Overview
overview
10Static
static
3SoftWare(1).exe
windows10-ltsc 2021-x64
10SoftWare(2).exe
windows10-ltsc 2021-x64
7atom.dll
windows10-ltsc 2021-x64
10brand.dll
windows10-ltsc 2021-x64
10concrt140.dll
windows10-ltsc 2021-x64
8encoding-c...on.dll
windows10-ltsc 2021-x64
3icudt68.dll
windows10-ltsc 2021-x64
3icuuc68.dll
windows10-ltsc 2021-x64
6libcrypto-1_1-x64.dll
windows10-ltsc 2021-x64
1libcurl.dll
windows10-ltsc 2021-x64
8libssl-1_1-x64.dll
windows10-ltsc 2021-x64
6msvcp140.dll
windows10-ltsc 2021-x64
8msvcp140_1.dll
windows10-ltsc 2021-x64
8msvcp140_2.dll
windows10-ltsc 2021-x64
8msvcp140_c...ds.dll
windows10-ltsc 2021-x64
8root-servi...er.dll
windows10-ltsc 2021-x64
10settings/c...lf.dll
windows10-ltsc 2021-x64
8settings/d...47.dll
windows10-ltsc 2021-x64
8settings/libEGL.dll
windows10-ltsc 2021-x64
8vcruntime140.dll
windows10-ltsc 2021-x64
8vcruntime140_1.dll
windows10-ltsc 2021-x64
8vcruntime210.dll
windows10-ltsc 2021-x64
8vcruntime211.dll
windows10-ltsc 2021-x64
8General
-
Target
ROBLOX Cheat.zip
-
Size
14.1MB
-
Sample
250212-wde6la1nbp
-
MD5
77612ae23f6eb446aed45201590f8d5d
-
SHA1
bf75734ae442e3e3bacc0b26fbc8edb67bf67705
-
SHA256
1e7bf1aa6b91a6626f5633b5588fc713a2188ba4a1abba445ad531f106a5dabe
-
SHA512
05cc5fc40774078266f7c58aea66a179555e558d8fada2066e24a736fade4934e065756f9502da5e2062c0f6075948ad43626047de7e8b4657e51d3e74552e34
-
SSDEEP
393216:0XG3+iho0r4nMrJz+sNVDAyqQpYQSK4Wka8R:WtK4neJSsNVWQpYE78R
Static task
static1
Behavioral task
behavioral1
Sample
SoftWare(1).exe
Resource
win10ltsc2021-20250211-en
Behavioral task
behavioral2
Sample
SoftWare(2).exe
Resource
win10ltsc2021-20250207-en
Behavioral task
behavioral3
Sample
atom.dll
Resource
win10ltsc2021-20250211-en
Behavioral task
behavioral4
Sample
brand.dll
Resource
win10ltsc2021-20250211-en
Behavioral task
behavioral5
Sample
concrt140.dll
Resource
win10ltsc2021-20250211-en
Behavioral task
behavioral6
Sample
encoding-conversion.dll
Resource
win10ltsc2021-20250211-en
Behavioral task
behavioral7
Sample
icudt68.dll
Resource
win10ltsc2021-20250211-en
Behavioral task
behavioral8
Sample
icuuc68.dll
Resource
win10ltsc2021-20250207-en
Behavioral task
behavioral9
Sample
libcrypto-1_1-x64.dll
Resource
win10ltsc2021-20250207-en
Behavioral task
behavioral10
Sample
libcurl.dll
Resource
win10ltsc2021-20250211-en
Behavioral task
behavioral11
Sample
libssl-1_1-x64.dll
Resource
win10ltsc2021-20250211-en
Behavioral task
behavioral12
Sample
msvcp140.dll
Resource
win10ltsc2021-20250211-en
