60ba214796ece45ea2131e23425919c61a635afe75180ea0feeaaefa7b63195b

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/07/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-03_657834a3d3cee7d01669c502960c781f_icedid_luca-stealer_njrat_stealc.exe
Size 1.5MB
Sample260703-e1646abt6y
SHA256 60ba214796ece45ea2131e23425919c61a635afe75180ea0feeaaefa7b63195b
MD5 657834a3d3cee7d01669c502960c781f
SHA1 2de45ca436e7ad3ad91e21dbb894b87a08afc706
SHA512 848bf77389d555d12243ad6744287ec927c5cf6af3310f826b222e237f7d2f8e77ec3110240e64724471c557400641d38022f65520b56cbe8307fd51dd88b7ab
SSDEEP 24576:bEjU5PYcrZMYMx19POnaWnHrtjGstZ1UXHhmPh4bGgdW8ooBQeX:bscrq3lIL4sv1UxmYW8R3
TLSH
T138758F46B6B400FCD057C27889566907E7B278061F74A7DF16D08AAA6F33EE11A7E334
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

credential_access defense_evasion discovery spyware stealer

Malware Config

Signatures

Uses browser remote debugging 2 TTPs 9 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
4304	chrome.exe
812	chrome.exe
2576	msedge.exe
2680	msedge.exe
3284	msedge.exe
1040	msedge.exe
2360	chrome.exe
2688	chrome.exe
804	msedge.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3028	chrome.exe
2852	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
4320	taskkill.exe
2068	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134275263442513000"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe

Suspicious use of AdjustPrivilegeToken 38 IoCs

description	pid	Process
Token: SeDebugPrivilege	2068	taskkill.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeDebugPrivilege	4320	taskkill.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4304	chrome.exe
2576	msedge.exe
2576	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 4792 wrote to memory of 4892	4792	2026-07-03_657834a3d3cee7d01669c502960c781f_icedid_luca-stealer_njrat_stealc.exe	86
PID 4892 wrote to memory of 2068	4892	cmd.exe	88
PID 4792 wrote to memory of 4304	4792	2026-07-03_657834a3d3cee7d01669c502960c781f_icedid_luca-stealer_njrat_stealc.exe	90
PID 4304 wrote to memory of 3176	4304	chrome.exe	91
PID 4304 wrote to memory of 4692	4304	chrome.exe	92
PID 4304 wrote to memory of 4692	4304	chrome.exe	92
PID 4304 wrote to memory of 3028	4304	chrome.exe	93
PID 4304 wrote to memory of 3756	4304	chrome.exe	94
PID 4304 wrote to memory of 3756	4304	chrome.exe	94
PID 4304 wrote to memory of 2688	4304	chrome.exe	95
PID 4304 wrote to memory of 2688	4304	chrome.exe	95
PID 4304 wrote to memory of 2360	4304	chrome.exe	96
PID 4304 wrote to memory of 2360	4304	chrome.exe	96
PID 4304 wrote to memory of 812	4304	chrome.exe	98
PID 4304 wrote to memory of 812	4304	chrome.exe	98
PID 4304 wrote to memory of 3244	4304	chrome.exe	99
PID 4792 wrote to memory of 4152	4792	2026-07-03_657834a3d3cee7d01669c502960c781f_icedid_luca-stealer_njrat_stealc.exe	102
PID 4152 wrote to memory of 4320	4152	cmd.exe	104
PID 4792 wrote to memory of 2576	4792	2026-07-03_657834a3d3cee7d01669c502960c781f_icedid_luca-stealer_njrat_stealc.exe	105
PID 2576 wrote to memory of 2080	2576	msedge.exe	106
PID 2576 wrote to memory of 2852	2576	msedge.exe	107
PID 2576 wrote to memory of 1068	2576	msedge.exe	108
PID 2576 wrote to memory of 1068	2576	msedge.exe	108
PID 2576 wrote to memory of 1068	2576	msedge.exe	108
PID 2576 wrote to memory of 1148	2576	msedge.exe	109
PID 2576 wrote to memory of 1148	2576	msedge.exe	109
PID 2576 wrote to memory of 804	2576	msedge.exe	110
PID 2576 wrote to memory of 804	2576	msedge.exe	110
PID 2576 wrote to memory of 2680	2576	msedge.exe	111
PID 2576 wrote to memory of 804	2576	msedge.exe	110
PID 2576 wrote to memory of 2680	2576	msedge.exe	111
PID 2576 wrote to memory of 2680	2576	msedge.exe	111
PID 2576 wrote to memory of 1040	2576	msedge.exe	112
PID 2576 wrote to memory of 3284	2576	msedge.exe	113
PID 2576 wrote to memory of 1040	2576	msedge.exe	112
PID 2576 wrote to memory of 1040	2576	msedge.exe	112
PID 2576 wrote to memory of 3284	2576	msedge.exe	113
PID 2576 wrote to memory of 3284	2576	msedge.exe	113

