8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 17:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
Size 2.0MB
Sample260723-vysfzstdke
SHA256 8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5
MD5 70379cb7a4b463eb82bb714f1b5bc4f6
SHA1 f42b07fbf23bd3c7aed23b8fcd640bdee459a3e6
SHA512 863caa6140e91140e0ccbcc754f5ca4b49ccf9f608f6277fe9eadff7ff8c75cd641c0c38ae959a8a001d0c254a7fab5ea14d2ef973fee3445e00720ce33f3d77
SSDEEP 49152:neGae3xs3TrauzUWzFZaG/wcjddddddddddddddddddddddddddddddd7n:neSBeHn5n
TLSH
T13A958C0BBDA448F6C0AAA2368C72A1517B71BC550F2223DB2AD0B67C2F777E05DB4754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2612	chrome.exe
1064	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134293010899684290"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{FA4539C9-2D8D-4765-8A8A-28FF51DF673F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
5604	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5604	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
4056	chrome.exe
4056	chrome.exe
5604	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5604	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5604	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5604	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5604	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5604	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5604	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5604	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5604	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5604	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5604	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5604	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5604	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5604	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4056	chrome.exe
Token: SeCreatePagefilePrivilege	4056	chrome.exe
Token: SeShutdownPrivilege	4056	chrome.exe
Token: SeCreatePagefilePrivilege	4056	chrome.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4056	chrome.exe
4656	msedge.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 5604 wrote to memory of 4056	5604	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe	89
PID 4056 wrote to memory of 5076	4056	chrome.exe	90
PID 4056 wrote to memory of 3436	4056	chrome.exe	91
PID 4056 wrote to memory of 3436	4056	chrome.exe	91
PID 4056 wrote to memory of 2612	4056	chrome.exe	92
PID 4056 wrote to memory of 4752	4056	chrome.exe	93
PID 4056 wrote to memory of 4752	4056	chrome.exe	93
PID 4056 wrote to memory of 6076	4056	chrome.exe	95
PID 4056 wrote to memory of 5464	4056	chrome.exe	96
PID 4056 wrote to memory of 6076	4056	chrome.exe	95
PID 4056 wrote to memory of 5464	4056	chrome.exe	96
PID 4056 wrote to memory of 4992	4056	chrome.exe	97
PID 4056 wrote to memory of 4992	4056	chrome.exe	97
PID 5604 wrote to memory of 4056	5604	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe	89
PID 5604 wrote to memory of 4656	5604	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe	100
PID 4656 wrote to memory of 3252	4656	msedge.exe	101
PID 4656 wrote to memory of 868	4656	msedge.exe	103
PID 4656 wrote to memory of 1064	4656	msedge.exe	104
PID 4656 wrote to memory of 868	4656	msedge.exe	103
PID 4656 wrote to memory of 868	4656	msedge.exe	103
PID 4656 wrote to memory of 4256	4656	msedge.exe	105
PID 4656 wrote to memory of 4256	4656	msedge.exe	105
PID 4656 wrote to memory of 4300	4656	msedge.exe	106
PID 4656 wrote to memory of 4300	4656	msedge.exe	106
PID 4656 wrote to memory of 4300	4656	msedge.exe	106
PID 4656 wrote to memory of 3224	4656	msedge.exe	107
PID 4656 wrote to memory of 3224	4656	msedge.exe	107
PID 4656 wrote to memory of 3224	4656	msedge.exe	107
PID 4656 wrote to memory of 4112	4656	msedge.exe	108
PID 4656 wrote to memory of 4112	4656	msedge.exe	108
PID 4656 wrote to memory of 4112	4656	msedge.exe	108
PID 4656 wrote to memory of 4252	4656	msedge.exe	109
PID 4656 wrote to memory of 4252	4656	msedge.exe	109
PID 4656 wrote to memory of 4252	4656	msedge.exe	109
PID 5604 wrote to memory of 4656	5604	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe	100
PID 4656 wrote to memory of 6012	4656	msedge.exe	112
PID 4656 wrote to memory of 2408	4656	msedge.exe	113
PID 4656 wrote to memory of 6012	4656	msedge.exe	112
PID 4656 wrote to memory of 2408	4656	msedge.exe	113
PID 4656 wrote to memory of 2656	4656	msedge.exe	115

