0605015c8428fb4efc98e0abd8af027c7a01f2e87471dbc7e4389a3c6e5844c4

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 20:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 991KB
Sample260728-zfk2eahk71
SHA256 0605015c8428fb4efc98e0abd8af027c7a01f2e87471dbc7e4389a3c6e5844c4
MD5 dc23b8b8afcffbf1798d09ebf443af85
SHA1 a7793c7102527152dc5972d13adb21969fe49e7a
SHA512 bc13975ca41219231a5a35b94ad04ce79b4c25c82e96e9e38973066b3b9a3b2926e0790cff616b71d07d09fded7856536ca47e8c74ae1e82877fd3cb02af6fb6
SSDEEP 12288:/4yljr5bCTpu7BIopiE1uLwpQk4ls9dJW76G3L6m442wOyITRMc08SdhccB:DASBnsE1e2QZuyT3L6mt5ONTRb08Yh
TLSH
T1E925BE53B291A27DD15BC0B4835AC9B6B536B0C90631BDBF21E4D7343E9AE920F1CB19
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1432	chrome.exe
5036	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	file.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{9A30F871-8A9C-44AB-97F0-0E5F32851BBC}	msedge.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
5668	file.exe
5668	file.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
5668	file.exe
5668	file.exe
5668	file.exe
5668	file.exe
5668	file.exe
5668	file.exe
5668	file.exe
5668	file.exe
5668	file.exe
5668	file.exe
5668	file.exe
5668	file.exe
5668	file.exe
5668	file.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5672	chrome.exe
Token: SeCreatePagefilePrivilege	5672	chrome.exe
Token: SeShutdownPrivilege	5672	chrome.exe
Token: SeCreatePagefilePrivilege	5672	chrome.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5672	chrome.exe
4560	msedge.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 5668 wrote to memory of 5672	5668	file.exe	89
PID 5672 wrote to memory of 5092	5672	chrome.exe	90
PID 5672 wrote to memory of 1476	5672	chrome.exe	91
PID 5672 wrote to memory of 1476	5672	chrome.exe	91
PID 5672 wrote to memory of 1432	5672	chrome.exe	92
PID 5672 wrote to memory of 4164	5672	chrome.exe	93
PID 5672 wrote to memory of 4164	5672	chrome.exe	93
PID 5672 wrote to memory of 5704	5672	chrome.exe	95
PID 5672 wrote to memory of 4244	5672	chrome.exe	96
PID 5672 wrote to memory of 5704	5672	chrome.exe	95
PID 5672 wrote to memory of 4244	5672	chrome.exe	96
PID 5672 wrote to memory of 1704	5672	chrome.exe	97
PID 5672 wrote to memory of 1704	5672	chrome.exe	97
PID 5672 wrote to memory of 1728	5672	chrome.exe	98
PID 5672 wrote to memory of 1728	5672	chrome.exe	98
PID 5668 wrote to memory of 5672	5668	file.exe	89
PID 5668 wrote to memory of 4560	5668	file.exe	101
PID 4560 wrote to memory of 1132	4560	msedge.exe	102
PID 4560 wrote to memory of 5036	4560	msedge.exe	103
PID 4560 wrote to memory of 2184	4560	msedge.exe	104
PID 4560 wrote to memory of 2612	4560	msedge.exe	105
PID 4560 wrote to memory of 2184	4560	msedge.exe	104
PID 4560 wrote to memory of 2184	4560	msedge.exe	104
PID 4560 wrote to memory of 2612	4560	msedge.exe	105
PID 4560 wrote to memory of 3896	4560	msedge.exe	106
PID 4560 wrote to memory of 3896	4560	msedge.exe	106
PID 4560 wrote to memory of 3896	4560	msedge.exe	106
PID 4560 wrote to memory of 4980	4560	msedge.exe	107
PID 4560 wrote to memory of 4980	4560	msedge.exe	107
PID 4560 wrote to memory of 4980	4560	msedge.exe	107
PID 4560 wrote to memory of 6008	4560	msedge.exe	109
PID 4560 wrote to memory of 4200	4560	msedge.exe	110
PID 4560 wrote to memory of 6008	4560	msedge.exe	109
PID 4560 wrote to memory of 6008	4560	msedge.exe	109
PID 4560 wrote to memory of 4200	4560	msedge.exe	110
PID 4560 wrote to memory of 4200	4560	msedge.exe	110
PID 4560 wrote to memory of 4996	4560	msedge.exe	111
PID 4560 wrote to memory of 4996	4560	msedge.exe	111
PID 5668 wrote to memory of 4560	5668	file.exe	101
PID 4560 wrote to memory of 5740	4560	msedge.exe	113
PID 4560 wrote to memory of 5740	4560	msedge.exe	113
PID 4560 wrote to memory of 3124	4560	msedge.exe	114
PID 4560 wrote to memory of 3124	4560	msedge.exe	114
PID 4560 wrote to memory of 5032	4560	msedge.exe	116

