91a67896f3d58d3b3ec5d12a0f45a4678b6983b5033cc0905ad71776f5fd463b

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/09/2026, 18:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 4.4MB
Sample260906-w4dqfseq4s
SHA256 91a67896f3d58d3b3ec5d12a0f45a4678b6983b5033cc0905ad71776f5fd463b
MD5 ea967c2f0238a326f3d3f786448cca6c
SHA1 35492b09032244440381294d63e34d51475e1bac
SHA512 612f815d517319232259c56b01a6aab5c08c774d411a3c975c9be135c16facba0c8fd1996f866d6b8c0a459962f5cc3e0a0046ef1987723b20ef22e0251f02ed
SSDEEP 49152:uSWYEcmiKM/B5dsq20J7PeVfjLVzDJIHBvtsvBp6mSM8ZZo:uS95m5vcSTkmmo
TLSH
T134265C03749894E9C0199638C57B52A3AA64BC8C573633E31E90BB383F6EBD07DB5716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery spyware stealer

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 4 IoCs

description	pid	Process	procid_target
PID 3212 created 1336	3212	file.exe	87
PID 3212 created 1336	3212	file.exe	87
PID 3212 created 1708	3212	file.exe	98
PID 3212 created 1708	3212	file.exe	98

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3212	file.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4128	chrome.exe
2864	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	file.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
3212	file.exe
3212	file.exe
3212	file.exe
3212	file.exe
3212	file.exe
3212	file.exe
3212	file.exe
3212	file.exe
3212	file.exe
3212	file.exe
3212	file.exe
3212	file.exe
3212	file.exe
3212	file.exe
1336	chrome.exe
1336	chrome.exe
3212	file.exe
3212	file.exe
3212	file.exe
3212	file.exe
3212	file.exe
3212	file.exe
3212	file.exe
3212	file.exe
3212	file.exe
3212	file.exe
3212	file.exe
3212	file.exe
3212	file.exe
3212	file.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	3212	file.exe
Token: SeShutdownPrivilege	1336	chrome.exe
Token: SeCreatePagefilePrivilege	1336	chrome.exe
Token: SeShutdownPrivilege	1336	chrome.exe
Token: SeCreatePagefilePrivilege	1336	chrome.exe
Token: SeShutdownPrivilege	1336	chrome.exe
Token: SeCreatePagefilePrivilege	1336	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1708	msedge.exe
1708	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 3212 wrote to memory of 1336	3212	file.exe	87
PID 1336 wrote to memory of 1536	1336	chrome.exe	88
PID 1336 wrote to memory of 4128	1336	chrome.exe	89
PID 1336 wrote to memory of 1972	1336	chrome.exe	90
PID 1336 wrote to memory of 1972	1336	chrome.exe	90
PID 1336 wrote to memory of 4088	1336	chrome.exe	91
PID 1336 wrote to memory of 4088	1336	chrome.exe	91
PID 1336 wrote to memory of 2656	1336	chrome.exe	92
PID 1336 wrote to memory of 3196	1336	chrome.exe	93
PID 1336 wrote to memory of 2656	1336	chrome.exe	92
PID 1336 wrote to memory of 3196	1336	chrome.exe	93
PID 1336 wrote to memory of 4936	1336	chrome.exe	95
PID 1336 wrote to memory of 4936	1336	chrome.exe	95
PID 1336 wrote to memory of 640	1336	chrome.exe	97
PID 1336 wrote to memory of 640	1336	chrome.exe	97
PID 3212 wrote to memory of 1708	3212	file.exe	98
PID 1708 wrote to memory of 5064	1708	msedge.exe	99
PID 1708 wrote to memory of 2864	1708	msedge.exe	100
PID 1708 wrote to memory of 2288	1708	msedge.exe	101
PID 1708 wrote to memory of 1240	1708	msedge.exe	102
PID 1708 wrote to memory of 2288	1708	msedge.exe	101
PID 1708 wrote to memory of 2288	1708	msedge.exe	101
PID 1708 wrote to memory of 1240	1708	msedge.exe	102
PID 1708 wrote to memory of 2024	1708	msedge.exe	103
PID 1708 wrote to memory of 2024	1708	msedge.exe	103
PID 1708 wrote to memory of 2024	1708	msedge.exe	103
PID 1708 wrote to memory of 4916	1708	msedge.exe	104
PID 1708 wrote to memory of 4916	1708	msedge.exe	104
PID 1708 wrote to memory of 4916	1708	msedge.exe	104
PID 1708 wrote to memory of 4900	1708	msedge.exe	106
PID 1708 wrote to memory of 2184	1708	msedge.exe	107
PID 1708 wrote to memory of 4900	1708	msedge.exe	106
PID 1708 wrote to memory of 4900	1708	msedge.exe	106
PID 1708 wrote to memory of 2184	1708	msedge.exe	107
PID 1708 wrote to memory of 2184	1708	msedge.exe	107
PID 1708 wrote to memory of 2684	1708	msedge.exe	109
PID 1708 wrote to memory of 2684	1708	msedge.exe	109
PID 1708 wrote to memory of 1656	1708	msedge.exe	112
PID 1708 wrote to memory of 1656	1708	msedge.exe	112
PID 1708 wrote to memory of 2652	1708	msedge.exe	113
PID 1708 wrote to memory of 2652	1708	msedge.exe	113
PID 1708 wrote to memory of 2652	1708	msedge.exe	113