C:\Users\Admin\AppData\Local\Temp\8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
"C:\Users\Admin\AppData\Local\Temp\8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check --disable-session-crashed-bubble --window-position=-32000,-32000 --window-size=800,600
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4056
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xa8,0xac,0x110,0xa4,0x134,0x7ff8f3fcc728,0x7ff8f3fcc734,0x7ff8f3fcc740
    3⤵
    PID:5076
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1612,i,9882365463434104729,14512445404179973570,262144 --field-trial-handle=1928,i,4871847296721175049,10821116033708421547,262144 --variations-seed-version --mojo-platform-channel-handle=1920 /prefetch:2
    3⤵
    PID:3436
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1492,i,177619260458199691,2376043283863003058,524288 --field-trial-handle=1928,i,4871847296721175049,10821116033708421547,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2612
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2324,i,5819373896721318728,16310395408772664953,524288 --field-trial-handle=1928,i,4871847296721175049,10821116033708421547,262144 --variations-seed-version --mojo-platform-channel-handle=2784 /prefetch:13
    3⤵
    PID:4752
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3216,i,5840571161110539505,18440852532508661258,2097152 --field-trial-handle=1928,i,4871847296721175049,10821116033708421547,262144 --variations-seed-version --mojo-platform-channel-handle=3268 /prefetch:1
    3⤵
    PID:6076
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3220,i,10511765577161873333,16682595344426313991,2097152 --field-trial-handle=1928,i,4871847296721175049,10821116033708421547,262144 --variations-seed-version --mojo-platform-channel-handle=3288 /prefetch:1
    3⤵
    PID:5464
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4676,i,9544849431628750439,7239012392174337988,2097152 --field-trial-handle=1928,i,4871847296721175049,10821116033708421547,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:1
    3⤵
    PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --no-default-browser-check --disable-session-crashed-bubble --window-position=-32000,-32000 --window-size=800,600
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ff8eb18c188,0x7ff8eb18c194,0x7ff8eb18c1a0
    3⤵
    PID:3252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1972,i,12222133090036594772,9058764021376512532,262144 --field-trial-handle=2528,i,8792516698223235759,14911649789134682123,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:2
    3⤵
    PID:868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2152,i,8899818105092722951,16816885675631359166,524288 --field-trial-handle=2528,i,8792516698223235759,14911649789134682123,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2656,i,4786431176746492004,3851832526310313773,524288 --field-trial-handle=2528,i,8792516698223235759,14911649789134682123,262144 --variations-seed-version --mojo-platform-channel-handle=3088 /prefetch:13
    3⤵
    PID:4256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,9626453883267636184,17533337333791959888,2097152 --field-trial-handle=2528,i,8792516698223235759,14911649789134682123,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
    3⤵
    PID:4300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3596,i,1326453044938477039,13439531052647839286,2097152 --field-trial-handle=2528,i,8792516698223235759,14911649789134682123,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
    3⤵
    PID:3224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4312,i,15086066992924190747,18253537645029301740,2097152 --field-trial-handle=2528,i,8792516698223235759,14911649789134682123,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:1
    3⤵
    PID:4112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4324,i,9549569602266514912,11866932424775826511,2097152 --field-trial-handle=2528,i,8792516698223235759,14911649789134682123,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:9
    3⤵
    PID:4252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,17632442734345867130,14972869195632501972,524288 --field-trial-handle=2528,i,8792516698223235759,14911649789134682123,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
    3⤵
    PID:6012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3768,i,11763637509904595814,7255183745890663838,524288 --field-trial-handle=2528,i,8792516698223235759,14911649789134682123,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
    3⤵
    PID:2408
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,5905415646020980724,277126614591535818,524288 --field-trial-handle=2528,i,8792516698223235759,14911649789134682123,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
    3⤵
    PID:5792
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,5905415646020980724,277126614591535818,524288 --field-trial-handle=2528,i,8792516698223235759,14911649789134682123,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
    3⤵
    PID:2656

