59c292aaa6b81e0de85fd7f463c7042f680c49e00f7e0027e6d0940a0fc88d9e

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 12:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Thor7.exe
Size 809KB
Sample260722-pflmtsef49
SHA256 59c292aaa6b81e0de85fd7f463c7042f680c49e00f7e0027e6d0940a0fc88d9e
MD5 2a3379120119c12e6281193c3f864c80
SHA1 65da6850d086d2fbeff693f9c1499fda09f91895
SHA512 5df1c24f52cf19a8387a208abaf766ae540b98a2d69a451833d5ef83af545109ae3aae1012a7f4806db9d3eabf9223937f6455665d2a0ee96fcbe7c8eafa775d
SSDEEP 12288:1ByztY2aSj3MXu3/JkC09wlvGiKKkUkcQGek0S2ZMQGYqX:QaKOuhkZKdGakVnk0xGY
TLSH
T10205BF3B72958F21C24A4373C5D7450097EA964776ABFB0F72C813D619427FECA0A29B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection discovery spyware stealer

Malware Config

Signatures

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 33 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Thor7.exe
Key queried	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Thor7.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Thor7.exe
Key queried	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	Thor7.exe
Key queried	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	Thor7.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	Thor7.exe
Key queried	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Thor7.exe
Key opened	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Thor7.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Thor7.exe
Key queried	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Thor7.exe
Key queried	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	Thor7.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	Thor7.exe
Key queried	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	Thor7.exe
Key opened	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Thor7.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	Thor7.exe
Key queried	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	Thor7.exe
Key opened	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Thor7.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	Thor7.exe
Key opened	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Thor7.exe
Key queried	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	Thor7.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Thor7.exe
Key queried	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Thor7.exe
Key opened	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Thor7.exe
Key queried	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Thor7.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	Thor7.exe
Key queried	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Thor7.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Thor7.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Thor7.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	Thor7.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Thor7.exe
Key opened	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Thor7.exe
Key opened	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Thor7.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Thor7.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Thor7.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5764	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5936	Thor7.exe
5936	Thor7.exe
5936	Thor7.exe
5936	Thor7.exe
5936	Thor7.exe
5936	Thor7.exe
5936	Thor7.exe
5936	Thor7.exe
5936	Thor7.exe
5936	Thor7.exe
5936	Thor7.exe
5936	Thor7.exe
5936	Thor7.exe
5936	Thor7.exe
5936	Thor7.exe
5936	Thor7.exe
5936	Thor7.exe
5936	Thor7.exe
5936	Thor7.exe
5936	Thor7.exe
5936	Thor7.exe
5936	Thor7.exe
5936	Thor7.exe
5936	Thor7.exe
5936	Thor7.exe
5936	Thor7.exe
5936	Thor7.exe
5936	Thor7.exe
5936	Thor7.exe
5936	Thor7.exe
5936	Thor7.exe
5936	Thor7.exe
5936	Thor7.exe
5936	Thor7.exe
5936	Thor7.exe
5936	Thor7.exe
5936	Thor7.exe
5936	Thor7.exe
5936	Thor7.exe
5936	Thor7.exe
5936	Thor7.exe
5936	Thor7.exe
5936	Thor7.exe
3196	chrome.exe
3196	chrome.exe
5936	Thor7.exe
5936	Thor7.exe
5936	Thor7.exe
5936	Thor7.exe
5936	Thor7.exe
5936	Thor7.exe
5936	Thor7.exe
5936	Thor7.exe
5936	Thor7.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
5936	Thor7.exe
5936	Thor7.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	5936	Thor7.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeDebugPrivilege	832	chrome.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3196	chrome.exe
3196	chrome.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 5936 wrote to memory of 3196	5936	Thor7.exe	90
PID 3196 wrote to memory of 2928	3196	chrome.exe	91
PID 3196 wrote to memory of 832	3196	chrome.exe	92
PID 3196 wrote to memory of 5764	3196	chrome.exe	93
PID 3196 wrote to memory of 2128	3196	chrome.exe	94
PID 3196 wrote to memory of 5676	3196	chrome.exe	95
PID 3196 wrote to memory of 3612	3196	chrome.exe	96
PID 3196 wrote to memory of 3672	3196	chrome.exe	97
PID 3196 wrote to memory of 5564	3196	chrome.exe	98
PID 3196 wrote to memory of 6048	3196	chrome.exe	99
PID 3196 wrote to memory of 3356	3196	chrome.exe	100
PID 3196 wrote to memory of 4752	3196	chrome.exe	101
PID 5936 wrote to memory of 6048	5936	Thor7.exe	99
PID 5936 wrote to memory of 832	5936	Thor7.exe	92
PID 5936 wrote to memory of 832	5936	Thor7.exe	92

