8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818

Analysis

max time kernel
148s
max time network
48s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 18:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe
Size 583KB
Sample260814-wsjsbsycmd
SHA256 8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818
MD5 aa93ba8b0288c65362442cb7c81aeee7
SHA1 ea15115bbf542e178b3c01f3184f8c4833ee1744
SHA512 17910c9d1c361201b2cd3b445321e00f28d842b4b061fad4bab9c22ce8cda5ef8b0f91227eb24f192fe4418abacb59ec5466126d516d645e080e2797972d592a
SSDEEP 12288:gKEXyvVUsQ5Pu8c1j3a5r9d2m5lVB0OwzbudFa+mJUGuowp8y48Jp0w9:gKEXy9UsgPu8c1jarb2m5Z0Owzc1Y8rJ
TLSH
T1EFD46C4AEAD381F0C983597631BFB22F6B71AE178935CACBDBE51D85E923740510F241
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery persistence spyware stealer

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 3 IoCs

description	pid	Process	procid_target
PID 4384 created 4764	4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe	89
PID 4384 created 4764	4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe	89
PID 4384 created 4800	4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe	104

Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs

description	pid	Process	procid_target
PID 4384 created 1372	4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe	81
PID 4384 created 1372	4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe	81
PID 4384 created 1372	4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe	81

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2156	msedge.exe
5236	chrome.exe

Checks processor information in registry 2 TTPs 15 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134312046974821317"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{55B3C388-72F0-459F-BB3D-22BF7B9D30E6}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe
4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe
4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe
4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe
4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe
4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe
4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe
4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe
4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe
4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe
4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe
4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe
4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe
4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe
4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe
4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe
4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe
4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe
4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe
4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe
4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe
4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe
4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe
4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe
4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe
4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe
4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe
4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe
4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe
4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe
4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe
4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe
4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe
4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe
4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe
4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe
4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe
4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe
4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe
4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe
4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe
4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe
4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe
4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe
4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe
4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe
4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe
4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe
4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe
4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe
4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe
4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe
4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe
4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe
4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe
4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe
4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe
4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe
4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe
4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe
4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe
4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe
4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe
4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe
4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe
4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4800	msedge.exe
5220	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4384 wrote to memory of 4764	4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe	89
PID 4764 wrote to memory of 3764	4764	chrome.exe	90
PID 4764 wrote to memory of 5236	4764	chrome.exe	91
PID 4764 wrote to memory of 4804	4764	chrome.exe	92
PID 4764 wrote to memory of 4804	4764	chrome.exe	92
PID 4764 wrote to memory of 2176	4764	chrome.exe	93
PID 4764 wrote to memory of 2176	4764	chrome.exe	93
PID 4764 wrote to memory of 1760	4764	chrome.exe	95
PID 4764 wrote to memory of 5372	4764	chrome.exe	96
PID 4764 wrote to memory of 1760	4764	chrome.exe	95
PID 4764 wrote to memory of 5372	4764	chrome.exe	96
PID 4764 wrote to memory of 3916	4764	chrome.exe	97
PID 4764 wrote to memory of 3916	4764	chrome.exe	97
PID 4764 wrote to memory of 4988	4764	chrome.exe	98
PID 4764 wrote to memory of 4988	4764	chrome.exe	98
PID 4764 wrote to memory of 5324	4764	chrome.exe	100
PID 4764 wrote to memory of 5336	4764	chrome.exe	101
PID 4764 wrote to memory of 5336	4764	chrome.exe	101
PID 4764 wrote to memory of 5592	4764	chrome.exe	102
PID 4764 wrote to memory of 5592	4764	chrome.exe	102
PID 4384 wrote to memory of 4800	4384	8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe	104
PID 4800 wrote to memory of 4672	4800	msedge.exe	105
PID 4800 wrote to memory of 4308	4800	msedge.exe	107
PID 4800 wrote to memory of 2156	4800	msedge.exe	108
PID 4800 wrote to memory of 4308	4800	msedge.exe	107
PID 4800 wrote to memory of 4308	4800	msedge.exe	107
PID 4800 wrote to memory of 5788	4800	msedge.exe	109
PID 4800 wrote to memory of 5788	4800	msedge.exe	109
PID 4800 wrote to memory of 5452	4800	msedge.exe	110
PID 4800 wrote to memory of 5416	4800	msedge.exe	111
PID 4800 wrote to memory of 5452	4800	msedge.exe	110
PID 4800 wrote to memory of 5452	4800	msedge.exe	110
PID 4800 wrote to memory of 5416	4800	msedge.exe	111
PID 4800 wrote to memory of 5416	4800	msedge.exe	111
PID 4800 wrote to memory of 1028	4800	msedge.exe	112
PID 4800 wrote to memory of 1028	4800	msedge.exe	112
PID 4800 wrote to memory of 1028	4800	msedge.exe	112
PID 4800 wrote to memory of 3380	4800	msedge.exe	113
PID 4800 wrote to memory of 3380	4800	msedge.exe	113
PID 4800 wrote to memory of 3380	4800	msedge.exe	113
PID 4800 wrote to memory of 1612	4800	msedge.exe	114
PID 4800 wrote to memory of 1612	4800	msedge.exe	114
PID 4800 wrote to memory of 972	4800	msedge.exe	115
PID 4800 wrote to memory of 972	4800	msedge.exe	115
PID 4800 wrote to memory of 1360	4800	msedge.exe	116
PID 4800 wrote to memory of 1360	4800	msedge.exe	116
PID 4800 wrote to memory of 964	4800	msedge.exe	119
PID 4800 wrote to memory of 3004	4800	msedge.exe	120
PID 4800 wrote to memory of 3004	4800	msedge.exe	120
PID 4784 wrote to memory of 5220	4784	firefox.exe	122
PID 4784 wrote to memory of 5220	4784	firefox.exe	122
PID 5220 wrote to memory of 3968	5220	firefox.exe	125
PID 5220 wrote to memory of 3968	5220	firefox.exe	125
PID 5220 wrote to memory of 3968	5220	firefox.exe	125
PID 5220 wrote to memory of 3968	5220	firefox.exe	125
PID 5220 wrote to memory of 5016	5220	firefox.exe	126
PID 5220 wrote to memory of 5016	5220	firefox.exe	126
PID 5220 wrote to memory of 5016	5220	firefox.exe	126
PID 5220 wrote to memory of 5016	5220	firefox.exe	126
PID 5220 wrote to memory of 4196	5220	firefox.exe	127
PID 5220 wrote to memory of 4196	5220	firefox.exe	127
PID 5220 wrote to memory of 4196	5220	firefox.exe	127
PID 5220 wrote to memory of 3464	5220	firefox.exe	128
PID 5220 wrote to memory of 3464	5220	firefox.exe	128