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check --disable-session-crashed-bubble --window-position=-32000,-32000 --window-size=800,600
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5672
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffb77dbc728,0x7ffb77dbc734,0x7ffb77dbc740
    3⤵
    PID:5092
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1632,i,5951891218476103089,784292937891244554,262144 --field-trial-handle=1932,i,2069509648262925937,18334412355789078542,262144 --variations-seed-version --mojo-platform-channel-handle=1928 /prefetch:2
    3⤵
    PID:1476
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2180,i,15734953854789525528,3115451224315404889,524288 --field-trial-handle=1932,i,2069509648262925937,18334412355789078542,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1432
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2344,i,17199048313875575981,5825317965484742582,524288 --field-trial-handle=1932,i,2069509648262925937,18334412355789078542,262144 --variations-seed-version --mojo-platform-channel-handle=2848 /prefetch:13
    3⤵
    PID:4164
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3212,i,10627286871545898041,6840131312963507522,2097152 --field-trial-handle=1932,i,2069509648262925937,18334412355789078542,262144 --variations-seed-version --mojo-platform-channel-handle=3256 /prefetch:1
    3⤵
    PID:5704
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3216,i,12199582528652653152,5130193372644915655,2097152 --field-trial-handle=1932,i,2069509648262925937,18334412355789078542,262144 --variations-seed-version --mojo-platform-channel-handle=3260 /prefetch:1
    3⤵
    PID:4244
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4672,i,11099589972652365136,9235434988629045651,2097152 --field-trial-handle=1932,i,2069509648262925937,18334412355789078542,262144 --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:1
    3⤵
    PID:1704
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4696,i,5954446493295962241,4126280031873690707,524288 --field-trial-handle=1932,i,2069509648262925937,18334412355789078542,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:14
    3⤵
    PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --no-default-browser-check --disable-session-crashed-bubble --window-position=-32000,-32000 --window-size=800,600
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x328,0x7ffb7404c188,0x7ffb7404c194,0x7ffb7404c1a0
    3⤵
    PID:1132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,17525323214402812764,14425329791212501505,524288 --field-trial-handle=2572,i,14021522675392258870,2389615418115713469,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,5450585067265391299,11005614801792941281,262144 --field-trial-handle=2572,i,14021522675392258870,2389615418115713469,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:2
    3⤵
    PID:2184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2272,i,14580712513075569194,12099119672468571242,524288 --field-trial-handle=2572,i,14021522675392258870,2389615418115713469,262144 --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:13
    3⤵
    PID:2612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3528,i,3253102837348273096,16613557065193897631,2097152 --field-trial-handle=2572,i,14021522675392258870,2389615418115713469,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
    3⤵
    PID:3896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3532,i,9198241565379957709,18277575330667188937,2097152 --field-trial-handle=2572,i,14021522675392258870,2389615418115713469,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
    3⤵
    PID:4980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4308,i,13007606254260903190,5967588185716481399,2097152 --field-trial-handle=2572,i,14021522675392258870,2389615418115713469,262144 --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:1
    3⤵
    PID:6008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4412,i,2131987337700430704,18306631052113204827,2097152 --field-trial-handle=2572,i,14021522675392258870,2389615418115713469,262144 --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:9
    3⤵
    PID:4200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,2884108359186878344,283582434268582168,524288 --field-trial-handle=2572,i,14021522675392258870,2389615418115713469,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
    3⤵
    PID:4996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,17439479400878997979,8653525742913442985,524288 --field-trial-handle=2572,i,14021522675392258870,2389615418115713469,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
    3⤵
    PID:5740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,12357948534823785643,2953976431122127537,524288 --field-trial-handle=2572,i,14021522675392258870,2389615418115713469,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:14
    3⤵
    PID:3124
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,2191105678860349138,15542920156353073554,524288 --field-trial-handle=2572,i,14021522675392258870,2389615418115713469,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
    3⤵
    PID:3236
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,2191105678860349138,15542920156353073554,524288 --field-trial-handle=2572,i,14021522675392258870,2389615418115713469,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
    3⤵
    PID:5032