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Thor7.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Thor7.exe

C:\Users\Admin\AppData\Local\Temp\Thor7.exe
"C:\Users\Admin\AppData\Local\Temp\Thor7.exe"
1⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:5936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\14ijhjei.e0z"
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3196
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\14ijhjei.e0z /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\14ijhjei.e0z\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\14ijhjei.e0z --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0xa4,0x138,0x7ffcf16ac728,0x7ffcf16ac734,0x7ffcf16ac740
    3⤵
    PID:2928
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\14ijhjei.e0z" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1632,i,9924711283707865138,2729715517369694576,262144 --field-trial-handle=2004,i,677073092077480759,7895158297261016894,262144 --variations-seed-version --mojo-platform-channel-handle=2000 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:832
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\14ijhjei.e0z" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1884,i,4595336114399537726,18345561475559712178,524288 --field-trial-handle=2004,i,677073092077480759,7895158297261016894,262144 --variations-seed-version --mojo-platform-channel-handle=2020 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5764
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\14ijhjei.e0z" --force-high-res-timeticks=disabled --metrics-shmem-handle=2124,i,4744718906205962391,2072960665288049705,524288 --field-trial-handle=2004,i,677073092077480759,7895158297261016894,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:13
    3⤵
    PID:2128
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\14ijhjei.e0z" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2844,i,11185193332809909747,17286222876763734562,2097152 --field-trial-handle=2004,i,677073092077480759,7895158297261016894,262144 --variations-seed-version --mojo-platform-channel-handle=2888 /prefetch:1
    3⤵
    PID:5676
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\14ijhjei.e0z" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2848,i,3258092212829344141,16433166429588235809,2097152 --field-trial-handle=2004,i,677073092077480759,7895158297261016894,262144 --variations-seed-version --mojo-platform-channel-handle=2928 /prefetch:1
    3⤵
    PID:3612
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\14ijhjei.e0z" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3128,i,15726644793890600759,11353320794141838369,2097152 --field-trial-handle=2004,i,677073092077480759,7895158297261016894,262144 --variations-seed-version --mojo-platform-channel-handle=3160 /prefetch:1
    3⤵
    PID:3672
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\14ijhjei.e0z" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3140,i,13892238691855836607,3555210590871375270,2097152 --field-trial-handle=2004,i,677073092077480759,7895158297261016894,262144 --variations-seed-version --mojo-platform-channel-handle=3264 /prefetch:9
    3⤵
    PID:5564
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\14ijhjei.e0z" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3716,i,11707980935615360289,3290315159121349040,2097152 --field-trial-handle=2004,i,677073092077480759,7895158297261016894,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:9
    3⤵
    PID:6048
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\14ijhjei.e0z" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4332,i,8687662592640959495,17041069605464129459,2097152 --field-trial-handle=2004,i,677073092077480759,7895158297261016894,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
    3⤵
    PID:3356
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\14ijhjei.e0z" --force-high-res-timeticks=disabled --metrics-shmem-handle=3652,i,3632386326554307301,101943088530202843,524288 --field-trial-handle=2004,i,677073092077480759,7895158297261016894,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:14
    3⤵
    PID:4752