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:1372
- C:\Users\Admin\AppData\Local\Temp\8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe
  "C:\Users\Admin\AppData\Local\Temp\8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818.exe"
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4764
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffa9613c728,0x7ffa9613c734,0x7ffa9613c740
    3⤵
    PID:3764
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1512,i,13254311809063768686,152898214720576346,524288 --field-trial-handle=1952,i,17324345392194860882,3646949050679598199,262144 --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5236
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2248,i,5440909572371922406,10917447745103837623,524288 --field-trial-handle=1952,i,17324345392194860882,3646949050679598199,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:13
    3⤵
    PID:4804
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1640,i,18213470439253565017,2038328057696806993,262144 --field-trial-handle=1952,i,17324345392194860882,3646949050679598199,262144 --variations-seed-version --mojo-platform-channel-handle=1944 /prefetch:2
    3⤵
    PID:2176
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3216,i,766579075554501739,17222518782923402103,2097152 --field-trial-handle=1952,i,17324345392194860882,3646949050679598199,262144 --variations-seed-version --mojo-platform-channel-handle=3296 /prefetch:1
    3⤵
    PID:1760
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3212,i,5818687408620297029,7906622364714812311,2097152 --field-trial-handle=1952,i,17324345392194860882,3646949050679598199,262144 --variations-seed-version --mojo-platform-channel-handle=3272 /prefetch:1
    3⤵
    PID:5372
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4576,i,8039919865882225679,16886124826664654885,2097152 --field-trial-handle=1952,i,17324345392194860882,3646949050679598199,262144 --variations-seed-version --mojo-platform-channel-handle=4592 /prefetch:1
    3⤵
    PID:3916
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4748,i,18042443208344800478,4904434235684011431,524288 --field-trial-handle=1952,i,17324345392194860882,3646949050679598199,262144 --variations-seed-version --mojo-platform-channel-handle=4616 /prefetch:14
    3⤵
    PID:4988
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5528,i,1071392796233372593,14516772712345982398,524288 --field-trial-handle=1952,i,17324345392194860882,3646949050679598199,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:14
    3⤵
    PID:5324
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5548,i,6462250835345798404,2590137008393570923,2097152 --field-trial-handle=1952,i,17324345392194860882,3646949050679598199,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:1
    3⤵
    PID:5336
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5624,i,7462456708745033877,18273407705020408225,2097152 --field-trial-handle=1952,i,17324345392194860882,3646949050679598199,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:1
    3⤵
    PID:5592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --no-default-browser-check
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2cc,0x394,0x7ffa917ac188,0x7ffa917ac194,0x7ffa917ac1a0
    3⤵
    PID:4672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1540,i,2669014963470670963,12153491448140748452,262144 --field-trial-handle=2936,i,1554578208092874191,1830489684082632273,262144 --variations-seed-version --mojo-platform-channel-handle=2932 /prefetch:2
    3⤵
    PID:4308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1672,i,13433207934811907338,14761130231398680841,524288 --field-trial-handle=2936,i,1554578208092874191,1830489684082632273,262144 --variations-seed-version --mojo-platform-channel-handle=2968 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2204,i,9515070527965564070,8166847866128970584,524288 --field-trial-handle=2936,i,1554578208092874191,1830489684082632273,262144 --variations-seed-version --mojo-platform-channel-handle=3284 /prefetch:13
    3⤵
    PID:5788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3572,i,17079859369094706751,13897913637189834699,2097152 --field-trial-handle=2936,i,1554578208092874191,1830489684082632273,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
    3⤵
    PID:5452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3576,i,15944174088355402044,8932739829197469874,2097152 --field-trial-handle=2936,i,1554578208092874191,1830489684082632273,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
    3⤵
    PID:5416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,4922910262164237322,10889427437766509767,2097152 --field-trial-handle=2936,i,1554578208092874191,1830489684082632273,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
    3⤵
    PID:1028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,16225032924165935059,5883710475499986347,2097152 --field-trial-handle=2936,i,1554578208092874191,1830489684082632273,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:9
