deae3ebd94f7c0752254ff99864785796baea6310cfe8cf84db7c0efe27f2837

Analysis

max time kernel
150s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 09:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-22_43c51ccc6ead26267c6d76b259172e09_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 12.8MB
Sample260823-k8lfbazwhy
SHA256 deae3ebd94f7c0752254ff99864785796baea6310cfe8cf84db7c0efe27f2837
MD5 43c51ccc6ead26267c6d76b259172e09
SHA1 5a8cc6c30c777656c4fc3112615ca024f88afa02
SHA512 6441885aa3b879027549bd3156117339bb23cb5d4911e242dbaf6be0d45782b31f3d13c757e585ae61fa98e9e829f5083df2c0ebc3912997fcaba40358c20a08
SSDEEP 98304:M0N0OKQEk+HvGxtlNBlsqgdVQyBYoxv8E:9t1EkMv4rG/QyH1
TLSH
T1C1D63957F8A505E5C1AED135C6229613BB703C981B3027D76B90BA382F37BD0AEB9714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

credential_access defense_evasion discovery spyware stealer trojan

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	reg.exe

Looks for VMWare services registry key. 1 TTPs 3 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Vmmouse	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMware	reg.exe

Uses browser remote debugging 2 TTPs 16 IoCs

Can be used to control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
1344	chrome.exe
1332	chrome.exe
4544	chrome.exe
3104	chrome.exe
2552	chrome.exe
1392	msedge.exe
5188	chrome.exe
2028	msedge.exe
3676	msedge.exe
4140	msedge.exe
5548	chrome.exe
1756	chrome.exe
2044	chrome.exe
1924	msedge.exe
5112	chrome.exe
768	chrome.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ipinfo.io
5	ipinfo.io

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c61900000001000000100000002fe1f70bb05d7c92335bc5e05b984da6030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f6314000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-08-22_43c51ccc6ead26267c6d76b259172e09_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c00000001000000040000000010000014000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e81900000001000000100000002fe1f70bb05d7c92335bc5e05b984da66b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-08-22_43c51ccc6ead26267c6d76b259172e09_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4620	chrome.exe
2764	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 4 IoCs

defense_evasion

pid	Process
2164	taskkill.exe
5900	taskkill.exe
4612	taskkill.exe
1248	taskkill.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134319501956217166"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
3672	reg.exe
4816	reg.exe
5924	reg.exe
2496	reg.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	2026-08-22_43c51ccc6ead26267c6d76b259172e09_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5832	2026-08-22_43c51ccc6ead26267c6d76b259172e09_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
5832	2026-08-22_43c51ccc6ead26267c6d76b259172e09_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
5112	chrome.exe
5112	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
5112	chrome.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe