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\14ijhjei.e0z\Crashpad\settings.dat
Size 40B
SHA256 d78bb00f1b344ae40f013591650ee8a1342976bb0e027ef70a7deafea7762aea
MD5 6f34b69f71ec4c28a844fd4a5bdd51b4
SHA1 7b9fe9640425faaa3d40a6babfa4204ed1f53813
SHA512 a2c588565cf36d4df967174432527b3795236f6ff70e318808dcddb0ee72931d88381ececdaf69d62203688cdb7e805d2de2f84bf74a85b69246a5f71398abf8
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\14ijhjei.e0z\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 02e7482413c9346e90b38b4b9d89b15564f1e86d18bf41b4523e5e7bc3bc9b04
MD5 2dc2f118f0909fa234bba97707aa653c
SHA1 d3c9bf6f45b198704b45794607622d2d135e812c
SHA512 6f0abce45eed4783fb67ea25b334ceeb7e4404d8c9f3afd924dea17037746ad82f80810fb5418baf4110c9b0f7b56aefd601fa0113c4c8c1b072ca7c86a19cab
SSDEEP 6:/F8kfRX1ikNWS1Cr4P3fRTTLnEC+Yglt:dFRX1HNt1o2TT0lt
TLSH
T1C31302AFACC14D4AC1A12038AC969FB372B56D09F1413F5790B468E631543550409145
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\14ijhjei.e0z\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 d6d4f222a42ea8fd21dd518abed9e010e19d87bcde21af0fac57440224f913e5
MD5 2fedf40358dbd673b85db0bcd1cff810
SHA1 0ea5718f7e4b104c42a6a57d6b017aa402225b38
SHA512 6d45f93f015e501a4151dc2f24f921280dff10015b5749ad998f511e2088d3a2157c802b1e52738ab4f735f6df4b9dc2363dfdbb760acb90b3368b361e97bb30
SSDEEP 12:U/uAflkUpqp9iki6WhUpqp9ixlWdVBpqp9iAZY/u7vsZvpqp9iAHC+ebwggwHx5F:5Aflk4NhBdgYGDsZEC+JO5qDDopHCZ
TLSH
T1B344CCE37C00525BCB50E3FE0100B33CCA3793286CDEDEDA962C05B29494FA626685A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\14ijhjei.e0z\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 f0f4c9a403918e48760a8bf6b8b8a82071252a4b4f9e3742a6cc5357a8c3871a
MD5 9eaf346fe5f17754bad2f2e52190d04e
SHA1 fc385e50c04cbcd5ef9e1ecfff7bfcbf944f2d5e
SHA512 2c13fed02b30490e6f4781638c52d9456086f2e8a09819d9b56e3537f094de8c25b5badc93fd7b651c355d0592e657dd6e4d27981ef8e225e1acb40400ed60af
SSDEEP 768:yUfDPLSgcRUv+z48UfDPLSgcRUv+T4uUfDPLSgcRUv+d4+fDPLSgcRUv+G4:o7Hv
TLSH
T1C4161BB74E647947D781EAB0BBC8EE183CB122CDEC925C91F52262695BE0FC11BC521D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\14ijhjei.e0z\Default\Cache\Cache_Data\f_000001
Size 37KB
SHA256 f90c3f2f23aa462195da198f8723cb4ce0c97b3bbe009d5aa43f2149dc651aa5
MD5 1b262aaf98416eb134c81249cd909600
SHA1 f117a8986157b0a6f0f5e47d54787f22573cad5d
SHA512 e4986c083cde60df3307e099cada7de30167ba45663da518c32c6ced7364ea1008474042d78367da28dffc07acf8b8470a397e340915904cc4574bb03e4fc315
SSDEEP 768:aSnwBzHLaQQh4tpb11daqnjaT5wC8xOwKZlhHK4D1NvvgY7vJTau5B1shS60kcOa:PwBzH3QmHCT5wC5wKZK4DHTtR1shdcOa
TLSH
T1B003E11B6C498BC37B451A98BE99E9DD1B1F1C1DC47F9F312EB85838264E13249E210C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\14ijhjei.e0z\Default\Cache\Cache_Data\index
Size 256KB
SHA256 587fbd4e6fda13c2a8794eed4f55a53742bfc16b479c102be19b72ace12af4fd
MD5 b6c5cb570bde80075080c03ef7b56e9e
SHA1 9b94f14054e10335e7524c958b3555da140f8474