    3⤵
    PID:3380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,7986583267404605008,17352421319927684225,524288 --field-trial-handle=2936,i,1554578208092874191,1830489684082632273,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:14
    3⤵
    PID:1612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,7905272099072832399,3259264740796012986,524288 --field-trial-handle=2936,i,1554578208092874191,1830489684082632273,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:14
    3⤵
    PID:972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,12188036108085286931,8851406107138342323,524288 --field-trial-handle=2936,i,1554578208092874191,1830489684082632273,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:14
    3⤵
    PID:1360
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,10566347813632541694,11151378219649754872,524288 --field-trial-handle=2936,i,1554578208092874191,1830489684082632273,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:14
    3⤵
    PID:4316
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,10566347813632541694,11151378219649754872,524288 --field-trial-handle=2936,i,1554578208092874191,1830489684082632273,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:14
    3⤵
    PID:964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6640,i,7088218036479216911,13569982498804481593,524288 --field-trial-handle=2936,i,1554578208092874191,1830489684082632273,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:14
    3⤵
    PID:3004
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -headless
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4784
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -headless
    3⤵
    - Checks processor information in registry
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5220
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2308 -prefsLen 27097 -prefMapHandle 2312 -prefMapSize 270315 -ipcHandle 2376 -initialChannelId {3841e48e-2637-41dd-9335-204809be64f4} -parentPid 5220 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5220" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 socket
      4⤵
      PID:3968
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3584 -prefsLen 27238 -prefMapHandle 3588 -prefMapSize 270315 -jsInitHandle 3592 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3600 -initialChannelId {21057901-23a4-4e9f-be50-be2b651793dc} -parentPid 5220 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5220" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 tab
      4⤵
      Checks processor information in registry
      PID:5016
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3768 -prefsLen 27238 -prefMapHandle 3772 -prefMapSize 270315 -ipcHandle 3816 -initialChannelId {d08f5d63-7376-45d1-9d8f-d973b05c111c} -parentPid 5220 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5220" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 rdd
      4⤵
      PID:4196
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4404 -prefsLen 34737 -prefMapHandle 4408 -prefMapSize 270315 -jsInitHandle 4412 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4420 -initialChannelId {20f72745-449f-4fd2-a365-c81e2a149725} -parentPid 5220 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5220" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 tab
      4⤵
      Checks processor information in registry
      PID:3464
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4984 -prefsLen 34974 -prefMapHandle 5028 -prefMapSize 270315 -ipcHandle 5016 -initialChannelId {6a0aa188-0974-4bb6-914a-37d5a11cf67f} -parentPid 5220 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5220" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 utility
      4⤵
      Checks processor information in registry
      PID:4980
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5244 -prefsLen 32916 -prefMapHandle 5248 -prefMapSize 270315 -jsInitHandle 5252 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5260 -initialChannelId {6f6c8d8c-645a-4324-8e4e-9f7ea2f69abf} -parentPid 5220 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5220" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
      4⤵
      Checks processor information in registry
      PID:2944
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5272 -prefsLen 32916 -prefMapHandle 5276 -prefMapSize 270315 -jsInitHandle 5280 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5288 -initialChannelId {36fe5f86-1dbd-4963-a13f-75eae37d3c40} -parentPid 5220 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5220" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      PID:5216
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4868 -prefsLen 32916 -prefMapHandle 4800 -prefMapSize 270315 -jsInitHandle 1616 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5592 -initialChannelId {4bbb1491-32d0-4ee7-814b-cc3815e7bfe5} -parentPid 5220 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5220" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      PID:4452