Suspicious use of AdjustPrivilegeToken 32 IoCs

description	pid	Process
Token: SeDebugPrivilege	5900	taskkill.exe
Token: SeShutdownPrivilege	5112	chrome.exe
Token: SeCreatePagefilePrivilege	5112	chrome.exe
Token: SeShutdownPrivilege	5112	chrome.exe
Token: SeCreatePagefilePrivilege	5112	chrome.exe
Token: SeShutdownPrivilege	5112	chrome.exe
Token: SeCreatePagefilePrivilege	5112	chrome.exe
Token: SeShutdownPrivilege	5112	chrome.exe
Token: SeCreatePagefilePrivilege	5112	chrome.exe
Token: SeShutdownPrivilege	5112	chrome.exe
Token: SeCreatePagefilePrivilege	5112	chrome.exe
Token: SeShutdownPrivilege	5112	chrome.exe
Token: SeCreatePagefilePrivilege	5112	chrome.exe
Token: SeShutdownPrivilege	5112	chrome.exe
Token: SeCreatePagefilePrivilege	5112	chrome.exe
Token: SeShutdownPrivilege	5112	chrome.exe
Token: SeCreatePagefilePrivilege	5112	chrome.exe
Token: SeShutdownPrivilege	5112	chrome.exe
Token: SeCreatePagefilePrivilege	5112	chrome.exe
Token: SeShutdownPrivilege	5112	chrome.exe
Token: SeCreatePagefilePrivilege	5112	chrome.exe
Token: SeShutdownPrivilege	5112	chrome.exe
Token: SeCreatePagefilePrivilege	5112	chrome.exe
Token: SeShutdownPrivilege	5112	chrome.exe
Token: SeCreatePagefilePrivilege	5112	chrome.exe
Token: SeShutdownPrivilege	5112	chrome.exe
Token: SeCreatePagefilePrivilege	5112	chrome.exe
Token: SeShutdownPrivilege	5112	chrome.exe
Token: SeCreatePagefilePrivilege	5112	chrome.exe
Token: SeDebugPrivilege	4612	taskkill.exe
Token: SeDebugPrivilege	1248	taskkill.exe
Token: SeDebugPrivilege	2164	taskkill.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5112	chrome.exe
2028	msedge.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 5832	2304	2026-08-22_43c51ccc6ead26267c6d76b259172e09_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	91
PID 5832 wrote to memory of 5924	5832	2026-08-22_43c51ccc6ead26267c6d76b259172e09_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	92
PID 5832 wrote to memory of 2496	5832	2026-08-22_43c51ccc6ead26267c6d76b259172e09_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	94
PID 5832 wrote to memory of 3672	5832	2026-08-22_43c51ccc6ead26267c6d76b259172e09_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	96
PID 5832 wrote to memory of 4816	5832	2026-08-22_43c51ccc6ead26267c6d76b259172e09_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	98
PID 5832 wrote to memory of 5900	5832	2026-08-22_43c51ccc6ead26267c6d76b259172e09_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	100
PID 5832 wrote to memory of 5112	5832	2026-08-22_43c51ccc6ead26267c6d76b259172e09_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	101
PID 5112 wrote to memory of 2024	5112	chrome.exe	102
PID 5112 wrote to memory of 4480	5112	chrome.exe	103
PID 5112 wrote to memory of 4620	5112	chrome.exe	104
PID 5112 wrote to memory of 4480	5112	chrome.exe	103
PID 5112 wrote to memory of 2992	5112	chrome.exe	105
PID 5112 wrote to memory of 2992	5112	chrome.exe	105
PID 5112 wrote to memory of 768	5112	chrome.exe	107
PID 5112 wrote to memory of 768	5112	chrome.exe	107
PID 5112 wrote to memory of 5548	5112	chrome.exe	108
PID 5112 wrote to memory of 5548	5112	chrome.exe	108
PID 5112 wrote to memory of 4324	5112	chrome.exe	109
PID 5112 wrote to memory of 4324	5112	chrome.exe	109
PID 5112 wrote to memory of 1728	5112	chrome.exe	110
PID 5112 wrote to memory of 1756	5112	chrome.exe	112
PID 5112 wrote to memory of 1344	5112	chrome.exe	111
PID 5112 wrote to memory of 1756	5112	chrome.exe	112
PID 5112 wrote to memory of 1344	5112	chrome.exe	111
PID 5112 wrote to memory of 4544	5112	chrome.exe	115
PID 5112 wrote to memory of 4544	5112	chrome.exe	115
PID 5112 wrote to memory of 1332	5112	chrome.exe	116
PID 5112 wrote to memory of 1332	5112	chrome.exe	116
PID 5112 wrote to memory of 3104	5112	chrome.exe	117
PID 5112 wrote to memory of 3104	5112	chrome.exe	117
PID 5112 wrote to memory of 2044	5112	chrome.exe	118
PID 5112 wrote to memory of 2044	5112	chrome.exe	118
PID 5112 wrote to memory of 5188	5112	chrome.exe	119
PID 5112 wrote to memory of 2552	5112	chrome.exe	120
PID 5112 wrote to memory of 2552	5112	chrome.exe	120
PID 5112 wrote to memory of 5188	5112	chrome.exe	119
PID 5832 wrote to memory of 4612	5832	2026-08-22_43c51ccc6ead26267c6d76b259172e09_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	121
PID 5832 wrote to memory of 1248	5832	2026-08-22_43c51ccc6ead26267c6d76b259172e09_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	122
PID 5832 wrote to memory of 2028	5832	2026-08-22_43c51ccc6ead26267c6d76b259172e09_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	123
PID 2028 wrote to memory of 4608	2028	msedge.exe	124
PID 2028 wrote to memory of 1744	2028	msedge.exe	125
PID 2028 wrote to memory of 2764	2028	msedge.exe	126
PID 2028 wrote to memory of 1744	2028	msedge.exe	125
PID 2028 wrote to memory of 1744	2028	msedge.exe	125
PID 2028 wrote to memory of 472	2028	msedge.exe	127
PID 2028 wrote to memory of 472	2028	msedge.exe	127
PID 2028 wrote to memory of 4140	2028	msedge.exe	128
PID 2028 wrote to memory of 1392	2028	msedge.exe	129
PID 2028 wrote to memory of 4140	2028	msedge.exe	128
PID 2028 wrote to memory of 4140	2028	msedge.exe	128
PID 2028 wrote to memory of 1392	2028	msedge.exe	129
PID 2028 wrote to memory of 1392	2028	msedge.exe	129
PID 2028 wrote to memory of 3676	2028	msedge.exe	131
PID 2028 wrote to memory of 1924	2028	msedge.exe	132
PID 2028 wrote to memory of 3676	2028	msedge.exe	131
PID 2028 wrote to memory of 3676	2028	msedge.exe	131
PID 2028 wrote to memory of 1924	2028	msedge.exe	132
PID 2028 wrote to memory of 1924	2028	msedge.exe	132
PID 5832 wrote to memory of 2164	5832	2026-08-22_43c51ccc6ead26267c6d76b259172e09_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	133