SHA512 1346732f82a26635fd2149baed4f268dd0fc4ed03600f6e75060440662165e4f5091663d0d391ea6a93c8df4912b5139578d3f2190cfd7c613f12c507f46184a
SSDEEP 3:LsYllfltlNllklkXlxIPLll8njNtlmNtlwlNlXl:Lso13lP6PUkN
TLSH
T1D844012B97954C05C5D1017D880B83212324C444D50EE347471419252CC57906E1D184
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\14ijhjei.e0z\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 39b0c36067e48c72da30e30fb588d039d0f451b0bae1704c3180171f08903870
MD5 bb12c204e1d206a5cfd751db480df7de
SHA1 c5850da22907121a0e1bb375ddbfdf3885d0c83a
SHA512 7f35a255de886f2b116880cfedf717ab8ece4517eeca26ebef8ece684f579a1bbfc250339452c0cf30f2758ea8580f928d781f9db237930bbaadc5b6415b4871
TLSH
T114E02B85824D1F4DD73D96F7CDA603088A0A52C42ABE7603A880C2C237524741258123
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\14ijhjei.e0z\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 5f1d385c48f125e5d12fc836b71acd5427b754d61f0b2e64942d89615d748118
MD5 bce2ff82c66f8be25a225574d20edc93
SHA1 6a5fe497b04c1095f253662dad4ff5fa7704b31b
SHA512 46e838500e0b8ae34f9c4f81c9278d7622b5b0fa080751274dab5ae8229ac66589ca176c25d21ccfd4183746fc64abd0b64535518912677d18a272c58bbf28b5
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\14ijhjei.e0z\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 e97750e99b2a983c182625cfeca6ad489ac38b8b2d07d5c4c0c1d6694d2febfe
MD5 b983a543dff7ea077e72843eb35d0b81
SHA1 2913af90208c35af9026d2dff943b077db4da8ea
SHA512 bd52184c9bad58295f0f2af5cf14b279c8a5f73029b447827623681ab90ecd27587f48252f66fee11f16da937b2125cb076c14e1ef61e687260cd2c8a8da97bb
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\14ijhjei.e0z\Default\DawnGraphiteCache\index
Size 256KB
SHA256 1e29f5e2c998a1290b0db8a0f78016655c14b0c2cb202fb7b1a31029b0f1e229
MD5 ce37ca4e83b47ab8a701a20189e70220
SHA1 80d0ec6672fd2d0d00fcd68b4850c8d59110610a
SHA512 319e82b47412f5b4b7a298081ba55b2775bbe9fff5bf105666bb450241b37aa15651c3cfb3b3bd83d3497a9c7493401e5efd5b944529fd55cfa4655009406b66
SSDEEP 3:LstlNllklkXlgstf//l:LsX3lPgM/l
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\14ijhjei.e0z\Default\DawnWebGPUCache\index
Size 256KB
SHA256 a27c6e63ec1cdb3fd67b7e7fe082d8485cfaf9f5642a7fb966417ba9f3613631
MD5 119479e9dfad392841fb5b055fe6f309
SHA1 8c8c49fcb190823b591d46a9fbca297d915c52ba
SHA512 e6300f1f05dad32ae4c31dee18a2b8645782c94e5e5d6eed8c0a45a5a5bd3b696a9c4cc65d5da1dca77afdfc89e3edf71175625e61ea070b93d5daca27130d51
SSDEEP 3:LstlNllklkXl6/l:LsX3lP6/l
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\14ijhjei.e0z\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\14ijhjei.e0z\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\14ijhjei.e0z\Default\GPUCache\index
Size 256KB
SHA256 99bd62e1cea3685cc512d2f29de4bf9699972516175e17cd0e22c5ac4e5fcdc4
MD5 866792669e08476afec0a80b7a7acb0e
SHA1 f5063150a27592bdfd0c7c22b893662b0d8cb477
SHA512 519029e1c1018ff68b7ab9c49459056caf020a432836f99849a46a25b616a3103665a7ed9cdc8e7e509f4e1cfd3aa64abd07b4183fb7ed18f2b09ca00e45bd94
SSDEEP 3:LstlNllklkXlnr/l:LsX3lPnr/l
MD5 SHA1 SHA512 SSDEEP