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2428

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 9cb8a9066fed07f727ee4bc9143beca7c6d9131998d8459ad4b2df0ffcf2fc3b
MD5 f01e7683904f46f5793d9160e2c23690
SHA1 b107550c57bfdb63b8cdfca3db10c243b6b067c0
SHA512 623f97fd4123fc61f4eb6b4a9850c6b42d8c459f8be20c79bdedd2feb01556bce404b88ab652bb93e2b110ce011aba6a13d066f62d55bd8d456bcef53567fdd6
SSDEEP 192:tB+XuvBnl3JsueMEGvIW1/rcP2OOpX6CVquVumUGBwkRSS:jeuvBnhJsueMEGvIW1DcP2OG7VumLnUS
TLSH
T192D3864B3A743102EDE59A722CE050BB5D3CB16D4F55A5D428B620688EF2863B23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 b1793148c1efbeb52fb7549807468fe8900a2d3d409041bdcfd2aef975f1f819
MD5 ab109d085fb616f08487d11294e9cba8
SHA1 564e153d14c76bcf32c10476395de4df1b723f58
SHA512 1f1be6634be0277d4696b86839ad0c114a9e9d9104d2d19694e60f70083c9903d2a621ce724d84b05f9ca7ed7bbff4ce7a67c3dc368d04b93d09117f9ae753f3
SSDEEP 96:gC0d+cAOIt5aDVmufj7jcbRDotok5XCDRjB6/dGyv95SFhbb2Jv4a:gC0LA/TE57cDUDUR9UweSFhbKl
TLSH
T120A10871B8A95EB75C75D584F9827E83DF68A117A9227F80D8ED1F0C11E70EC1382A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8ee8ad58-4f1c-459c-bc95-4ac98d1cfc38\index-dir\the-real-index
Size 672B
SHA256 6845ee8397fd0c3dbad1904f60478dc1a82606d47ba99e81e2373fda707cdf90
MD5 f88be487aa387b377580f5554b2d068d
SHA1 fdfefec16e579996a4dbcea57002a09ab361e9fe
SHA512 eff2d469d79b9ef486738ed27b28320269b66c094c7dbd76716d1ccca7b2c7f7fe35f1b4c854c5d8a3ccafdc1b82a4a5d9302b1286cf9a6f9e39f5563bf88e48
TLSH
T18E015487CCD29847CCA3B97F2A3D314E3B3C04FE21058DD7006DA0398D627398241315
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59b339.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8ee8ad58-4f1c-459c-bc95-4ac98d1cfc38\index-dir\the-real-index~RFe59b339.TMP
Size 672B
SHA256 63c3dd9fe9075277b339c639af8c6594eb87513abf725de2d8bf0207ac34b084
MD5 f3067c63813f3566794031633f299bfa
SHA1 b631baf1a9f5fd13f811aff8862a7bf91eca5fb2
SHA512 f6c413c84ba5df429c07d0fab29178f2024bc4fffff689a0701264e9e8f8edab122fd8a71ecaae0d1d565b5c3b7ef2f0d94316430ef0f7ba9694fadecb7bcfc5
TLSH
T1E001D4D70091EC42DD56A5B531196116723F08343165DA8B61DA747E45717344281652
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 1f558a8faf1734a07a2c74052b67299f03845e9df6198e89f8f986b29ae4fe5f
MD5 39d9f06f3edb85417e1fe401d378f809
SHA1 e6b32e77d1eac1c3281a7b562d69fd92a70a768c
SHA512 00a01a4e90e4fe9b8e8f9d981decb262bb3ba028704a7ac94157e40bfef6b9dc13d2ca1e9e4edcd1fb2f93535533a249a876fe177ad8ce9cb058f413be85c826
SSDEEP 96:KRklQUuSW0Wyf/gc0K4xgW0cUUfO0pH7kh1DZpVW9yogdVK4kgzVcbDfurUg2QUc:CklQUuSWLyfocIxgWbUUfO0pH7kh1DZv
TLSH
T18F917851357B12443DBEE50C81A98A1E468278B73128663F37E881F62F67E029DFC4CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 459d86447c67041b54d7e67e0549a9a7104bfdc51d42fa3b6afb4776029ba022
MD5 ea9d94ff7e56b2d4991b2c952cb7337a
SHA1 1ffd8bb3da1d7c99719085bce1790bffb6b8a41e
SHA512 21409ae9edae021e170d43e2b2de94dc8ce04bd787014dfbb51d351de928e06281c96b27a95a5869597a131a2b2290aee5bb9be1c9526f39b231f70f253651bb
SSDEEP 384:DNrRZyCSDnxTIC0nMEhIKyll7svbFKfk7:xFZJSDnirMyI1l7svbF9