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5872

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4480

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5604

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2376

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 a0efe84766babb6fa2e3c705b57d5e12aa8bfdd080f18939d3cf75d1e124b6e0
MD5 bf02cd16ebdd85908453277e2250ded7
SHA1 1bad972a62d5036982b548167cd12b4eed2ca180
SHA512 e0e7f2d1c1b1cefe60714c4a998a843961098732bce98d369b802850b8222c5c700c34ea27a6f2fcd4884d6adf66ac90bd857ca7fcae7f6f6dc4df19c99712a9
TLSH
T1F6218CF7C7D8997D894146F8A7256F1BCE290914531C3D66C8E8AE1F57E1871E20054F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 356B
SHA256 a00adfdf5d5d629b505048679b7b94826b53697103289f244ca5a44396c2e1e4
MD5 f481da7b6682e152af8b8fa2657e634e
SHA1 a62b59d9df42651365f7e5bd3c61dfe7c5a700a8
SHA512 7d6c62d556f0640b65a9c8f807e657a4182353626d0b8f192bd8289c0b3468812047be398ba84e974ac8031f4b92be4c5cf9b54b0eaf03fd17d0fe62e49e43e2
TLSH
T101E0C063897870738478D07F5F04B400B7B4E43001422CE0CF9A826CF086CE30F02513
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 52db2026e6c75d5f1773799f9a90dac975eb6cc3b37d002ed103cfb0f276bcb6
MD5 69a1a4f9dda37a71e627e3c1aa9d3613
SHA1 f394fe2a97e38a07c0fd909de7381809b025eaf5
SHA512 88989b6917ccd8216b25b46d4362488ea646d956375df4988ac77b0c6b04fae5485869fbfe9a88462493d510b22f8324ca31d757540476faf85fd64e1f519aac
SSDEEP 96:5KC0d+oJm4V0FH+pqf+HBKyoytsRDotok5SHDGB6eGyvkonNob1v4a:MC0HJm5FHuPgXDUDQWW8nNobZ
TLSH
T10AA12BF1647D4CB759B7D645F9832A83DEA4A22769A0EF80D9DD1F0C01F31D81342927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d849b163-9d4f-47f8-b6cf-f901db5367e3\index-dir\the-real-index
Size 288B
SHA256 132ce01421694e14e4100e52ccc1979b6523dca025f54b6dd31568dc7fe5f81b
MD5 7edc7d699c42c34b937ecaeef7547c77
SHA1 6cf7e7535068132749dadfc2d5e09a1252f2e4cc
SHA512 fcbff94b03389c35aa9304d1a3605a75516d436d600684724da2ecd0b405c8b3f7beb3e0382cd31e5928dd49a9d23ab8902f3d7e99a89dad173ed7c7df3136f6
TLSH
T1ADD0A7CE8C629947C719647505B72419333706FD2112AD6600FD183E5556A6D9546506
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59457b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d849b163-9d4f-47f8-b6cf-f901db5367e3\index-dir\the-real-index~RFe59457b.TMP
Size 288B
SHA256 056e90de5d579b292383371135407837d99f5206c04c5f9c1000fc8f504984d1
MD5 07deb3cd448e654accf30410c80583bc
SHA1 41710a25bad464dd2f94df599e4e27cd8f369a45
SHA512 ee1c9fa78f1932c8052ec1a978c2e7e975e5aafa32289ab517317b04c389c9b326321dadf8b35d4462101fe82e977ca02217ae3df5e1428dbd3be88c5764e416
TLSH
T1C8D023CB45516D67F61755792443651533370C342415EE2111FE183F4D7179C9981106
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 769a3eb5e4f91baf54eacfea3aa594d2de7b961d6407012165522c65e4984319
MD5 7905b6971cf61198bbe95dc79cdd5c3c
SHA1 acf6558e10d0cbd5dc41618b784e1aabd29124e8
SHA512 5398f7e446fdc9a685d78a63f9361275c394ac62f781a691c95472931813b62944b8ccd5e47542cfa3f5a783ea346681b06c6b115ca5235e0053866cbf9bde6c
SSDEEP 384:DNrRZyCSDnxTICYMEhIKyll7svbFKfk7:xFZJSDniwyI1l7svbF9
TLSH
T1EC44640A7B747001EDE2D9725CB080771E3CA16E8F22E6815DB654694EB3853A63D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 47a49b07378f9e72eaea012b487377782fe2937c91fc206cacf8fd67974a747a
MD5 808559dafa6c283ec80df727fb39770f
SHA1 dbd352544837d05d4a43eac11012e269c15ad484
SHA512 3dbe07c87b147ea39ae6d67cc3540df11ec960f3c0e334236922adbf7e3318e49b341ad9658dc7520974301c0eb33408014bfa2ea72d6547a6fd1c3eba1ac96a
SSDEEP 768:grv+4UNbd735yf+Xap8+p3bd66j+4BRv86aLIW1ol:gbsbd3zE8+p3Z6n4y7O
TLSH
T18803AE72E8AC9D739CF6CA44B15677437FB8246395C00EA4E8D96B4E019B19E270BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 9cbe3bb6b2047cfaa93e846cccf0b13daab6730b46a1d74ad0162627d53c7bee
MD5 c631c86ca4ce67fc9cd0751e5769ef93
SHA1 60ae50067b2bcb29671f5a07e6bac410bf26c05d
SHA512 055a657bc8698e0dbe0bb4c3855a3783e06112029762848f77e1430f0f7e170655715b6eac0523bfd8ea95af02c5e07e8a584627cf2bb320dc752e7b8d21ae4e
SSDEEP 768:Irv+4UNbdD3qcfKNp8+p3bd66j+4BRv86aLIim2bwCl1:Ibsbp30L8+p3Z6n4y80ww
TLSH
T1EB03BF33E8A899739CF6C648B24677437FF851A396C10ED4E4DD2B4E415A19E630BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5668-33-0x0000000000B90000-0x0000000000C93000-memory.dmp

Download

memory/5668-1-0x0000000140000000-0x0000000140035000-memory.dmp

Download

memory/5668-0-0x0000000000B90000-0x0000000000C93000-memory.dmp

Download