Submit Download

README

Path C:\Users\Admin\AppData\Local\Temp\14ijhjei.e0z\Default\README
Size 180B
SHA256 c43668eec4a8d88a5b3a06a84f8846853fe33e54293c2db56899a5a5dfb4d944
MD5 883d62acd72005f3ad7a14500d482033
SHA1 e5900fe43fb18083bf6a483b926b9888f29ca018
SHA512 97bb1bde74057761788436de519765ea4e6ba1ad3a02d082704e8b3efca3ef69d3db6e65b65e5f5f90205e72c164d82779cf754d52ec05d944df49f10d822a6d
TLSH
T13CC01222958335AD511A81B2690162824A128831E42E9A61A6DE844C1704A63A2507DB
MD5 SHA1 SHA512 TLSH

Submit Download

2cc80dabc69f58b6_0

Path C:\Users\Admin\AppData\Local\Temp\14ijhjei.e0z\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0
Size 472B
SHA256 7433e2de592bac3d53e34206cd580d140d107eae0defa146b238d209d3b34c87
MD5 d1d6b5a71725264ad4893180b3baa615
SHA1 d1c1cef579f3a8b1d517c2171d6aa37390634fc3
SHA512 6f50f6f08b9c5fc7fdb614ee423f14cf2b2407c2488d7b5a0cfe8a497174ae194d4f564bda132d3180963213e24fa8bb6b25c158a5ac8734d2a73bc87f2068a1
TLSH
T1C2F0A3560D498974D71845F2CBD7735D87172628D93E5255B954821CD494F6CC8909C2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\14ijhjei.e0z\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 02f2ef2a2e1e818f26d5b20141e60e15701257a723eaf4c365e732ed60babeb2
MD5 78f0ded6a58ee6e56c507d75c093690c
SHA1 539a3b1c3c89ce4652c2658566d9972266a0a6fd
SHA512 d346e92b286b31ad3956d7172e987f0e1eab48d5c5d9fb83fe0d664904a197d73799f353922258601c92716da47af4a837e78835fe1aa1278025127d2af996ce
TLSH
T1FFA002610248D112C54103B078C283A87224F9659202536377E003768D603704921144
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\14ijhjei.e0z\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\14ijhjei.e0z\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 8585a78c59609bda67a1872e73581e90557d45e15b3b2633528eb3f7abd243a9
MD5 166e73bcab81b84b5ad065448baceecf
SHA1 a743e991b334aafb529ab8691356d63affed6a66
SHA512 49fafca39a9fd30152b3a689640025cf3bd8708f9a9c23065e51719a6766b8d98d9ac26f633d01b70cba8c6ea6cf90bf930cba120fec2266d74850afa03ca9fc
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\14ijhjei.e0z\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\14ijhjei.e0z\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\14ijhjei.e0z\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\14ijhjei.e0z\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\14ijhjei.e0z\GrShaderCache\index
Size 256KB
SHA256 3a3a04b1d9ecba2f27abe6da5b8203225b130bc77cc3a4cba8010903bc521fb4
MD5 fe71c98be15345c76be422769326bdb4
SHA1 9d73bd0b75dc4d0fe9b377f39d1f87bcd6730da9
SHA512 eef36d065239a00944c3d681debfb164a6aa45eabbc8d878918b085942aa3d99e69d11e217b7534001b6bb27b74a2286bdfd2bbf377c5289db80746e3fdc35f6
SSDEEP 3:LstlNllklkXlw5l:LsX3lPw5l
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\14ijhjei.e0z\GraphiteDawnCache\index
Size 256KB
SHA256 305530af7d8c3e73dc97d6fede850696744aa1bf777b26a6331a470ec984ee93
MD5 2a3834d891cff5b53bb435e3973c8b0f
SHA1 f505659d13aac1ac12d27f6374bbcfb93467bed0
SHA512 0d0b0abc8c633299f9223016750763003031c46470e79d1837c9655f09d8fca8caa060470f20ebd5f069d5cefd3cc1f430e9c2eb9dd6cf11e99fcb1f1907a185
SSDEEP 3:LstlNllklkXlUql:LsX3lPDl
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Temp\14ijhjei.e0z\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\14ijhjei.e0z\Local State
Size 1KB
SHA256 01279b8105838ab1b85f6994eb49ee83d22b51ed785f2fd14ac10a408c635f9c
MD5 5847922b74f461e5f20e5622a580aa40
SHA1 4265de53763488347fd3c8385c1e0eed8964fb80
SHA512 99866afee6850e9127a4256206e4c05d31c3006d9b045abce1138f740bdc840def13432c76601de0da5004eedfea01e967e2d7d4c730bdd6b805dab39c3dbf1c
TLSH
T156117575287E3725B8868A1DBD89A3970E386227C6A688496FCC2A0002B134C370DC39
MD5 SHA1 SHA512 TLSH