TLSH
T1C244840A7B747001EDE6D9725CB080771E3C716E8F22A6916DA254694DB3853A33D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 07989ee026b8fe0bfea0c56abc4d2839186d4420e9e3295af0d75e2f7c4a8a0b
MD5 01eb4f5ffe20cbf1d56da254f4aef9d7
SHA1 9579ba456d65bef72f9563694d5b23cab984c7c3
SHA512 89d6fd5f2582d801b59ae6a280bac1981602b8b0615e1fc36fca865fb01afc73c45222237bfbf7d3061eb520804ac5859a6b890fb1583301e017a830a4aad605
SSDEEP 768:6rv+4UNbds3vODZIO0ZQRONzc4ReyIsXoeVH1S5D:6bsbS3eOtc44bsYEH1Y
TLSH
T19603DF32A8788A77ECF6A686B14776537EF8512BC2D81E94C8DE1F0C464B5DD130B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 1f6a7a0e15d2b18532f794f7c3540445398dba3bfccdcd77c2ebf97eb6e644af
MD5 78a62083db7bfa23f4e208f0fb51bd41
SHA1 944152f8e8e58b90f3bf675ed4bce92dfc60fbc9
SHA512 4b595d48f82fc87dd98736dde4d19f11befc25cc6e63f605aec285bf416d78f2b06e7fc3e8aba612c8b9fae6072b1cb176dc9b62a5828733afa6608ea273ddd5
SSDEEP 768:frv+4UNbds39rDZIO0ZQRIWsMNzc4ReyIs2BeVH1S5D:fbsbS33IWsMtc44bsiEH1Y
TLSH
T18803CF32A869DD73ACFAA641F14776937FF8216B81880EA4C9DA4F0C4A471DD175F823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 043b328173c3b0fa530a6df1e863d055dfd7a7a040abb4dc73b0e6457aaf2c86
MD5 1ea72c7c0e072dbc4048dffed699ca43
SHA1 2fa06b4e7fb2f90e90526bd45109af0646b5f7c8
SHA512 44559a13a03b0e61514339c7c8febbeb921887c0dbc45a0e081f0f794eab7f78a14de9f585497c6648898261748c0367ac556ff5e389af6ff5170b39b8878704
SSDEEP 96:cEe/pSdF95/7bkW6ArWC9yUR6HfWZtFRF2FAFOFpFR/dd66JoztdzgClKtmBM2/L:3SOv5zbo8WC9yjH+vM1d66JoztdzgClh
TLSH
T18BC1AA24E729863FC849423BCCB51B400F76388BD88E7F1536EC64492D562DE7A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 0451052a7005c29555da79c5a72b73ff14d1dd7dd9773bd6bf6f5d8ddace38f3
MD5 86021477a0ef914483062a2fecb171bd
SHA1 8dc9e4f929fa06c6e99bb55e7f729c85ecd46c11
SHA512 d789850190d2492bc92cc1153579c55f9ea2283b2fb456e97c4eac0e98385c9d5a2aa896723ae04a820eb5b9353970d582c51ad1e9cc1dc2090d4d6574be765f
SSDEEP 192:KM1d66JoztdzgCl6mBM2NSOv5zboisC9yjHsCw:Zd66Joz/zgC1OaRboisC9yjHc
TLSH
T16AE1FD64EA28863FC849527BCDA51F404F39388BD88E7F1935AC640C2D572DE768E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 c86987adae80c27d530ae295bd779e6ecfdad1748c1a9e838ddf4e80fe10c8f4
MD5 baf6c263a97c456db0f83106b70959f6
SHA1 2e051f980cd88170fb8e6670734a6a9a2d49ec76
SHA512 b803cf1d5f46d7ac6ce5ae4beb98822fa98fd6efcb012cbba416f7415f14db37789c4eabf9c693b10a95f241141b9adec7d2e64cc22464ec1b298f127374af5e
SSDEEP 96:6SdF95/7bkW6ArlyUR6rWZ6FRAQFQFOFpFR/dd66JoztdzgClKtmBM2/U:6Ov5zbo8lyjC0X1d66JoztdzgCl6mBM2
TLSH
T125B1BC28F629463FC859423ACCA11B000E76344B985E7F1636EC745D2D572DE7A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\events\events
Size 1KB
SHA256 0cd3e713f392a8e74fdd92cac8beae891db35f6bd7d2c0c5600df33e5d34dc09
MD5 842183e1b3962fd8f9cc67e13aea2c9a
SHA1 cd7efccb44ab3ac812b995effdaec1cf62a0a3c9
SHA512 48de20cd44b10ae978c98b483fe6d67704bd0532d10d0aa27af9247ae1d2737bd3a9caf03715f674cbf8e67c0bafff00deeb41e678090e4809a422aaf8f1d01f
TLSH
T15711AA5C3AF94D7AE8C7E29C7491038F63118A4A444B1C438F02EE8DCE91AD9332A46D
MD5 SHA1 SHA512 TLSH