Behavioral task
behavioral13
Sample
msvcp140_1.dll
Resource
win10ltsc2021-20250211-en
Behavioral task
behavioral14
Sample
msvcp140_2.dll
Resource
win10ltsc2021-20250211-en
Behavioral task
behavioral15
Sample
msvcp140_codecvt_ids.dll
Resource
win10ltsc2021-20250207-en
Behavioral task
behavioral16
Sample
root-service-provider.dll
Resource
win10ltsc2021-20250211-en
Behavioral task
behavioral17
Sample
settings/chrome_elf.dll
Resource
win10ltsc2021-20250207-en
Behavioral task
behavioral18
Sample
settings/d3dcompiler_47.dll
Resource
win10ltsc2021-20250211-en
Behavioral task
behavioral19
Sample
settings/libEGL.dll
Resource
win10ltsc2021-20250211-en
Behavioral task
behavioral20
Sample
vcruntime140.dll
Resource
win10ltsc2021-20250211-en
Behavioral task
behavioral21
Sample
vcruntime140_1.dll
Resource
win10ltsc2021-20250211-en
Behavioral task
behavioral22
Sample
vcruntime210.dll
Resource
win10ltsc2021-20250211-en
Behavioral task
behavioral23
Sample
vcruntime211.dll
Resource
win10ltsc2021-20250211-en
Malware Config
Targets
-
-
Target
SoftWare(1).exe
-
Size
3.1MB
-
MD5
09776d1e6b458622944c21a37127d945
-
SHA1
55fe43db0038a411d1302b85cb1d8c61704bf2a4
-
SHA256
6718e20d2fcaed405be6cb6784e6df72d93e5449fbab18e4d2d1dec5e2efde0a
-
SHA512
e530a84c2bf855f8ed7ec667f12dd738c0af4a6f63efb861432065634d4d5afb5e8369d28e1c90753efe5ed24bbf384ac5e20819efdc3b73735a31fce7e83d07
-
SSDEEP
49152:SZQQYNwNfHO8dkHOL+/4n5TlqmjPEY5XlPHXc1jbIEXVQ7IiVVNSrUWTKtOd/o06:SdHSwn5eY5V2bd8b
Score10/10-
Detects Rhadamanthys payload
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Rhadamanthys family
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Suspicious use of SetThreadContext
-
-
-
Target
SoftWare(2).exe
-
Size
371KB
-
MD5
2569020b4f537d6bfe2c65ef058f5c81
-
SHA1
380b0299db8c4e24b5485fc703e612adb9b5b638
-
SHA256
8b642d18712bec1c4388be2de24f7a8abcfe4bdea72b39cc0f0df484828afd3f
-
SHA512
5e4397875992c74daa14ca44351dd6cb871543bddfee8438ffaaf9d7c9ba7cca4816a0af210ab28a2328ee8549d9c045180a25ea0b3a042613b81c4c9dfb48a1
-
SSDEEP
6144:Pn31Zi9rAs2tOr9a/Tg4Z7tIFkkPGH04a/c8g8koJh9uEOw6/pFYJZctsVPfcjyM:P31Zi9rA/qa/Tg4B96y0zxJkshtOw+Fz
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-
-
-
Target
atom.dll
-
Size
3.1MB
-
MD5
1569785bfb346bca69521f03a8725f41
-
SHA1
0197e299cce7adb9856e2f0d458c4f995898fb55
-
SHA256
9a89cf1428bbba42ea97e747485eabebd0f3116e9287fd8bbe9e5e383bc91d98
-
SHA512
648a98491358bd73009354f418f782179c19489be7d4383e726c965ae2f9016006144a9d40fadc8ca6ab65c3883897f5a0dfb884580ed6699f30144d5c931ff4