Submit Download

memory/832-137-0x0000017321780000-0x00000173217B2000-memory.dmp

Download

memory/832-134-0x0000017339B40000-0x0000017339C32000-memory.dmp

Download

memory/5936-12-0x0000000074242000-0x0000000074243000-memory.dmp

Download

memory/5936-200-0x0000000006F80000-0x0000000006F92000-memory.dmp

Download

memory/5936-139-0x0000000074230000-0x00000000749EC000-memory.dmp

Download

memory/5936-136-0x0000000074230000-0x00000000749EC000-memory.dmp

Download

memory/5936-39-0x0000000074230000-0x00000000749EC000-memory.dmp

Download

memory/5936-13-0x0000000074230000-0x00000000749EC000-memory.dmp

Download

memory/5936-0-0x0000000074242000-0x0000000074243000-memory.dmp

Download

memory/5936-11-0x0000000006FE0000-0x0000000007030000-memory.dmp

Download

memory/5936-10-0x0000000006D70000-0x0000000006E02000-memory.dmp

Download

memory/5936-9-0x0000000007410000-0x00000000079CA000-memory.dmp

Download

memory/5936-8-0x0000000006B60000-0x0000000006BC6000-memory.dmp

Download

memory/5936-7-0x0000000006A80000-0x0000000006AB2000-memory.dmp

Download

memory/5936-6-0x0000000006610000-0x0000000006702000-memory.dmp

Download

memory/5936-5-0x0000000005030000-0x000000000507C000-memory.dmp

Download

memory/5936-4-0x0000000005100000-0x00000000051D8000-memory.dmp

Download

memory/5936-146-0x0000000074230000-0x00000000749EC000-memory.dmp

Download

memory/5936-3-0x0000000004C00000-0x0000000004C7C000-memory.dmp

Download

memory/5936-2-0x0000000074230000-0x00000000749EC000-memory.dmp

Download

memory/5936-1-0x0000000000190000-0x0000000000260000-memory.dmp

Download

memory/5936-201-0x0000000074230000-0x00000000749EC000-memory.dmp

Download