C:\Users\Admin\AppData\Local\Temp\2026-08-22_43c51ccc6ead26267c6d76b259172e09_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-22_43c51ccc6ead26267c6d76b259172e09_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_43c51ccc6ead26267c6d76b259172e09_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-22_43c51ccc6ead26267c6d76b259172e09_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  2⤵
  - Modifies trusted root certificate store through registry
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5832
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest
    3⤵
    - Enumerates VirtualBox registry keys
    - Modifies registry key
    PID:5924
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\vmci
    3⤵
    - Looks for VMWare services registry key.
    - Modifies registry key
    PID:2496
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\Vmmouse
    3⤵
    - Looks for VMWare services registry key.
    - Modifies registry key
    PID:3672
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\VMware
    3⤵
    - Looks for VMWare services registry key.
    - Modifies registry key
    PID:4816
- - C:\Windows\system32\taskkill.exe
    taskkill /f /t /im chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5900
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --remote-debugging-port=0 --no-first-run --no-default-browser-check --headless=new --disable-gpu about:blank
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5112
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffe69d5c728,0x7ffe69d5c734,0x7ffe69d5c740
      4⤵
      PID:2024
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1836,i,13866770032584716051,3153032045869269155,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1832 /prefetch:2
      4⤵
      PID:4480
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1836,i,13866770032584716051,3153032045869269155,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1964 /prefetch:11
      4⤵
      System Time Discovery
      PID:4620
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1836,i,13866770032584716051,3153032045869269155,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:13
      4⤵
      PID:2992
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=0 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1836,i,13866770032584716051,3153032045869269155,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3092 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:768
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=0 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1836,i,13866770032584716051,3153032045869269155,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3060 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5548
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1836,i,13866770032584716051,3153032045869269155,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:14
      4⤵
      PID:4324
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1836,i,13866770032584716051,3153032045869269155,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:14
      4⤵
      PID:1728
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=0 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=1836,i,13866770032584716051,3153032045869269155,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1344
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=0 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=1836,i,13866770032584716051,3153032045869269155,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1756
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=0 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=1836,i,13866770032584716051,3153032045869269155,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4544
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=0 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=1836,i,13866770032584716051,3153032045869269155,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1332
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=0 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=1836,i,13866770032584716051,3153032045869269155,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3104
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=0 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=1836,i,13866770032584716051,3153032045869269155,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2044
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=0 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=1836,i,13866770032584716051,3153032045869269155,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5188
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=0 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=1836,i,13866770032584716051,3153032045869269155,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2552
- - C:\Windows\system32\taskkill.exe
    taskkill /f /t /im chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4612
- - C:\Windows\system32\taskkill.exe
    taskkill /f /t /im msedge.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --remote-debugging-port=0 --no-first-run --no-default-browser-check --headless=new --disable-gpu about:blank
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x270,0x7ffe6914c188,0x7ffe6914c194,0x7ffe6914c1a0
      4⤵
      PID:4608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2716,i,6056620978247509996,1009524984742447836,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2712 /prefetch:2
      4⤵
      PID:1744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2716,i,6056620978247509996,1009524984742447836,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:11
      4⤵
      System Time Discovery
      PID:2764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2716,i,6056620978247509996,1009524984742447836,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3192 /prefetch:13
      4⤵
      PID:472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=0 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2716,i,6056620978247509996,1009524984742447836,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=0 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2716,i,6056620978247509996,1009524984742447836,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=0 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2716,i,6056620978247509996,1009524984742447836,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4144 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=0 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2716,i,6056620978247509996,1009524984742447836,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:9
      4⤵
      Uses browser remote debugging
      PID:1924
- - C:\Windows\system32\taskkill.exe
    taskkill /f /t /im msedge.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2164

