da665ea4f78297c0cd671a5767e05c415403efb649110868fb279d22dc496792452c325e19b00f5e579f6e014a4488c9a4d6fac83d1c46
TLSH
T118D012273B0DB054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b9dac8593d827b7b825086ba5eeec776b808b8429eb90a6b645c319ec8f1435
MD5 c16a98ebe36bda7f5aece00f9ac1d0d0
SHA1 ef2e2a8775d1ebc0124f0ba983b6f20777919000
SHA512 148affd9dbe6aaee9070c22e41bc916df527cec5741753ca2733855f500e4eef0a257445d281d79c2449f8265c41b54dd53ffe57650802594b1211b0db611349
TLSH
T1ADD012273B0DA054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 6a202bd59e50adf3e282147b91ae47b3269bebab75d598df587684481255ec75
MD5 9eeaa9c50b9b89756d17401d7e3ff343
SHA1 a571e537b9cc1fd6c853b086c6b4a9c58149cfbd
SHA512 4b06009b46ed9d1e9fc07ee0639518e621003271a26e66c4bc48790964d986d256c64e1d8fe9e55861ef48be4fb4f703c876895d54268ad9085abf5ef7d0b6d8
TLSH
T1E0F0F9EACD21AC3718FD2B2960646746F74513572B41494F3A3C920C8FB163B4545D6C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 aa5b404862f24fa2d48e6af58b2112554bce5fe890af8ed55fe54c130e27e2ef
MD5 2f2c203483eacc9c1c72de5e19c32163
SHA1 3285f897857f5878213b0a4fd5a8a87292d4648d
SHA512 46a21c0b7ba527d07c666b09b7356d6537ecf43dbc1c62ea87e7fd22dc97d8c7fe555c5c4ddf4b5e738ea11da85b97a9ca265f46947cbeea01b10204074e1b9e
SSDEEP 192:GD9R5VJhn/iVJnZFGVApBPisTE/3oNloNPSF53pVWFQ5xfSsD0PnY9JFlPtv0F58:GZLVDJjEDPV0/ZdwPH
TLSH
T1E8A2791232BA02023C7D391C92969B274A82F5633069ED7F7BB900B54E67E125DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 924ced782732bbf515a4766a51d2be8ab2f61989fe31d9049eee77ff9115492e
MD5 d900ca1e6605d80c34913d76113653d3
SHA1 6201d961edff55dffc8ae3d0e6f01f182883e098
SHA512 0185b49d168f0f2d1d18627ceacb0ec074dd96b559917d878bb52967786d5a7247a66fe67d7f9cbadbea04d271ec8b192f21983b5a19ed85e62249ab5dac8231
SSDEEP 192:FvoWus0RfT8wRJQnGL11HLfzNSivuvTNN+u/egddCeyv/hVRdbsCEV:a55fQ0JQn6lLfzAivuvBN+wtP2s
TLSH
T17924740A7B747001DDE7D9725CB080771E3CB16ECF22A6916DA254698DB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 c41b175dd3ffcc3fe72453d84aaaa310c7cd6edb2431a3e7c24c8474cda31280
MD5 c17ca43519db7a3a6701e12c4ab5e051
SHA1 911cf09bf7bf2792abd7ca126a62ec3fedc40c9a
SHA512 b2b1836d24afd02505e8425069b8123a5d9a0aa3d47a1fcc0b462cf3d7fbae0b45aab02d415ee9fba8d578c03150a57beebe3bc166d1368b8ef19103921dc6f2
SSDEEP 384:nMiF9CcmyWCs38NF8TUNTUlIxBPm3ek32nn9BhQ4s4JfbgGGkp3sUqsj/tEMe4K2:3Fccps3WwgPKekmJ/sGLVDNtEMI8p0o
TLSH
T1C7C26B36E868CABBECE64FD9B74E6612DEE05263958899D4DEDC0D0D00971DC134B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/424-61-0x00000000039D0000-0x00000000039D1000-memory.dmp