Submit Download

0213f4a1-df84-464f-9a7f-0fe28f945219

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\0213f4a1-df84-464f-9a7f-0fe28f945219
Size 235B
SHA256 3bfa226b0ebf03f27aa6d9361cb946e06b181d5921dbbe36cbcb1ff0f369b187
MD5 c06f206bb2ec1cae428f275c3129f0d6
SHA1 05671080b4e0ebcd497c79e6c7de726804eb2016
SHA512 8376eb7a8534e862f9f5258c52855038ed73fa267e2d69cc41c56b398b4f87dec57e83b5b3683702380c5835e9241696f0ac2a4e7d3415ba3e0a7cd6f1d2f225
TLSH
T117D0978828E8B39D0C140F02B0E069C230598C3320789C109A6049B48BBADC86262D1B
MD5 SHA1 SHA512 TLSH

Submit Download

55361174-0154-4243-bc55-40fa9b536b44

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\55361174-0154-4243-bc55-40fa9b536b44
Size 883B
SHA256 b57d001b9e8a5459d040012b7105be238d74b8408a0c008b204306d3a4895e3d
MD5 c377679cec7fc9cbd9f83dceb4969081
SHA1 df44a937520d491877841065e1551368c165ece1
SHA512 cf560bee5454e4f20f1d67e9b6b41e5aedec9eb5181f2ebf50bc6691ae8eb0d9dd0f2cbafa64ef2f87e1b04c2ee22488c479668b44baaa37178bba59e5f94f4a
TLSH
T11A110041A734B9B2CC78D20BC9983B429BE87413C0C654143EA05A080E7E61FE7AF60B
MD5 SHA1 SHA512 TLSH

