b231c67fc102bd1784a10330a0b827e599ad66e08d9dc477f2d6c93efb581f85

max time kernel
29s
max time network
31s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
22/06/2026, 15:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mpclient.dll
Size 3.8MB
Sample260622-taepjset4x
SHA256 b231c67fc102bd1784a10330a0b827e599ad66e08d9dc477f2d6c93efb581f85
MD5 3209f3fe564e9fb6eecd3c40a9563dc1
SHA1 c8a648d8703039cad8c630e4066fbce93586f9e6
SHA512 f13de9ab03301af4da9cadb4957030b47864d7ac33a9be58d013014b9836ef7fc271b8ae2f76dc33f5bc79fb9ac30bde17da0abe7189056ed5315f3f44a58c22
SSDEEP 49152:iHIjM8nROo7Wjyp2NLtVKPOfuQjPDyO45tfI9hWlHB:ix6W+sNLvfuQjPeJI9GHB
TLSH
T18D069E07EF911869D45A923189EB9651773CBC481B323BD72E90737A2F723D06D3AB24
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery spyware stealer

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 13 IoCs

description	pid	Process	procid_target
PID 4940 created 4240	4940	rundll32.exe	83
PID 4940 created 856	4940	rundll32.exe	84
PID 4940 created 2500	4940	rundll32.exe	85
PID 4940 created 3776	4940	rundll32.exe	86
PID 4940 created 3952	4940	rundll32.exe	88
PID 4940 created 1760	4940	rundll32.exe	89
PID 4940 created 4772	4940	rundll32.exe	90
PID 4940 created 692	4940	rundll32.exe	91
PID 4940 created 4240	4940	rundll32.exe	83
PID 4940 created 4240	4940	rundll32.exe	83
PID 4940 created 2500	4940	rundll32.exe	85
PID 4940 created 2500	4940	rundll32.exe	85
PID 4940 created 3296	4940	rundll32.exe	99

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	4940	rundll32.exe
5	4940	rundll32.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4940	rundll32.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2648	msedge.exe
2500	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134266170985534760"	chrome.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
4940	rundll32.exe
4940	rundll32.exe
4940	rundll32.exe
4940	rundll32.exe
4940	rundll32.exe
4940	rundll32.exe
4940	rundll32.exe
4940	rundll32.exe
4940	rundll32.exe
4940	rundll32.exe
4940	rundll32.exe
4240	chrome.exe
4240	chrome.exe
4940	rundll32.exe
4940	rundll32.exe
4940	rundll32.exe
4940	rundll32.exe
4940	rundll32.exe
4940	rundll32.exe
4940	rundll32.exe
4940	rundll32.exe
4940	rundll32.exe
4940	rundll32.exe
4940	rundll32.exe
4940	rundll32.exe
4940	rundll32.exe
4940	rundll32.exe
4940	rundll32.exe
4940	rundll32.exe
4940	rundll32.exe
4940	rundll32.exe
4940	rundll32.exe
4940	rundll32.exe
4940	rundll32.exe
4940	rundll32.exe
4940	rundll32.exe
4940	rundll32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	4940	rundll32.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
3296	msedge.exe
3296	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 4940 wrote to memory of 4240	4940	rundll32.exe	83
PID 4240 wrote to memory of 856	4240	chrome.exe	84
PID 4240 wrote to memory of 2500	4240	chrome.exe	85
PID 4240 wrote to memory of 3776	4240	chrome.exe	86
PID 4240 wrote to memory of 3776	4240	chrome.exe	86
PID 4240 wrote to memory of 3952	4240	chrome.exe	88
PID 4240 wrote to memory of 3952	4240	chrome.exe	88
PID 4240 wrote to memory of 1760	4240	chrome.exe	89
PID 4240 wrote to memory of 4772	4240	chrome.exe	90
PID 4240 wrote to memory of 1760	4240	chrome.exe	89
PID 4240 wrote to memory of 4772	4240	chrome.exe	90
PID 4240 wrote to memory of 692	4240	chrome.exe	91
PID 4240 wrote to memory of 692	4240	chrome.exe	91
PID 4240 wrote to memory of 4920	4240	chrome.exe	96
PID 4940 wrote to memory of 3296	4940	rundll32.exe	99
PID 3296 wrote to memory of 3128	3296	msedge.exe	100
PID 3296 wrote to memory of 2648	3296	msedge.exe	101
PID 3296 wrote to memory of 4764	3296	msedge.exe	102
PID 3296 wrote to memory of 4764	3296	msedge.exe	102
PID 3296 wrote to memory of 4764	3296	msedge.exe	102
PID 3296 wrote to memory of 3696	3296	msedge.exe	103
PID 3296 wrote to memory of 3696	3296	msedge.exe	103
PID 3296 wrote to memory of 4072	3296	msedge.exe	105
PID 3296 wrote to memory of 4072	3296	msedge.exe	105
PID 3296 wrote to memory of 2144	3296	msedge.exe	106
PID 3296 wrote to memory of 4072	3296	msedge.exe	105
PID 3296 wrote to memory of 2144	3296	msedge.exe	106
PID 3296 wrote to memory of 2144	3296	msedge.exe	106
PID 3296 wrote to memory of 1508	3296	msedge.exe	107
PID 3296 wrote to memory of 1508	3296	msedge.exe	107
PID 3296 wrote to memory of 1508	3296	msedge.exe	107
PID 3296 wrote to memory of 1908	3296	msedge.exe	108
PID 3296 wrote to memory of 1908	3296	msedge.exe	108
PID 3296 wrote to memory of 1908	3296	msedge.exe	108
PID 3296 wrote to memory of 1332	3296	msedge.exe	112
PID 3296 wrote to memory of 1332	3296	msedge.exe	112
PID 3296 wrote to memory of 3256	3296	msedge.exe	113
PID 3296 wrote to memory of 3256	3296	msedge.exe	113