Download

memory/424-221-0x00000000039D0000-0x00000000039D1000-memory.dmp

Download

memory/424-63-0x00000000039D0000-0x00000000039D1000-memory.dmp

Download

memory/424-60-0x00000000039D0000-0x00000000039D1000-memory.dmp

Download

memory/424-59-0x00000000039D0000-0x00000000039D1000-memory.dmp

Download

memory/424-58-0x00000000039D0000-0x00000000039D1000-memory.dmp

Download

memory/424-57-0x00000000039D0000-0x00000000039D1000-memory.dmp

Download

memory/424-56-0x00000000039D0000-0x00000000039D1000-memory.dmp

Download

memory/424-55-0x00000000039D0000-0x00000000039D1000-memory.dmp

Download

memory/424-54-0x00000000039D0000-0x00000000039D1000-memory.dmp

Download

memory/424-53-0x00000000039D0000-0x00000000039D1000-memory.dmp

Download

memory/424-51-0x00000000039D0000-0x00000000039D1000-memory.dmp

Download

memory/424-52-0x00000000039D0000-0x00000000039D1000-memory.dmp

Download

memory/424-50-0x00000000039D0000-0x00000000039D1000-memory.dmp

Download

memory/424-45-0x00000000039D0000-0x00000000039D1000-memory.dmp

Download

memory/424-44-0x00000000039D0000-0x00000000039D1000-memory.dmp

Download

memory/424-43-0x00000000039D0000-0x00000000039D1000-memory.dmp

Download

memory/424-42-0x00000000039D0000-0x00000000039D1000-memory.dmp

Download

memory/424-41-0x00000000039D0000-0x00000000039D1000-memory.dmp

Download

memory/424-40-0x00000000039D0000-0x00000000039D1000-memory.dmp

Download

memory/424-64-0x00000000039D0000-0x00000000039D1000-memory.dmp

Download

memory/424-65-0x00000000039D0000-0x00000000039D1000-memory.dmp

Download

memory/424-66-0x00000000039D0000-0x00000000039D1000-memory.dmp

Download

memory/424-67-0x00000000039D0000-0x00000000039D1000-memory.dmp

Download

memory/424-46-0x00000000039D0000-0x00000000039D1000-memory.dmp

Download

memory/424-48-0x00000000039D0000-0x00000000039D1000-memory.dmp

Download

memory/424-49-0x00000000039D0000-0x00000000039D1000-memory.dmp

Download

memory/424-47-0x00000000039D0000-0x00000000039D1000-memory.dmp

Download

memory/424-36-0x00000000039D0000-0x00000000039D1000-memory.dmp

Download

memory/424-62-0x00000000039D0000-0x00000000039D1000-memory.dmp

Download

memory/424-222-0x00000000039D0000-0x00000000039D1000-memory.dmp

Download

memory/424-223-0x00000000039D0000-0x00000000039D1000-memory.dmp

Download

memory/424-239-0x00000000039D0000-0x00000000039D1000-memory.dmp

Download

memory/424-238-0x00000000039D0000-0x00000000039D1000-memory.dmp

Download

memory/424-224-0x00000000039D0000-0x00000000039D1000-memory.dmp

Download

memory/424-237-0x00000000039D0000-0x00000000039D1000-memory.dmp

Download

memory/424-236-0x00000000039D0000-0x00000000039D1000-memory.dmp

Download

memory/424-235-0x00000000039D0000-0x00000000039D1000-memory.dmp

Download

memory/424-234-0x00000000039D0000-0x00000000039D1000-memory.dmp

Download

memory/424-233-0x00000000039D0000-0x00000000039D1000-memory.dmp

Download

memory/424-232-0x00000000039D0000-0x00000000039D1000-memory.dmp

Download

memory/424-231-0x00000000039D0000-0x00000000039D1000-memory.dmp

Download

memory/424-230-0x00000000039D0000-0x00000000039D1000-memory.dmp

Download

memory/424-227-0x00000000039D0000-0x00000000039D1000-memory.dmp

Download

memory/424-226-0x00000000039D0000-0x00000000039D1000-memory.dmp

Download

memory/424-225-0x00000000039D0000-0x00000000039D1000-memory.dmp

Download

memory/424-229-0x00000000039D0000-0x00000000039D1000-memory.dmp

Download

memory/424-228-0x00000000039D0000-0x00000000039D1000-memory.dmp

Download

memory/424-38-0x00000000039D0000-0x00000000039D1000-memory.dmp

Download

memory/424-261-0x00000000039D0000-0x00000000039D1000-memory.dmp

Download

memory/424-39-0x00000000039D0000-0x00000000039D1000-memory.dmp

Download

memory/424-37-0x00000000039D0000-0x00000000039D1000-memory.dmp

Download

memory/424-266-0x00000000039D0000-0x00000000039D1000-memory.dmp

Download

memory/424-265-0x00000000039D0000-0x00000000039D1000-memory.dmp

Download

memory/424-264-0x00000000039D0000-0x00000000039D1000-memory.dmp

Download

memory/424-263-0x00000000039D0000-0x00000000039D1000-memory.dmp

Download

memory/424-262-0x00000000039D0000-0x00000000039D1000-memory.dmp

Download

memory/4272-258-0x0000021BFB340000-0x0000021BFB561000-memory.dmp

Download