-
SSDEEP
49152:4Z294FkBxwSfyRzgsbbAf2F1b7521Ire5AT3:4iQnAfG1P5Ze23
Score10/10-
Detects Rhadamanthys payload
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Rhadamanthys family
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Suspicious use of SetThreadContext
-
-
-
Target
brand.dll
-
Size
204KB
-
MD5
916d89b5d24979190fd8b5b5795230a2
-
SHA1
42515c9b2aa015be9a3c8942b76bb119ff1c318a
-
SHA256
fd6bfe231d47a831c5e0f8a65fd264636710e30f5c611176de2b341d92f12df8
-
SHA512
c9a6909c6f781d974282f62824b9f2cc21bbc8c11fc03c09c40d97295ea8977c31bb11c0cf2eae2765ecd6e8a9e67b57345a20db85102339ac5b49200301077c
-
SSDEEP
3072:yyN5t1veJLGufnflehMvmldBTlqlAO/bmDx3g0RDlYSkEo3z/VrTsyFqug:yyfvveJLhyMvmgv0haSe3z9rTsyF3g
Score10/10-
Detects Rhadamanthys payload
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Rhadamanthys family
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Downloads MZ/PE file
-
Suspicious use of SetThreadContext
-
-
-
Target
concrt140.dll
-
Size
325KB
-
MD5
eb42b164d603672e07997019bb00e4ad
-
SHA1
9f73f2323b167215874a7d3dd4a7f7750312f219
-
SHA256
dabdb0732b2fc14040cedbbfd369d9eb3c7a2e66b38a79892e1c05e6d6a8526d
-
SHA512
1e74ea24bfcaa5dd1ef0654a45f96c99900dbfca406bcfb73ae3abfdad7c1d0d12e773817a9ab3fd8d1d927a85d5fa6447b3c521192dccf33957f5bea00b3cc8
-
SSDEEP
6144:1ndGd0wl7XIbBx5C9YtkO2MUWghMWbGynWzgcZ6rO4i47:zCpIRC6tcG5zKiU
Score8/10-
Downloads MZ/PE file
-
-
-
Target
encoding-conversion.dll
-
Size
28KB
-
MD5
b0f21ea663476cbf02a93b8de7152586
-
SHA1
b6253d151a6d88ecf7029e79bbe4737792dfa79d
-
SHA256
249e70a3bf203692e2212ede45fdefecafaede7ab9fa6cefcf02a65f0e14cbe7
-
SHA512
59fcddc5b4a87efca72a9a7c1252701c57ba65c656958d9c0a5557c3ffd049fcfeb10d6ddfeca8e33171cd269c03bb19ecbb5e7e9a25e664e1b26c81211db1c1
-
SSDEEP
384:FibcYRa//wXJg3s4h+hh0cTGfZihL0cTGfZVhm:jCLOph+hhTwiNTwVhm
Score3/10 -
-
-
Target
icudt68.dll
-
Size
19KB
-
MD5
994a66f27812c53d3f5bd8336b4a2aa4
-
SHA1
e4575dd22d14cd9704d0b34d2d0ddeac54c90637
-
SHA256
ce1ba6d19bd4842fb54daf9d929208b3840ec98e3a135bd89008dd9312f03894
-
SHA512
d2ecf75afc628026e0f10cd58869cfe8b7dd85e401b544a9e5b0a3a26e5518883b3d5bd03160301b4d927f20b983b403fd514a7c7762b70ba19c9feb9258f3f7
-
SSDEEP
192:tSU/lU0TBZHh0Fg2kAdGlYqufZnixMa4bbP0Fg2kAdGlYqufZnltBZHVd:VtVhh0cTGfZSMPj0cTGfZ1hX
Score3/10 -
-
-
Target
icuuc68.dll
-
Size
2.1MB
-
MD5
95482a6a29f2d531732294b10f35a684
-
SHA1
7bf324f137d085d7ff5431df0d12208f42b8217b
-
SHA256
5f56fea8807d97052e8dfe3bb25baf7ad0200d7cb288a8b3e9aef4d8881367b8
-
SHA512