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\mpclient.dll,#1
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Badlisted process makes network request
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4240
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffc9fe4c728,0x7ffc9fe4c734,0x7ffc9fe4c740
    3⤵
    PID:856
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2012,i,2620211207046807254,2535687559848461646,524288 --field-trial-handle=2044,i,15865239244286395857,12545530701561940469,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2076 /prefetch:3
    3⤵
    - System Time Discovery
    PID:2500
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1720,i,8749497199772781816,10908849956800570520,262144 --field-trial-handle=2044,i,15865239244286395857,12545530701561940469,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2040 /prefetch:2
    3⤵
    PID:3776
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2328,i,11739233943670248106,8015623384538212526,524288 --field-trial-handle=2044,i,15865239244286395857,12545530701561940469,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2504 /prefetch:8
    3⤵
    PID:3952
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3004,i,13879625259326814963,11524273311441817215,2097152 --field-trial-handle=2044,i,15865239244286395857,12545530701561940469,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3124 /prefetch:1
    3⤵
    PID:1760
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3016,i,5845061028149939964,11951435091721399926,2097152 --field-trial-handle=2044,i,15865239244286395857,12545530701561940469,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3148 /prefetch:1
    3⤵
    PID:4772
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4148,i,9654690723567075509,14305419434764407707,2097152 --field-trial-handle=2044,i,15865239244286395857,12545530701561940469,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4152 /prefetch:2
    3⤵
    PID:692
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5556,i,3957906689551467638,7627285393784376081,524288 --field-trial-handle=2044,i,15865239244286395857,12545530701561940469,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5560 /prefetch:8
    3⤵
    PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x28c,0x7ffc9a29c188,0x7ffc9a29c194,0x7ffc9a29c1a0
    3⤵
    PID:3128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1924,i,5780322189004854816,690966444494566924,524288 --field-trial-handle=2240,i,12911949605660830417,12456600965823353850,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:3
    3⤵
    - System Time Discovery
    PID:2648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1768,i,17293454676931288584,2270563882064106488,262144 --field-trial-handle=2240,i,12911949605660830417,12456600965823353850,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:2
    3⤵
    PID:4764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2480,i,14175016944767264842,9424176160699816493,524288 --field-trial-handle=2240,i,12911949605660830417,12456600965823353850,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:8
    3⤵
    PID:3696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3356,i,639444562418293973,12659295214355940299,2097152 --field-trial-handle=2240,i,12911949605660830417,12456600965823353850,262144 --variations-seed-version --mojo-platform-channel-handle=3392 /prefetch:1
    3⤵
    PID:4072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3368,i,14250789112988783185,1487894322896274345,2097152 --field-trial-handle=2240,i,12911949605660830417,12456600965823353850,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:1
    3⤵
    PID:2144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4036,i,13351163903859160914,14324567012530864354,2097152 --field-trial-handle=2240,i,12911949605660830417,12456600965823353850,262144 --variations-seed-version --mojo-platform-channel-handle=4052 /prefetch:1
    3⤵
    PID:1508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4060,i,12630229231218814250,11188212368482088458,2097152 --field-trial-handle=2240,i,12911949605660830417,12456600965823353850,262144 --variations-seed-version --mojo-platform-channel-handle=4100 /prefetch:2
    3⤵
    PID:1908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,12923765428048219351,5137549026729697827,524288 --field-trial-handle=2240,i,12911949605660830417,12456600965823353850,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:8
    3⤵
    PID:1332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4420,i,7170569233637210941,14412669073591928399,524288 --field-trial-handle=2240,i,12911949605660830417,12456600965823353850,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
    3⤵
    PID:3256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,14058075812581218983,9701324325189754798,524288 --field-trial-handle=2240,i,12911949605660830417,12456600965823353850,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:8
    3⤵
    PID:5316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,15568303796420583492,15250964780492172629,524288 --field-trial-handle=2240,i,12911949605660830417,12456600965823353850,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:8
    3⤵
    PID:5324