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6096

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5356

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5068

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1204

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 02292fadfa7ad8a1abfe6fdc5d9d8434ddb824900345329cd743539f2678f348
MD5 f1ba6a7f1bec796e4b9df4f5ae2d6a58
SHA1 1fa97b21365e60a3d0c8ae6519908318abd7132b
SHA512 05ddc0283f0d91684e545973130e937629a8b32c5502f8e3214a29acbc10f1c68e6c95265aaf1555db803004daf7579bf627f2c2fb4a39bd7a98256ba3a981aa
TLSH
T1193188F7C3D8997D890596F8AB156F1BCE2D0E14532C3C16C8D4AE1F53E28B2D24064E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 f2ba2c898e7e427a4d3796bcc3f395805293244abc5eee9375751e26c748d06d
MD5 0b920fcaf5167a194e10c4a26d57e06d
SHA1 eeb63c8235b172e89dc29e3b9952686a5f649b16
SHA512 4236bff81be9b865f60b496402e292db915ede45faf496b63ae05993157c0a3c1eacb7f39b5cd525af9583fdad387fb8544b05e0e1b8520d7e9e8aa8f7ac7156
TLSH
T17FF09EAB976E7963A5BAC57F1D047C0968B9A43102E16CF4CE9A833CE0869F71B02413
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 eff12743ec034a26ee3ae7bc7791c988258f2576d9521e40b3eac7ed972a5953
MD5 dd13f82dc345fcfb65e6e10436c1ba13
SHA1 21f0f6d07878056ad34a2c3cdd87636e24534642
SHA512 cecce8ed9bc18be82144668b5432a2edeb7b3481a6d3cfc57d2986e592fc231ba7bef6e79f224e74216f7d8010b7948b392a5711806cf6a6428236cf4c175993
SSDEEP 96:gC0d+cAOIt5aDVmufj7jcbRDotok5FCD4B6/dGyv95S3hbb2Jv4a:gC0LA/TE57cDUDqMUweS3hbKl
TLSH
T142A10871B4A95EB75D79D584F4827E83CF68A157AA226F80D8DC1F0C10E75EC1382A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8ee8ad58-4f1c-459c-bc95-4ac98d1cfc38\index-dir\the-real-index
Size 696B
SHA256 e1cbd07adac14b1e461eb5c6c2f3ad332eaeb683a0ce78ea62981273d9cf6d65
MD5 56200eacb924fad4b30e3ad0b3a26a78
SHA1 5efaae4d7fcdc7ffbf290ccd4dba145fd7b4c3c9
SHA512 9891a71e2ff82ca82915eadd7941adf22af7dadb76ec3228612c4c7f383b51c3629960420fcc187f53e73bac42057333644d98d9ad1c9af0ba7215a4e1163c34
TLSH
T141010E87DCEA98C3CC177CBB663A344E333E09FD01059E9B009DA53E8D726388284394
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592b3c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8ee8ad58-4f1c-459c-bc95-4ac98d1cfc38\index-dir\the-real-index~RFe592b3c.TMP
Size 696B
SHA256 1c7382bbd520e5fede9a9451ea093238c1de7b94c145982c0fec16a472bf798a
MD5 508264809a8e73d1fad1dea710347401
SHA1 c0b04f2322924cba6a3fc8c2b331bd1bdb55355b
SHA512 f8ea63cfc5b51f893f1f83c49019c4dc92074b8cc04bf9ea16679028c20dbab0b0bc1ed36d8c95b0d9cf9b6ede230e93254aece8a22224cc187ebe0efa0b6f80
TLSH
T17901D4EB00D1EC42DD16B4F632196019733E0C303155DB4B60DFB87E59716384681651
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a8c35cdc18693cd3d11102d6282273a28b115b7ac6d116686f2f9df84858168e
MD5 be181fc9d9d394505083175b985c7416
SHA1 b8ad19fac1a3f2ecade1677211e7418f8e27b4e5
SHA512 8a934fa303e6034e17607ebcd1dd2b9599e530d4e030a870ba5f72ba5c9ef8cf09ffc558d3dd7e94ed9325120286e6b4285374d5a988619888c9cd82768c2dac
SSDEEP 96:KRdqjXNn7vWj4mgfvK4+gBvcldQzLkHm7KmgIIOW4tVgGOK47g0OcOGlk19GKWgG:CdqjXNn7Oj4XfV+gBkldQzLkHm7KmgIY
TLSH
T140919940707B0244397EB6199179885BD6C27477305AA5BB37AC01A20FABE438EFDECD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 769a3eb5e4f91baf54eacfea3aa594d2de7b961d6407012165522c65e4984319
MD5 7905b6971cf61198bbe95dc79cdd5c3c
SHA1 acf6558e10d0cbd5dc41618b784e1aabd29124e8
SHA512 5398f7e446fdc9a685d78a63f9361275c394ac62f781a691c95472931813b62944b8ccd5e47542cfa3f5a783ea346681b06c6b115ca5235e0053866cbf9bde6c
SSDEEP 384:DNrRZyCSDnxTICYMEhIKyll7svbFKfk7:xFZJSDniwyI1l7svbF9
TLSH
T1EC44640A7B747001EDE2D9725CB080771E3CA16E8F22E6815DB654694EB3853A63D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f00f6c0f-3d1d-4213-921a-19dab6da9e92.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f00f6c0f-3d1d-4213-921a-19dab6da9e92.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 ab20a6ca90b8596317b0a0e374107fce2c79484f0b6228fbdf1faf91879348d2
MD5 816e1cd877b8e2908a2225c49ea8e23d
SHA1 d677538b3113ab1ad44732bba5c9ec4c16ed1fde
SHA512 2af4cd772b905213eaf657d22ceadf1e9ea23e917e3adc5a973a679aa37c5bc0dbf32e7260abcad49f8dce51a0e4376dd6bf431d9f9523bfedc8284b661c8b2d
SSDEEP 768:6rv+4UNbds3twDZIO0tNzc4ReyIsXseVH1S5D:6bsbS3/tc44bs8EH1Y
TLSH
T14A03CF32AC789977ECF69686B54B36533EF8911B82D81E94C5EE2F0C464B1DD130B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 90415383e9b7313a775983a7bdb1087a16670944bc70b28fd28c08d055131442
MD5 2caffb6f550a1db891f3e84a85000e71
SHA1 42b380434bf67e6eff6846b861f4a5c9f1c452cf
SHA512 91765ba12a9a639d5a7a4c33fe1b965b420f61657a51a14a4b6daa3ad986cbd0ddb61086a176e6da9ccc24b239c39f681fd8db45f89b3db5a71d7162ed819e35
SSDEEP 768:nrv+4UNbdn3ewvKDZIO00he8Nzc4ReyIsPoeVH1S5F:nbsbF3ewM/tc44bsgEH1W
TLSH
T17313CE32A8789973ECF69A82F44776533FF8611B81D40D94C9EE5F0C4A8B5AD131B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5604-0-0x00000194EF0D0000-0x00000194EF105000-memory.dmp

Download