b19e9f8b8b5cefd798ffd7a3b428aa842798d697a049f32cf80c720ccb5602f0

Analysis

max time kernel
22s
max time network
42s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 03:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Trojan.Siggen32.61915.1296.exe
Size 2.8MB
Sample260705-ebk6dscy5p
SHA256 b19e9f8b8b5cefd798ffd7a3b428aa842798d697a049f32cf80c720ccb5602f0
MD5 2ae339b769bb7b5ec637d243e07a349e
SHA1 51c82d82b7e8e89521e4f3259524fbc2a4b8e595
SHA512 48932e30bf6b543ac7e3d79915ae518de75aa3fcf4ad24cf90a6a8202335b12886d017fa32b22c761869938282a930093cd6aacb76fca12b52b98536ad6928cb
SSDEEP 49152:OIWQYezEREEbDncQtLiwhjsVhzPqsBbcUVgwN:OIKeBQtmojsbzPqsBbTV9N
TLSH
T137D5AE0BBCD508E9C4AA673588B201967B35BC4A0F3263C72E90B7782F727E19D79754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery spyware stealer

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 7 IoCs

description	pid	Process	procid_target
PID 4904 created 5820	4904	SecuriteInfo.com.Trojan.Siggen32.61915.1296.exe	88
PID 4904 created 1664	4904	SecuriteInfo.com.Trojan.Siggen32.61915.1296.exe	89
PID 4904 created 4828	4904	SecuriteInfo.com.Trojan.Siggen32.61915.1296.exe	90
PID 4904 created 4632	4904	SecuriteInfo.com.Trojan.Siggen32.61915.1296.exe	91
PID 4904 created 4916	4904	SecuriteInfo.com.Trojan.Siggen32.61915.1296.exe	92
PID 4904 created 3500	4904	SecuriteInfo.com.Trojan.Siggen32.61915.1296.exe	94
PID 4904 created 3220	4904	SecuriteInfo.com.Trojan.Siggen32.61915.1296.exe	95

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4904	SecuriteInfo.com.Trojan.Siggen32.61915.1296.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4632	chrome.exe
3576	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SecuriteInfo.com.Trojan.Siggen32.61915.1296.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	SecuriteInfo.com.Trojan.Siggen32.61915.1296.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
4904	SecuriteInfo.com.Trojan.Siggen32.61915.1296.exe
4904	SecuriteInfo.com.Trojan.Siggen32.61915.1296.exe
4904	SecuriteInfo.com.Trojan.Siggen32.61915.1296.exe
4904	SecuriteInfo.com.Trojan.Siggen32.61915.1296.exe
4904	SecuriteInfo.com.Trojan.Siggen32.61915.1296.exe
4904	SecuriteInfo.com.Trojan.Siggen32.61915.1296.exe
4904	SecuriteInfo.com.Trojan.Siggen32.61915.1296.exe
4904	SecuriteInfo.com.Trojan.Siggen32.61915.1296.exe
4904	SecuriteInfo.com.Trojan.Siggen32.61915.1296.exe
4904	SecuriteInfo.com.Trojan.Siggen32.61915.1296.exe
4904	SecuriteInfo.com.Trojan.Siggen32.61915.1296.exe
5820	chrome.exe
5820	chrome.exe
4904	SecuriteInfo.com.Trojan.Siggen32.61915.1296.exe
4904	SecuriteInfo.com.Trojan.Siggen32.61915.1296.exe
4904	SecuriteInfo.com.Trojan.Siggen32.61915.1296.exe
4904	SecuriteInfo.com.Trojan.Siggen32.61915.1296.exe
4904	SecuriteInfo.com.Trojan.Siggen32.61915.1296.exe
4904	SecuriteInfo.com.Trojan.Siggen32.61915.1296.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
5820	chrome.exe
5820	chrome.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	4904	SecuriteInfo.com.Trojan.Siggen32.61915.1296.exe
Token: SeShutdownPrivilege	5820	chrome.exe
Token: SeCreatePagefilePrivilege	5820	chrome.exe
Token: SeShutdownPrivilege	5820	chrome.exe
Token: SeCreatePagefilePrivilege	5820	chrome.exe
Token: SeShutdownPrivilege	5820	chrome.exe
Token: SeCreatePagefilePrivilege	5820	chrome.exe
Token: SeShutdownPrivilege	5820	chrome.exe
Token: SeCreatePagefilePrivilege	5820	chrome.exe
Token: SeShutdownPrivilege	5820	chrome.exe
Token: SeCreatePagefilePrivilege	5820	chrome.exe
Token: SeShutdownPrivilege	5820	chrome.exe
Token: SeCreatePagefilePrivilege	5820	chrome.exe
Token: SeShutdownPrivilege	5820	chrome.exe
Token: SeCreatePagefilePrivilege	5820	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe
5820	chrome.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 5820	4904	SecuriteInfo.com.Trojan.Siggen32.61915.1296.exe	88
PID 5820 wrote to memory of 1664	5820	chrome.exe	89
PID 5820 wrote to memory of 4828	5820	chrome.exe	90
PID 5820 wrote to memory of 4632	5820	chrome.exe	91
PID 5820 wrote to memory of 4828	5820	chrome.exe	90
PID 5820 wrote to memory of 4916	5820	chrome.exe	92
PID 5820 wrote to memory of 4916	5820	chrome.exe	92
PID 5820 wrote to memory of 3500	5820	chrome.exe	94
PID 5820 wrote to memory of 3220	5820	chrome.exe	95
PID 5820 wrote to memory of 3500	5820	chrome.exe	94
PID 5820 wrote to memory of 3220	5820	chrome.exe	95
PID 5820 wrote to memory of 4368	5820	chrome.exe	96
PID 5820 wrote to memory of 4368	5820	chrome.exe	96