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" https://google.com --disable-gpu
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1336
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff81d81c728,0x7ff81d81c734,0x7ff81d81c740
    3⤵
    PID:1536
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1888,i,13918483744089945279,17876995605401367155,524288 --field-trial-handle=2020,i,6713985608880820000,2928530319515658870,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2080 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4128
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1764,i,3980881558924734547,17498288442862657550,262144 --field-trial-handle=2020,i,6713985608880820000,2928530319515658870,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2016 /prefetch:2
    3⤵
    PID:1972
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2296,i,5645170345886388311,11563614150478545734,524288 --field-trial-handle=2020,i,6713985608880820000,2928530319515658870,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2308 /prefetch:8
    3⤵
    PID:4088
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3144,i,12733763158228226419,3421086087243749813,2097152 --field-trial-handle=2020,i,6713985608880820000,2928530319515658870,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3172 /prefetch:1
    3⤵
    PID:2656
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3140,i,3167584107684465039,15641900114556856864,2097152 --field-trial-handle=2020,i,6713985608880820000,2928530319515658870,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3192 /prefetch:1
    3⤵
    PID:3196
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4188,i,3460350230422580042,5977573450581972956,2097152 --field-trial-handle=2020,i,6713985608880820000,2928530319515658870,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4200 /prefetch:2
    3⤵
    PID:4936
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4644,i,10444884016184548071,12484447878131019188,2097152 --field-trial-handle=2020,i,6713985608880820000,2928530319515658870,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3784 /prefetch:1
    3⤵
    PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://google.com --disable-gpu
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff810d2c188,0x7ff810d2c194,0x7ff810d2c1a0
    3⤵
    PID:5064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,11485451768757748907,1916256637078071332,524288 --field-trial-handle=2316,i,4218726379490702961,7999606087420869421,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:3
    3⤵
    - System Time Discovery
    PID:2864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1748,i,1685270441200202944,17516928856558707501,262144 --field-trial-handle=2316,i,4218726379490702961,7999606087420869421,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
    3⤵
    PID:2288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2372,i,16366700559583710577,17390472078250023242,524288 --field-trial-handle=2316,i,4218726379490702961,7999606087420869421,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:8
    3⤵
    PID:1240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3396,i,16599443628790190887,10354560141799921038,2097152 --field-trial-handle=2316,i,4218726379490702961,7999606087420869421,262144 --variations-seed-version --mojo-platform-channel-handle=3408 /prefetch:1
    3⤵
    PID:2024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3404,i,5834210399868894769,17555416571803096324,2097152 --field-trial-handle=2316,i,4218726379490702961,7999606087420869421,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
    3⤵
    PID:4916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4076,i,11524800643108408588,13718088086536659387,2097152 --field-trial-handle=2316,i,4218726379490702961,7999606087420869421,262144 --variations-seed-version --mojo-platform-channel-handle=4088 /prefetch:1
    3⤵
    PID:4900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4084,i,5753700615878591422,13421823570914152507,2097152 --field-trial-handle=2316,i,4218726379490702961,7999606087420869421,262144 --variations-seed-version --mojo-platform-channel-handle=4108 /prefetch:2
    3⤵
    PID:2184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3568,i,13937283571486580081,1588894607006806446,524288 --field-trial-handle=2316,i,4218726379490702961,7999606087420869421,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:8
    3⤵
    PID:2684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,11013399976315255379,13499367531633998440,524288 --field-trial-handle=2316,i,4218726379490702961,7999606087420869421,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:8
    3⤵
    PID:1656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3556,i,3654441298142676411,17256893892630810682,2097152 --field-trial-handle=2316,i,4218726379490702961,7999606087420869421,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
    3⤵
    PID:2652