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3468

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 06179fc62d4c9055f86e0cc7c8af0ff725e7a1e8d50d82c66fdd86c75203aa10
MD5 13df2d8ed7d081ea15304b1132535a0c
SHA1 8f99d413aafcaddaa0fd94b05918b02af7d64b96
SHA512 118c05d1d0607026d3353272a453db28aeaba3b84baaf83ae851a5ae0fb61502f26d6868e82cde7431ea8e90c3593a3e8d726052c4e1b1ca0f72dbebec96cd96
SSDEEP 192:CRJQYa/e0v7bpAPRp259/Hsb+WNnKbP9eSRWxL8kVyIsnAUge:CRJQiwPUXe1wKP95RWJe
TLSH
T18842B92EBA10657B6CDBD22AFD227763D7F5102231D41E84E6FC8A2C15EB5CD211741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 4a8de811b93ad52e9d4022e9fa8a9091cc20b5ffab88a1e0f530f17ec1f4af83
MD5 469645fc081cfe6eb6c54d3ab7d6055c
SHA1 a833172ee1a4cfdf987c031a33c493f52999a2a9
SHA512 e6874d4c0de8dab37c06cfe06c0e7f6a0485f59eca431899ec8c9501c7f2f35d5061c79cd8a90a2176dfdb88432ceb4ee67ce09a6e5a875caf924a573ae28e55
SSDEEP 384:RrjNI7KxkXqKf/pUZNCgVLH2Hfgsl4Tv7pLuLcSj/6XODNI+ErU3BtvHG+lGGEVP:RHNI7KxkXqKf/pUZNCgVLH2HfgsmT7pL
TLSH
T13D7209677C4C9A3B0F94C6CCE8177B4FADB5025B26E9886543FA582503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 f4aad9b534da0681b8561a6608fb4ec33078d9c04110689836892c50e8fb0c2f
MD5 98bf343c6f6b0c4d5a78d51e595b09cc
SHA1 c4044a3dddac18bb7ca12e344dc22da3e249ff08
SHA512 8189d8305b524bb67b1c0dffc3be6ac1c344b16fb54956819db1c0e6228b6655a6ae58d0cf38e3f37c0af75d8f7142bb84c6a913afe1542f2a300fb90611f358
SSDEEP 3072:XTGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM1:Xqm7Rkm1tYpBeh2BAo1
TLSH
T1FCC312279E71E9375D79AB4EB08E0B1F1EF149A3C920DE82C8D85B0477FA6CD1A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 b923cb74b35f9302061b67cbe83714570f5b85d818e448652af6b6ad1ea503dc
MD5 a403b60f4fb3103575a7f883a0f0125b
SHA1 4201cbd40d88a1ec302cd9e0dda5ea655f47f418
SHA512 4d8d6aaa3256eed3e962dae5a5941e922f4bce9eb795917fceb03d75af950fb346833f9cf3e7f1d41f1c5840d47bdbf642735ff8d1d558c1b4f4011da844f671
SSDEEP 3072:9Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrM0:Um7Rkm1tYpBeh2BAo0
TLSH
T1D4C312279D74E9364DB9BB1EB04E0B1F1EF149A3CA20DE92C8D85B0437EA7DC0A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 25702f00b9ae3e59191c9934c14d23ed967e0529851788b808888646dea4d732
MD5 ffa356b657a3409019fc8a239c32c6a4
SHA1 0d51c84aa86ab7959c598cad1154ad13f00af759
SHA512 c83ea8fc753dc36b208df6ad992709ac8598c211965482ecabbc7cb3003aa09cf7cf7dd16ddb5bb30a93ef60e91ddc256b634830a8856ba86888c4fe6d173b24
TLSH
T126D080367B5EB404E71BC231A42EC701DB1A59F014968B07E254D42C97F40DC63EF593
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9991c48ed8914879dae4effcec150d36bec17d010668f447d8f9cade2568ef52
MD5 2b78928af0525d555cba6be0800700cd
SHA1 c47480c0d63ca33a357bdeae4e0a2b4778e4464d
SHA512 6bc6c0cf883cc43a054d194fde4d18e99c2cbbeb4a8d8d02877029180da59e5d35cf8681da958469d6f20c0b488cb0657a9b8230375256327c3a614ac9ee7298
TLSH
T18AD01236BA1AA404E61A8231A42E87019A1A59A014964B06A254D42C96B409862AF593
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 67f1619af5f90b41859dc6d68b387ede395aeadd615309e8e2e710ab72fd8d70
MD5 f0d00995abd9fe74d0bd04bf4cfbb6b5
SHA1 cf18f14c2e3a224199f5ce05e7d05726e62b0492
SHA512 de1b48939fd281bf4f27a83a9e79758cb32cdb7248910a90c8d6074c28a3c3fe5660fd96b3d302e9c474a625a07a835b25f9019af1a7980872cb31fe9eea851f
SSDEEP 192:YON26LCWtDQmiUyLlILSuOCzZu2+TsESTU6:YON26mg18ImuO8R+9UU6
TLSH
T15F02DA36A9685C779EF37E45B4873B276FA4113BA9902F54DAE82F0C01D764C2306936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7dde18b499da5b7fd9a674605c19e61cb774fc6b0d5c6250ee537fdd9fa7d298
MD5 23d0724a276c042b629e32e3f2e53f8c
SHA1 0ae2d2537971cf5a32b0e426574d280fad09c466
SHA512 a5f3d0ad39f99ff21038ec5bfdfa6676cc04a3711d50b44d782e20ab1392a9f4cd5482bfeba4d06b3da8c92b6bbc1b15305e2f18fe360b55bff58e81638a1e0c
SSDEEP 192:eONL6LCWtJQmiUyElCLSuOCzZu2+2YyM8PwoBI/xqBU6:eONL6mgn5CmuO8R+2YyXYo8EU6
TLSH
T1DB120A76A8286C679EF3BE41B48776176FA8113BE9803F54DEE81F1C05DB68C1306D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4940-122-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4940-113-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4940-16-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4940-17-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4940-14-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4940-13-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4940-32-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4940-31-0x00007FFCAC020000-0x00007FFCAC40E000-memory.dmp

Download

memory/4940-12-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4940-50-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4940-92-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4940-117-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4940-130-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4940-151-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4940-150-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4940-149-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4940-148-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4940-147-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4940-146-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4940-145-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4940-128-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4940-127-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4940-126-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4940-125-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4940-124-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4940-123-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4940-0-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4940-121-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4940-120-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4940-119-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4940-116-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4940-115-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4940-114-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4940-15-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4940-112-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4940-129-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4940-118-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4940-91-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4940-90-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4940-89-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4940-88-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4940-87-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4940-86-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4940-85-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4940-84-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4940-82-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4940-81-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4940-80-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4940-79-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4940-78-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4940-77-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4940-76-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4940-75-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4940-74-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4940-73-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4940-83-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4940-72-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4940-11-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4940-10-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4940-9-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4940-8-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4940-7-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4940-6-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4940-5-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4940-4-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4940-1-0x0000000490000000-0x000000049021B000-memory.dmp

Download