Submit Download

a3e70875-c0a4-44d8-9520-2234a007b179

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\a3e70875-c0a4-44d8-9520-2234a007b179
Size 2KB
SHA256 439c01cd2147eeff7ab6a5b8ff634cdacd4f6378d959e5203cb8a94ad3edbca0
MD5 18e2f9e94ee5fc3789c31e83f314d9c8
SHA1 befb5de98fa0b3fb888beeb5abb64377cafa7aa2
SHA512 f4865d77d3907a340895bedac8041b1c88c83b774983598d682274ad15214e4429f9eb16d0415f73b7063584baf6226860f89412fde00ce899eab4f026a43306
TLSH
T18641345D36788D7A9CD6F25C9451338E93E0990304D62C432E91EF0C8EA22DE336E52F
MD5 SHA1 SHA512 TLSH

Submit Download

bb34f0b0-e5f2-4341-a15a-3b565d5f249d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\bb34f0b0-e5f2-4341-a15a-3b565d5f249d
Size 886B
SHA256 c7d7177aa8b33cc16fb27947ff9e8f7c92a67d38bc200a022111e229255d9fe5
MD5 2913b12eb1c8187e1b3538cb06e94f1d
SHA1 42faa7fcdf66f846586251e12d44889187e830f0
SHA512 054ad1e3766bcaa1d7ff19e648c76ad2a4499e832d98e48879875516eb168a2f26aa955dd278d360419851892af8d07fa2a0705c245cbec2ee94a8c00275f305
TLSH
T1511144418B38B5B2CCA8E25B99E03B4247D83013C0C608043E505A080C7B15FA76F70B
MD5 SHA1 SHA512 TLSH

Submit Download

e014a854-bda4-47a6-9b8c-d9841d60cfb2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\e014a854-bda4-47a6-9b8c-d9841d60cfb2
Size 16KB
SHA256 013d8ec14eb73ea6669a54e1dd48f5e40af19d0b0a3265f1e98d4d885117db1a
MD5 01e120c46a39711f0ef89bda0d5b66d8
SHA1 200b39d105dc67f8e8c150bc365305bbd6eb15f7
SHA512 a8f53763c674fa5c5605fc57914a98ad4727712525a6a30348146af0418ecca607fcafb3b1fae850cdcd735d318368a86a9de38fa2dd370e75ee46101df8a529
SSDEEP 192:6zhPNf9XogPHBAdPurLvHEmdeK7UVqD00lhBnmWo134SEmtbJEzsz3cS7ewOQhVr:zqDdh5FSHtbEsjcS7iQh1uZDu
TLSH
T12772EA56682045BB8591E368C4F87FC3E6F628CF4C419FCA9BE4BD086DDE0AD112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f2a48310-2d53-492d-aaff-a6d35b8f28ae

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\f2a48310-2d53-492d-aaff-a6d35b8f28ae
Size 235B
SHA256 be81cdb8e05019156d8956dffdd2151fa18fea7a2606d64b94aa6882c444ba8f
MD5 1429cb932404cd256d9fc5aa4737d9ca
SHA1 907c5b4d32589907293c00e223d2132750d8575e
SHA512 b46f09aa8e1582c27acc67322cc6299551f7317dae9499facf97a187c80a444ee09f6812d50f39f16abb82d8b7f22becd5fb5a51a43071539cd338a80bdcb194
TLSH
T17BD0238014F8B71D88280F07F0F0F8C672C64C3718796C60DA50007A9DFCDC51111C07
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\prefs.js
Size 6KB
SHA256 e9ea1d4e3e333b26d2d0cd04ee2c80bce81a6ebccc2c71fbee467879e0527436
MD5 dca4eb7a2d2d868727488ae1f6e62447
SHA1 78187bf6589c2b6cde5eb0933a103337295807d3
SHA512 187ea7d4836b6e2376281f9f11b47a4ca6d57c8b8f14a933f0178c66427717e04efbdf4fe72ffce3acf9450946b9aae4f6344666e2fda48ab7b53174b07c39f1
SSDEEP 96:xHTGUTUEqGqSvfklN1zSGSSlvdv9jqnNHKm9fBw88u8L4cn5VPB:oHRYfklNnSSa35Bw88vT
TLSH
T1D1E120789508CB7F74B677ACAC688C316AB2413B7BBF68C654B94485011CF3442F9AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download