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:644

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log
Size 7KB
SHA256 2bc0ae2ad1451126dba6133eabddc2f90657be5f62a7d798ca5042b82eef3064
MD5 0684ba5efe30bf336986dd72593e67dc
SHA1 e6aafbe9d2f5c040c6c0f4da36d746f76b9b0a3b
SHA512 0541992c773b3ddab7ed3baf097eba48b24ec61224e934b01b0dc9022fb2f05fd1f211f163d05f05e0e36af9c0b0158661c463b304e00261e2f62543413e7dab
SSDEEP 192:H+Pk7MI2V4GcgmONDQX8M8oH1/DeduEY5HaNC0HsqD:e6MI2V4QDM8oVbed/prs4
TLSH
T127F15EBEEFD19C5C6946D098748134153CDA719F3BC8B2AB9CD54526C2C948D2C4EFE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 87a97bc96a3c9f2fff237dce13b88e5f90add7c86b1b9ec1b2d580fc87fec939
MD5 05723191cdc8f9b5d51b8a39eccdd350
SHA1 686b050fd04b4dffa079526b7b90aeac3091f43a
SHA512 0883e174b05bd7ff1f197bdac8f418935ededa0979446623e2248e2d718058de8369a970a6e15051e37939e59b1bd5a66156e8181ec47de81381240b4f47e332
SSDEEP 3072:/9Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:/Um7Rkm1tYpBeh2BAoM
TLSH
T194C312275E75E9375879BB0EB08E0B1F1EF14AA6D830DA92C8D85B0467F97CC1A05D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
MD5 7060eae8ec426d15de2849b1f7d261b4
SHA1 b252d90b9d7050d0b9b7c03141d9d3b7cae404ac
SHA512 8791005fae20dc1dc5dc5b0086efe814e0b1e36781ef1931cc1fc699fc4cb34d62ab3f9a83f4967824f3bb71aef6adc6ad457ab7a6addcba99f9e9b473eabb4d
TLSH
T118D01222BE08A415E65BA271A502C7141F5954A124938651E224D86CD9F84D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4d517b88a0fb88494276c126764235de9ee52961c86cc4d3abaf517b10a649a8
MD5 dde9ea8dd9c7e315ef614ab3476af02c
SHA1 e03e201e89770d15b4040d579c2cce8684959a2c
SHA512 410e016336529d709de957d44e67238e4f6592b9ce6646395a9e45ce592e7810b4cb6b1b6df5d8b26875a6aa235b77d41c0983ccc055556f8b8c02224093fdd1
TLSH
T16DD012227E08A415E65BA271A502C7141F5954A124938651E224D86CC9F94D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 4KB
SHA256 d7ca3c1d7f0a8eee74f36cee6592dfbbd07cada97664c447903a928bbd9ddbfb
MD5 33930fa4fcff4327e50691a6e73f4493
SHA1 019a5b86e3e65a7ed6a7e5d76447314d8b98aa4a
SHA512 93011308a848af7e57974b90e3ddf8d35d74ab619886ed4041c4423961ea163b7276ef4a8fd7b9c04f6bee193c55fcbe006f06b0a944932ee706131562a75e3f
SSDEEP 96:lNGT5ZGgJztq5bXAbYSelL4MUnq0sVO3sJ3AMcFFc:XGhxQAbY9lL4MJVO3srcs
TLSH
T18581E97AEBD1801B7E5D80E520D764621DAD60BF2F895995AC841C07E7AC05C6C5C7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 8b36e43232843fb1ca0a21c3344b07b38856ebf257f21ab46a9d549b0c3ebb3d
MD5 17f746a1e16b815f29f47fbfe1bd0e04
SHA1 70444643c16c033c890d0cf51b379e21ca230a63
SHA512 00c05a2bc0221ca19f81599bf311a4bab64f83d9dff7e36467b2313307a50a35175b7c5808b3b4c775c9c7c4ab148ded42c222ccd602d3db07d8cbc621cff13c