4f6abeb8a2227ab30ae9aaa131408d1f6d737f38a1f0ef1b691cd20c40b756fdafa94bcf5413f49bb251187166574d03601e809601b487d6327c407034e98bcd
-
SSDEEP
24576:LE4CsQBmuuq+7QJHOqHsEehOB1TTCbKJM9lo736S1GBAdtkjsyk3lIkkp1sTf9wY:4sQ9+qHOIBehOB4mulo736uGCrykVYlO
Score6/10-
Downloads MZ/PE file
-
-
-
Target
libcrypto-1_1-x64.dll
-
Size
3.3MB
-
MD5
5bbead1078ba0b07e0766eb2426167eb
-
SHA1
c3443ea0a003268c022225e9b85c6edfb2c09607
-
SHA256
0cfa2871aa30c9e047a8f5266b31f548b343f15244d26be26bb2a070b5655237
-
SHA512
55b98d8b57bf06ff9718a73dffb11a3c666c2ba24964b8a9b3c540d4faa22e3aa5dd284795b97375edeb845b7b83dca89bcc97d44c2f66886d5c5b56ff532902
-
SSDEEP
49152:aVwASOxVIU6ix4GtlqcD+edG2uGAxq+qJhT/XtJl7Ec6YBE6yPBsosKL1CPwDv3G:0y+/rA0lBvKsosQ1CPwDv3uFh+2
Score1/10 -
-
-
Target
libcurl.dll
-
Size
449KB
-
MD5
f17bbe4b592ef5e2e5563c90aa6e9477
-
SHA1
836f12ca42b151eda66e542c8f81d965e377e7eb
-
SHA256
77208031dc7fdae3fc6bd8e2dd7173b740ba8527aa37bfd1774fa16ce26f9290
-
SHA512
5bbec8fe82bf7a9e719040064e1ad7940e44e81ffb5c7d9f4d320477e4a14050d632c8003a85b081d7923d90722b769c0bf0a602e191389eb1ae318b3a6da4fe
-
SSDEEP
6144:EPTD6DxLdMoND2/RNMPs00bqRv/suZN/RgbyR/Z79TBtgNS:EPHWxzNi/UzfXBN5mk9TUS
Score8/10-
Downloads MZ/PE file
-
-
-
Target
libssl-1_1-x64.dll
-
Size
687KB
-
MD5
70d81d5cdf48abebc6aedae38aec704a
-
SHA1
9346878ae8a259192a65a750ac033819d7326501
-
SHA256
49fe8b7f1580290335970b79d772f7fe91eaaa711068be86d7500213506afcd8
-
SHA512
f5226795667cb6731bb3b47e8da5a1999201c0a4bbfc74652f2dabaa106702de9828f6a04d64e54742f21b2bd7564e6bd86dd9c7b12a2e2084e8c20e66a2b9dd
-
SSDEEP
12288:wKaRK32Hgz6g1MI7t0pXDtfzeC83bZ0DoumKmqLh4YodAfvGw5U2lvztG:KH0MI7t8EuaO+dAfOEU2lvztG
Score6/10-
Downloads MZ/PE file
-
-
-
Target
msvcp140.dll
-
Size
603KB
-
MD5
a1d30ef2114e18e26e2bb96555be81bf
-
SHA1
a5e3e5a5910dd0781caf0a9f58dd7b519de8c927
-
SHA256
f87819ae8c6f7c90d3237a1abb9809e8cba9dcd0c80ac3f0969a5e68ef652ca4
-
SHA512
5c5bdae87327b3fb724844087257a0ba0e7ad31c194ab5f632845e8f09633f63982817ca551d1735523b1a65763efa3c2ddc8789b3bf23324d7882456e3aa6f2
-
SSDEEP
12288:ttc7Tg4ObbZu3JZfzeUQEKZm+jWodEEVTMj:U7Tg4+Zu3jJQEKZm+jWodEEVMj
Score8/10-
Downloads MZ/PE file
-
-
-
Target
msvcp140_1.dll
-
Size
30KB
-
MD5
a0b595f95be9cce12bff7ef199f874c4
-
SHA1
7fc5f91033cd83f11ce03ab2478d9b29036e6535
-
SHA256
b05f3dfd4e999c3e110219fb59151cbaa322757f4f3ce52b64dddc853e5c105c
-
SHA512
182a0cc4227afb43228ebe5033977fcfb4c8ebb2f047d2decfab8f33453fd2262e62dd80b2b0f34cded9a8ee784d7449120a000aeb1949642bdf8cc563282b8e
-
SSDEEP