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen32.61915.1296.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen32.61915.1296.exe"
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5820
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffac6c4c728,0x7ffac6c4c734,0x7ffac6c4c740
    3⤵
    PID:1664
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1640,i,9154107048414054778,8695323532271706285,262144 --field-trial-handle=1896,i,764676822372493037,17782935625339949836,262144 --variations-seed-version --mojo-platform-channel-handle=1892 /prefetch:2
    3⤵
    PID:4828
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1952,i,286193073842808116,11123007172097668851,524288 --field-trial-handle=1896,i,764676822372493037,17782935625339949836,262144 --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4632
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2236,i,7297638035468126341,546283339531035845,524288 --field-trial-handle=1896,i,764676822372493037,17782935625339949836,262144 --variations-seed-version --mojo-platform-channel-handle=2668 /prefetch:13
    3⤵
    PID:4916
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3068,i,18271513472289287431,14827529062542552847,2097152 --field-trial-handle=1896,i,764676822372493037,17782935625339949836,262144 --variations-seed-version --mojo-platform-channel-handle=3208 /prefetch:1
    3⤵
    PID:3500
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3080,i,15589169917767212663,12711794714579752416,2097152 --field-trial-handle=1896,i,764676822372493037,17782935625339949836,262144 --variations-seed-version --mojo-platform-channel-handle=3232 /prefetch:1
    3⤵
    PID:3220
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4592,i,5500021462808206328,12147627802785992834,524288 --field-trial-handle=1896,i,764676822372493037,17782935625339949836,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:14
    3⤵
    PID:4368
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5404,i,16176796561115953438,1475517652025120545,524288 --field-trial-handle=1896,i,764676822372493037,17782935625339949836,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
    3⤵
    PID:5460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
  2⤵
  PID:932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x284,0x7ffaaa5ec188,0x7ffaaa5ec194,0x7ffaaa5ec1a0
    3⤵
    PID:6064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1844,i,8346074448367511784,578662204771716722,262144 --field-trial-handle=2952,i,9597390888714274954,16847928311929519852,262144 --variations-seed-version --mojo-platform-channel-handle=2948 /prefetch:2
    3⤵
    PID:4884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,6516256326506248502,7956299134715785562,524288 --field-trial-handle=2952,i,9597390888714274954,16847928311929519852,262144 --variations-seed-version --mojo-platform-channel-handle=3084 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2412,i,8516802297203228531,17750568714067499533,524288 --field-trial-handle=2952,i,9597390888714274954,16847928311929519852,262144 --variations-seed-version --mojo-platform-channel-handle=3092 /prefetch:13
    3⤵
    PID:1716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,621349275033313710,13439261535837951173,2097152 --field-trial-handle=2952,i,9597390888714274954,16847928311929519852,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
    3⤵
    PID:4536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,10939141819501431261,8941998376036852256,2097152 --field-trial-handle=2952,i,9597390888714274954,16847928311929519852,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
    3⤵
    PID:3380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4024,i,1753744221841729636,13799818654583105024,2097152 --field-trial-handle=2952,i,9597390888714274954,16847928311929519852,262144 --variations-seed-version --mojo-platform-channel-handle=4084 /prefetch:1
    3⤵
    PID:4496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4060,i,5826599098184689288,2527067134909402812,2097152 --field-trial-handle=2952,i,9597390888714274954,16847928311929519852,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:9
    3⤵
    PID:2072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,17928884949308811193,585237933368902373,524288 --field-trial-handle=2952,i,9597390888714274954,16847928311929519852,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:14
    3⤵
    PID:6132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,227025560879699116,17501828206702687537,524288 --field-trial-handle=2952,i,9597390888714274954,16847928311929519852,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:14
    3⤵
    PID:3556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,18404499494464060282,17470525738456261461,524288 --field-trial-handle=2952,i,9597390888714274954,16847928311929519852,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:14
    3⤵
    PID:4604