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2564

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5460

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 8ba83ef6f0070dfa4da7a0af881cba8b335db9bc6cc5a3fc02f552a51a511184
MD5 803cad2bbfd79f79953b03a70193c835
SHA1 68623dc85c91be8b31086275849e56d70f2992ab
SHA512 fc8e1cc6fb13ec27c60f6e92438af8441d49ed87bc9dde596b77e1092ab48e5e406542d179f59671bb8f31b9aede2a3131c74b7bfcc8755962f7fecc4ae95634
SSDEEP 192:5BRWSai7v7QvAPRp2o9XxHsb+WNn35Ply4hRYQfVyIsnAUge:5BRWSfD86XjfwJPsQe
TLSH
T17832B52EBD10693B6DC7D229F9627B93D7F6102121A03E84E7FC9A2C15EB5CC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 85e93e7c7421935f0911b856282522aa7697c7f7f3e4e91fe9b68bdb1dee2254
MD5 17b14bf97159ca9e7782c9d7e031bfcd
SHA1 5412ddbb770ca1e448ec81ffd24d22720b4873e0
SHA512 fa87b1df3588a9d8536d2ca0322b2c03b19cf27561fcd164ff9c5ff208fc0e27dc790a5315f566f02886adf9352dd827c1148a40ca6a9d5dc8c58be7d73dfc76
SSDEEP 192:e294K6vX7KxkXqK4I40pUZNCgVLHrKHfFKslEClTXzKD/cb+ErUkKN9G6jBTK8/T:/9j0X7KxkXqKf/pUZNCgVLH2HfgslNT+
TLSH
T1B332D827A48D9A3F4FD8D519DC036F8B6DF5019272780C24A7FF5D0403A978E115A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 c302adf8b8f0fa47741e47daf4e1891f0212de6f556ec8fc19c96b6a2425c279
MD5 71f2095dfcef7639b7d09a83d1448bce
SHA1 f0822ea6783f57b6554e4016a373ac0d05f426da
SHA512 481cbd44f18923c606391a93f5eab79a095a36654f821638e6810e37048a1f5d9cc5af09abe504a14de3ac75887c3aee23bdbaa979fa8558c5c5e78b7d7b61fa
SSDEEP 96:xC0d+r2io+TJ/E0f6m934zM4RDotok5emDrB6nGyvn0b4T8TybJv4a:xC0ITo+TQ0InDUDVVPPb4T8Tybl
TLSH
T131A10935A0284D774476D446F1626A43CFB9B067E9B2EFA0EAD91F0D14F70EC1352A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 4c58e4b57407f18f55e1f67e5fb7cff65d92f1636564b265f1fd2620b337b093
MD5 c9f68cd3d4781882922572f314d3fd96
SHA1 d4f1dc9237c1e85fd4b70297669b060258b06a8d
SHA512 bf9eeed119110095e9ea460cbfbc9c218376fb800f15bba942fe260e96314387895f033dc7b2a338ba7e76de4b89d9426e747311040235a1c17d83f0edb2514a
SSDEEP 3072:CMO5PoycZ4g6S3l7D31LSMkdhnMCO131x8L2:CMO5PoycD6S3l/31Xksp91xF
TLSH
T1EAD3125074BCDE6E4B1BD568806F240BC857D0468919B97DAFE7AEC960D74E413333A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DevToolsActivePort

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\DevToolsActivePort
Size 60B
SHA256 91802733d674e27128e20df59fd8169bb28fcfd8cba94accd34267907395b90b
MD5 17980886c88905d4baf5cf39421564bb
SHA1 17635d1e9dc388532d2b354258f2e895e21bcc0f
SHA512 8286eee28f7b1bf5d222e4957f565983bba24ee7c9be33ee65afe31b10f00a2120d110e15e29c6a544d99ddf7b6dc65656a72ccd7678d43a53c2314ffcecb65a
TLSH
T12FA00248436985605ABA164C1017D8B9A5532C4611867411D9516551C004516595CEF4
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 f539b73e79d09f879b3a9a364ab955408406475cc7656a42d21f6cbcd871527c
MD5 d5904a0b2ccc28e89dfbd14c26aad9b4
SHA1 4edabca60e6e9efafa4b3b9704b1c79828b37e60
SHA512 1e3d7866c14620b65dff0295e4247af3330172d3af7d6c2a125d01b4c05d33252cc7df8c711afc346cb76b0112c83a52c336e818780bc100431f771870e66e9d
SSDEEP 768:hrv+4UNbdz3jb/TBOWtqONXyer1IRCzniBxeVH1SK7:hbsbV3XiSIqnSEH1l
TLSH
T10503BF32E4A89E334CE2A3D5B14776037FB86057D6840B90DDEE2F4E069B59E130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 b3c7ac701c55790bff0e8e5257a1269e53319ec4b147dff653cb53e7eec254ae
MD5 f2175e17eada89faf8cb4e4b337efaa5
SHA1 bd5df8014b72d0d929b6d3e2327f0691dd019a91
SHA512 844a6bbc171fd6f943ee00231f60964e578d5787a3d5288a7a794a7635cd8695d16dfce2ba9bdcef9c96e09a47f0809b3d298cbd08fa8642f4c32842e035155f
SSDEEP 768:+rv+4UNbdz30K/TBOWt3l0ONXyer1IRCzniwReVH1SK7:+bsbV3xN0SIqntEH1l
TLSH
T19B03AE31E1A99E234CE2A3D6B04BB2437FB86117D6840B909DDE2F4E069B59E130F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download