C:\Users\Admin\AppData\Local\Temp\2026-07-03_657834a3d3cee7d01669c502960c781f_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-03_657834a3d3cee7d01669c502960c781f_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM chrome.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4892
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless=new --remote-debugging-port=19224 --no-first-run --disable-gpu --disable-extensions --disable-background-networking --profile-directory="Default" --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data"
  2⤵
  - Uses browser remote debugging
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4304
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd7400c728,0x7ffd7400c734,0x7ffd7400c740
    3⤵
    PID:3176
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1912,i,3015581715534498100,4148696863998128069,262144 --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1908 /prefetch:2
    3⤵
    PID:4692
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1912,i,3015581715534498100,4148696863998128069,262144 --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1612 /prefetch:3
    3⤵
    - System Time Discovery
    PID:3028
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1912,i,3015581715534498100,4148696863998128069,262144 --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2412 /prefetch:8
    3⤵
    PID:3756
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=19224 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1912,i,3015581715534498100,4148696863998128069,262144 --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3108 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2688
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=19224 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1912,i,3015581715534498100,4148696863998128069,262144 --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3148 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2360
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=19224 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1912,i,3015581715534498100,4148696863998128069,262144 --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4376 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:812
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1912,i,3015581715534498100,4148696863998128069,262144 --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4868 /prefetch:8
    3⤵
    PID:3244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM msedge.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4152
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless=new --remote-debugging-port=19474 --no-first-run --disable-gpu --disable-extensions --disable-background-networking --profile-directory="Default" --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data"
  2⤵
  - Uses browser remote debugging
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x25c,0x7ffd734ac188,0x7ffd734ac194,0x7ffd734ac1a0
    3⤵
    PID:2080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2136,i,9575068445704225370,5174448093846794942,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:3
    3⤵
    - System Time Discovery
    PID:2852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2136,i,9575068445704225370,5174448093846794942,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:2
    3⤵
    PID:1068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2136,i,9575068445704225370,5174448093846794942,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:8
    3⤵
    PID:1148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=19474 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2136,i,9575068445704225370,5174448093846794942,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=19474 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2136,i,9575068445704225370,5174448093846794942,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=19474 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2136,i,9575068445704225370,5174448093846794942,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4060 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:1040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=19474 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2136,i,9575068445704225370,5174448093846794942,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4076 /prefetch:2
    3⤵
    - Uses browser remote debugging
    PID:3284

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3996

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3288

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 2fad121a0a75841a3d07c2daa01966ff6ffdf40ad1ab0f55526b6fa1b48c45a8
MD5 c52e4d3cb36e3c4c4a0f9a527458d00a
SHA1 304d38e3daaf890d63e34a02894868763db78266
SHA512 42d5988090e8e5907f007ce0dad49623bc48a7fc12219cf24d449651d76d2e1728ae90b1e024296a701df8121367a9a7e6dc7b1b7693c3804cadd4b33e4583a5
TLSH
T124E02BBAC920AD2B08FD07292458074EE754239B2B41455B3E3C870D8FB963B0986C1C
MD5 SHA1 SHA512 TLSH