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4748

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1216

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:5360
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  PID:696

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:712

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:296

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 c3b0a03936e1232c227abf05ad29708687c5a5244ca1be73456d22e21c1505cc
MD5 9408390b197449f9b27213a41b7fc767
SHA1 1e6463cfeb5b3b6d2373331a1603db0e2ac2ae3b
SHA512 73945a2ca54545bdc259da2dd20b630d247d9056c62a59e409f9da697232ecc940e7ec739ae77f85a3bc8b250d5b5cc8a389e270367d17db4abf63dd72058f71
SSDEEP 192:/3RMxBZuv7zlvAPRp2y9XHsb+WNnwYPC2eAjVyIsnAUgR:/3RMxLKl6XJxwbPpFR
TLSH
T17D22C66EA914643B5CCBC229FE717763DBF6002131D42E84EAFC9A2C16D79CC2217027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 4d67ce396e2f42dabc79a6204aa683970924223f390758adbaeb80af4cb87647
MD5 cc4cb8a9a3850863ac6d2ae35d43a670
SHA1 bd835616d63f914df04e577233699e5a5b819bdf
SHA512 c74da5470304c0278660b77b02b4306c4aeb99741b094ae6bc8bd805251b6448e1452877fb4488fda7dd772067a6530c509c4d9aa24054037ab08bba11e4d432
SSDEEP 192:ewL4K6th7KxkXqK4I40pUZNCgVLHrKHfFKslEAZP5XzKD/+5+ErUkKN9nfmH63Hb:RLjGh7KxkXqKf/pUZNCgVLH2HfgslV5U
TLSH
T1D732D82BA48D9E3F4FD8D51CCC526F8B6CF5029672680D2496FB9D0803A57CE115A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 235d282de2803b2bb4bedab1c8d609db5007081dd16181ac8bf4d37afd79e508
MD5 1729020a3c0a859e9f1e50d4dd1310fb
SHA1 8a9c4da74b596863acb2981716fecf259b8343ef
SHA512 f5e649c030c15af470f84b4b272ea90be01f56c4c5087c0d5e83f46c351aa7665f7aab3dc933cd6b1122c2edee11bd0066982735d42bb64bb5fc8c5e8fc2eb77
SSDEEP 96:VC68d+laPzyON3b/fVvMxRRDotok5jODEB6VddGyvvwjNuwb7v4a:VCPmaPzyONr1vmDUD0oQdwJjNuwbf
TLSH
T1D6A11972A028DD3759B6D885B1176F83CFB4616BA6219F98D8EC2F0C52F71EC0342523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 6e12481c888a43977c8ececb8a08e7103093526306643b3c6cb1dd23a3ef57d2
MD5 e23f5dd2eb4a2e57aae45d32e95a174a
SHA1 bd6172c6a8de8bf73aa3090143609bfd20321e5d
SHA512 4309d3c20532677a11e792f2dcfb58e22a3f0f1c5e9fdae2b52b247f82b9db7d21c9d8f5578a813e157bbbc7cbb1927da0ca78fb0fc34de05550a68dfcdbbc5d
SSDEEP 96:FC63dd+laPzyON3b/fVvuxESl8h4otop5jFDEB6SddGyvvwcCtPL1I054v5iyWwM:FCqmaPzyONr1vRiU2BordwJcime2mwM1
TLSH
T13DC10872A41DEC735AF3D889B1037E978EB4316BA651AE68D9E91F0C12E71AC0343512
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3a958178f477b8cf0f18d83e0835916167b3eaf95d859728b647bc0100a82efc
MD5 b2c496fb89251ff9b8ff1c46a5315932
SHA1 19626950ca3b280d084016871229a48eb3fa5ffc
SHA512 bbd974e4a08ca8f629f0b9a8892ba78ac7d4191c1640d1037e4fd018dadb4d8edd0a663e4a673a29497151c4defd9be09b6a4a4788adf24b182cbc36b18ccda7
TLSH
T1C5D08031774DFD08C18054757890D3517A104460245AC3186329E01DDDBC68513DF0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 48b0127c48894e5c8e42b14bcc7f6b1f91ca5d97355f42d22391fb602568bb1d
MD5 df62623cabc43e309a7767f4081f29d9
SHA1 420f1a4b11b86944a73d3cbcd4aec4883dfdfd62
SHA512 02067a08d194a87842f985ff7d0bee13c7b7228146565bf19114ffaebc120cb3d2ba8b19c941bb0d2773043366f064246a55efd57127d4a0de5768f453b2730c
TLSH
T1FDD08035774DFD08C18054717890D3517A204460345AC3186329A01DDDBC68513DF0EF
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 9e70be06db61c139d05d905a1a9525fbbdd3b0655c162d1ec84da46b5c27d9b2
MD5 9f2bbc339ba18a87169c5ac3e983d292
SHA1 b6dc1d979e16cbfa9d1517bb62d174d7b6ef335b
SHA512 d2ad57586c9697e078a864e9a95a77a393ce08c58e5cc5d8513bf79ccb75ec0a768e19f2ebb77428588aaac9ffc17b11a77a394a2f3467ed759ef5504e379b7d
SSDEEP 768:Arv+4UNbd23XPthhZ+AW+152MvSCa2CP+8rir9:Absbs3Tpx2pzPDriR
TLSH
T1F103BF32E8A9A9738DB686C4764B7613BFB0119385C10B94CDD92B4E429B6CD230BD77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 607B
SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
MD5 76b78ed7ff6273215b134d6a6488035d
SHA1 9e7a11ffb68d027036302eccd4c22315054843a9
SHA512 9919504cd4d8c0757abff8da4bbad1c4b6532f81d290c736fc5624ef66de45e6a9e29a8290854ae554d5bdfc5291f1ea81ae62d1b25846bfbcf1515e2ec3e4f1
TLSH
T174F0DC53CBD6536BD527223CC8E207E1FA70E2719E81212386106F2D6CB77241E474B4
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4904-120-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/4904-99-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/4904-10-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/4904-12-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/4904-13-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/4904-14-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/4904-15-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/4904-27-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/4904-43-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/4904-52-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/4904-56-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/4904-55-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/4904-64-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/4904-75-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/4904-98-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/4904-95-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/4904-110-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/4904-113-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/4904-123-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/4904-135-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/4904-134-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/4904-133-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/4904-132-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/4904-131-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/4904-130-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/4904-122-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/4904-121-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/4904-8-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/4904-119-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/4904-111-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/4904-108-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/4904-103-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/4904-100-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/4904-7-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/4904-136-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/4904-320-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/4904-161-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/4904-160-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/4904-158-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/4904-319-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/4904-157-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/4904-144-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/4904-318-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/4904-149-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/4904-148-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/4904-147-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/4904-146-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/4904-145-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/4904-313-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/4904-312-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/4904-311-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/4904-310-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/4904-88-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/4904-87-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/4904-86-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/4904-85-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/4904-74-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/4904-73-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/4904-6-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/4904-4-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/4904-3-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/4904-2-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/4904-1-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/4904-0-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/4904-54-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/4904-53-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download