384:6i/3lk2SyA04U9Kqnd5ZWcR5gW546QpBj0HRN73YxQHRN7MCMlvz:bObyl4+Kqd5DPXqW3Yx8A
Score8/10-
Downloads MZ/PE file
-
-
-
Target
msvcp140_2.dll
-
Size
198KB
-
MD5
bbcf50b71928edb1c32c969d0533753c
-
SHA1
faca1db3873d478b17fc6791b94fae651202627a
-
SHA256
7d5d180c8e41b1964835b2550191e2d9054d8f4beff898ade67b3d5dd25b5101
-
SHA512
e3890679d21e76a19361cc181eda9323ba31fb1211124e40fa3c9834cb0bfab6f7b3b34cf349ee4d7b3cc10e50813ae728dd01dd254eee098f3971f07679d710
-
SSDEEP
3072:0m2dow+wS2vEYFBeoVM4ZaeEQDjQdA05+TiIfH+YKpHANGbaQLvaOvV:0xhbBFBnPZTL0mfiAN9Q7aOd
Score8/10-
Downloads MZ/PE file
-
-
-
Target
msvcp140_codecvt_ids.dll
-
Size
26KB
-
MD5
e42f86965ceb093d95b9c93bd87b179d
-
SHA1
4184b271261b3eb9c0193e5e6874b8847b18dc22
-
SHA256
1e56cee876940affe9883aeccee9132280d03fd4282ab6552adf75fbeeed2bac
-
SHA512
6b355d468fd8214cf50cef7d30a9098c812b60f0215726da937361e0cf2d2b8362ae5bc2b88c5e8dd48298c13b1be1a52d7f68d075c2a8d9c93480354b0e8420
-
SSDEEP
384:OTDpEPOCAbHWi/EWz46QpBj0HRN7bX8QHRN7ep1x09lT9D:qNEFa1XqWbX88epQD
Score8/10-
Downloads MZ/PE file
-
-
-
Target
root-service-provider.dll
-
Size
590KB
-
MD5
d991901b3fb8228b3637e4483cc36260
-
SHA1
57e769738c10ca5aa43de3fa20883fc49acb9922
-
SHA256
e06e2da83d8506522be3f269941408373c70d10a1cc6072a9110db9615ebb176
-
SHA512
c9fafe1133fde3e4fc36e70b97ea152bf8728f6a1f1022be5f1f98ccb550c98e272f3510b7c18f6168119a9c45b1ce79920ae5d93261eb765f162dd483cae232
-
SSDEEP
6144:DLfoRIJ9O2qXPKTG1KyK63fGMEfJ8MHPxpFjYU8a4Z/u/lWbTO+FIIZoMhNdLkLe:gmMEfJ8MHPxpFR8a4Ru/lWbTZF/ZoDNY
Score10/10-
Detects Rhadamanthys payload
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Rhadamanthys family
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Downloads MZ/PE file
-
Suspicious use of SetThreadContext
-
-
-
Target
settings/chrome_elf.dll
-
Size
968KB
-
MD5
ddc33cf2f8a0d4fa0b96667cb037a5bd
-
SHA1
277e4695266d7ac368a7635476556a2cc4793d98
-
SHA256
cdac4bac1481074e5a1664a2c6437273b0a2da068ede892ed0468825429e5e77
-
SHA512
574bc9f683a8a18b34e70d6830dcc6c0e605f3ed601f921d525f712e74ed3c83e106eb43551ab3325566e032a98a752e24407494081863dd4bc5fcd20f079bd9
-
SSDEEP
12288:kVq/yoDkMVSDPwy1wmThw2ljaR0E/uDmH5wvQwmeR5+n+orQ:dbsZwmTd1UuiZTwTz
Score8/10-
Downloads MZ/PE file
-
-
-
Target
settings/d3dcompiler_47.dll
-
Size
4.1MB
-
MD5
5daacc29ed5218bcb836bfa8dba4dade
-
SHA1
0f94d6b63e1a8c5def69377a9c2c5b9ed8a2a9d9
-
SHA256
b548547f7f7e6afc5769be1f084b3e13b6bce07fbacf5de8156a5f88328b621d
-
SHA512
8ad9243d7d811d8e9768d8213a0bf0c120b8b3081c8374de8459d56ec9e10f11f81acf0d4421d949d3a892bc9468559c4c148b548f1128b674990afb55a31347