SSDEEP 192:P+x3fT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mx3fQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T1C524640A7B787001EDE3D9725CB080771E3CA16DCF22A6915DB654694EB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 54ff5236a11f83786f6a3ca3a4c8bf483bf595d43f9d44246a66accd126a0222
MD5 499ea66c011d7ee55b0904ad28e66479
SHA1 e4609cf88188ac92109e08edf1e270f0e7d22224
SHA512 fc92eb981d5013c4481a91b6165a0c40428df8d9e83840ec19f0851f19057404b6bbaa1d3baaac56886ced6338fcd353808c86460276e16bb5f6c2654daef05f
SSDEEP 192:lON76vMtPQmiUykNThTFp+FdLXKV847zFU/u:lON76UtRNTOdLK1BU/u
TLSH
T120020835BC786C7B9AA3BD86F48A27171FE4217BE9D11B50EAE82F1C00D765C1303826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 16e9382f798886cb307943341d7b099f6811ef6c9dfddd21a72feaaac82ff283
MD5 9ad633d1f5933526f4cf9e2cd8f696a1
SHA1 b97eef6991b17d1410023ce21606c1f31c9a0993
SHA512 f67d859f3f2f0cbe73e0573a000c09390ee6073ad46caabffe360dbb15a58ab99fcb42d1d7a6b4496f24b17e93a06c29e8bc325631160c6371faca6e2494dcc3
SSDEEP 192:pONJ6vMEPQmiUyPNlhTFp+FdLXKxzSJrt80IMqcU/u:pONJ6UERAlOdLKoJrSmU/u
TLSH
T144122C32AC649C2B6D93B581F48B36175EF0926BEAC56B50F6DD3F1C01DB66C1307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 956ec6e73c992fd40d3a6d172ac7bbb6c54552afbf50b72ef88a4ec48b1b2b61
MD5 9e8dc2cdd79ef9125bc8441821727210
SHA1 f1f5df4a709891bd12ebd671f7ca895f0269c968
SHA512 f478c44a3107c16280ecb9e4b83f06711e16f30363dc89d72b441b3db9b6f11767c34857d1efe499bc83763ee2c8d3e37672064d6c1963c4b5bebe41daf98e23
TLSH
T188412C6CA6FA1148B3B77E1AAFF7686D847AB9732E46D05D00110D4F0663A41C8B2737
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 2fc573abb30852c4e9c0c8728e4f4afc995af24e7fe75921763c0eace418fb2f
MD5 7dc2c7790bf55acd2635802c389942f7
SHA1 43d16e13fb22fc3c1cecf179fd8292482d1f8ef0
SHA512 0f368a51da999cc920350c8d2f515d52010cbb76ad0a2074d1f30562f0273d1ae442d7b5629f32013767523899f00121110952f6bfe59ac36c612b091af464b0
TLSH
T12C512C58A6FA1158B3736F569BF6A8AD457FBC333E07945E10120E4F0A63A41C861B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3212-22-0x0000000140000000-0x0000000140061000-memory.dmp

Download

memory/3212-0-0x0000000140000000-0x0000000140061000-memory.dmp

Download

memory/3212-198-0x0000000140000000-0x0000000140061000-memory.dmp

Download

memory/3212-199-0x0000000140000000-0x0000000140061000-memory.dmp

Download

memory/3212-8-0x0000000140000000-0x0000000140061000-memory.dmp

Download

memory/3212-5-0x0000000140000000-0x0000000140061000-memory.dmp

Download

memory/3212-4-0x0000000140000000-0x0000000140061000-memory.dmp

Download

memory/3212-1-0x0000000140000000-0x0000000140061000-memory.dmp

Download

memory/3212-204-0x0000000140000000-0x0000000140061000-memory.dmp

Download

memory/3212-205-0x0000000140000000-0x0000000140061000-memory.dmp

Download