Submit Download

0c604b26-658c-48f8-8cdd-977a8cb89e5c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\0c604b26-658c-48f8-8cdd-977a8cb89e5c.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 4446d4f9d948d4a4d964f828777153cbb470bc8f490b1299cb8e9979f34828ba
MD5 862db159f1398e995fdeb8bea4c41092
SHA1 992ff3830b7c8654b2afe7e9db0174296036240b
SHA512 f28f01492f417c85791478e79a0f3760c82e4627001e090a96a5f68dcd123e8045856e85fc947c07c21ac01800d21b698cc9a6e85ddc218c20834590cb8049f0
SSDEEP 192:6RPui1av72ympAPRp2/95Hsb+WNnNa40ZV27AadcZVyIsnAUge:6RPuM2QUXo7wY40P28ai/e
TLSH
T15742C82FA924693B9CCBC319F9227757D7F9112625E42E84EAFC872C15E75CC221B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 14KB
SHA256 1abb4e9e48f5ed23e9deb8a3c9a90373cd06578f49c1772e822d76d9584e4be4
MD5 2a5c73cdb48b508c7a73a0873e141a7e
SHA1 c0572da5404e06ff4eaec0c220a9fa92c8c8cc2e
SHA512 cf6b393aaf120cbd510cd5afe825cedb12981ec7483f2fa984db91a83a58f79743b5dfb7f14d4c0793747a9fd44b22a72d6487f797af2837c2434a72da187d19
SSDEEP 384:Q+jM77KxkXqKf/pUZNCgVLH2HfgslAV7pLuLcSjW3XODM3+ErU3RkkVWtl:QOM77KxkXqKf/pUZNCgVLH2HfgsSV7pL
TLSH
T19C62E867A84C9E370FD4C589DC17BF4FACB5025B66ED882492FA9C1503D5B8E110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nmmhkkegccagdldgiimedpiccmgmieda\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nmmhkkegccagdldgiimedpiccmgmieda\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 53007c4b5c2d1a11281bb76829372dcd3852e05b7a792cd3ac9850810095beea
MD5 2cf33c344d8bd6d5c46a449fffbde684
SHA1 11e07e704e472776fea781fe53cf2058300d015e
SHA512 ef8dd2ce8e8b0bcfa27c5f46bf92e9dfca76d4daab64d39ad50063f0b1312f165be677613d01e581e1d12fc618aba86eb20320a9cba9104a696b1a4e3a6b31ab
SSDEEP 1536:o1xGyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbz:8Mqfd7NtZL8cHQRZEQ6Spsk
TLSH
T1D6C30237ABC61E335EC2CB60B9130EDB97B545A9D034D305AA6D2BFF6883495684249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 4f925501ba502ad1e0e19108effe927911ae7849d1607d84a36bb474ccc731be
MD5 514d22a9179bb022099185dd1d3a88a7
SHA1 26d7a509b49f5820df98e1a47e9d3cc6e2f3dc16
SHA512 b9581b3946bdfc1775619acfc066b804ebe2c99325c0caf91e48035d8ab3db61206a1f60737523beba1bbe8400dc5d824ac84392506716f832677fbc6b9efb67
SSDEEP 1536:TmQyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjf:vqfd7NtZL8cHQRZEQ6Spsk
TLSH
T1EAC30237EBC21F339D96CB60B9530FDA97B644A99034D301AA7D77BF6C83491684289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 550b72068c284fd67e1b963da24e8997a1a758dc87993de4cfb92bc21765d3b4
MD5 6de2df567d2e42d515aa7acb83ff194f
SHA1 61e65f8bba8f239d101d7554d2473501ec69dff5
SHA512 228bde88c301eaafdadf69b62b2cd4e20bdc7ff123aec2a89f96b33cefd3ed8a39ebb8c20c03b7ac8f7b05edd85a60e4b9368dfb23da3d41bc4ad855ed5b0a26
SSDEEP 192:eONX61rWQmiUz+8rGGX5Obd+jFjzors1yRjAX6klYjJh1A5U6:eONX6UpCGX5od+t8s1MAXwmU6
TLSH
T11112F831A46CEC6B5ED3B544B48732539EE9217BDE856F84D6EC0F1C009769C2B1AC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e94193180cf7c3834a4349750b47d22c4b47881787165cd21ef75daedabf5aab
MD5 f84ebb591cb6bc2ec534a1c768358f7c
SHA1 2428dec09e615642734e5e243803524544dffb91
SHA512 fe6cd4a18279855579530046591fcb9d20d6443bafc5ea4e659cf44332f61b74e00cdde6e2424dea3aadfbe83ae54f7ab9f4f863fba0f620f2abcaa49e9db48e
SSDEEP 192:yONx61VWQmiUyx8gGX5Obd+jFjzors1yRjL/aQ3YtU6:yONx6W3gGX5od+t8s1MubtU6
TLSH
T1C002D736A9686C7B8EE2BE49B88737135FD8106BEA552F84C6EC0F1C009765C2306837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download