-
SSDEEP
49152:l5EfJYiVk9w6hAPqzag2At6i5K/8Ub6Lg3MEq/NHiQTtVr+5kb62QgdD6zoodr7z:j7iNPWHYE+Bnmc
Score8/10-
Downloads MZ/PE file
-
-
-
Target
settings/libEGL.dll
-
Size
382KB
-
MD5
2bb37aae4eec265d97aea03800a26145
-
SHA1
06542423b68110c3d5ecf2159114f4c0bc2879b9
-
SHA256
4a34a80415a041caa00456fcbcfa24cbe8a05d699c8cc302215823826e94bc54
-
SHA512
66d6307e2a412aadc731bbfe0d96cad3f0aace100de0f7cba970438f7cc8087b8c6a5ac205809622e58d46b92f43da7b213a4713885ae247a1a229e8abf4125a
-
SSDEEP
6144:5fn91PNKeDQhPAybcKwtN0eHpN5uv4XdWT9V:5fn91PDDQhPRNkN5uv0W3
Score8/10-
Downloads MZ/PE file
-
-
-
Target
vcruntime140.dll
-
Size
87KB
-
MD5
23105a395b807d9335219958b4d0cec1
-
SHA1
fb60050d82e3bc1be3b10877b9355f5d48e04854
-
SHA256
61832990e364dca5bfa2c61d930f00acaae6d1aaa3130392403455ae9a1125a5
-
SHA512
ef91d19e632d0d146fa68d52beb04ffcb9b972079cd9c255f44ea5201637a8b00907ec8e3358c7b5cc37338470e29e43dbaec7ddc0562810b49ab2e8115cc805
-
SSDEEP
1536:fTSVLL1/VfZPtsO6nBy0r8Z3j5X7K0d4HIH8d2//zoXnf7toecbNCOAS7Z:fW/tB8n8F4i/LoXfeecbNCA
Score8/10-
Downloads MZ/PE file
-
-
-
Target
vcruntime140_1.dll
-
Size
43KB
-
MD5
9040ed0fdf4ce7558cbffb73d4c17761
-
SHA1
669c8380959984cc62b05535c18836f815308362
-
SHA256
6cc4315daceb0522816c60678344466cb452426267f70c7faae925361674e774
-
SHA512
303143006c781260540e9d0d3739acc33f2d54f884358c7485599dd22b87cce9b81f68d6ad80f0f5bb1798ce54a79677152c1d3600e443e192aecd442ea0a2e4
-
SSDEEP
768:vG3xRsJTKdiibUoT2zvivbXXyJWqWZ8DZX:vG7DyM22DiJMCtX
Score8/10-
Downloads MZ/PE file
-
-
-
Target
vcruntime210.dll
-
Size
27KB
-
MD5
60e94c457312c39cebeaa44c365013ca
-
SHA1
39e125e04dde3c9a20f5e6fcb0560897a0f4a6dd
-
SHA256
638e5817aabcb9344e083b5c59cf73950cc0ec4440635e7f3ea6a65d7f25be47
-
SHA512
250016ac13caca70c7fcd9991f7d7d46835038e4a62c277fc08d32310839e4af36cb3bad805b97573bffadfb7ddf3e8e452c7d6157ff98ea17a669349711a9a9
-
SSDEEP
768:CTbEinVPfzZiCVJW19JDFGX3mFiWbBO8mC/DQU1:CTgEhNi4JWD7GX3mFy8mC/cK
Score8/10-
Downloads MZ/PE file
-
-
-
Target
vcruntime211.dll
-
Size
439KB
-
MD5
fa47d70b3a979cb311ee7f1790ed9f46
-
SHA1
27e7e114f3678311768269bb481adeea89a97c5e
-
SHA256
e0d0945e5c34276578d651b0aaf4d2a40ba67d9c4af8773bdf99abeac60e5160
-
SHA512
15f9a9f5315b06e57f6d00cbc467fc6a541599624e70d1d47c67318c89bd954d38e6fccbf94d2362a5b1272c2d5c5666a43392d3ec3ba6d5ae765a01253cb055
-
SSDEEP
12288:XKV/4w+WDhYuwn72U6EVoabc06Yx2tnY4NG8t16PPQ+4b:a/JDhbiWMoabcJc2tY4x36wX
Score8/10-
Downloads MZ/PE file
-
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3