71e70a95591741d64cdc93dfb21a31ab0b83252f2ecf75bb0e8a4d72310928e2

Analysis

user interaction
yes
max time kernel
151s
max time network
156s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/07/2026, 22:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
V6OficialVersion.exe
Size 68.8MB
Sample260726-2b9kbascne
SHA256 71e70a95591741d64cdc93dfb21a31ab0b83252f2ecf75bb0e8a4d72310928e2
MD5 d58e6a36a8e6363cb07eadeb928592a7
SHA1 9ca0e9c576db23685a4489fa53882fd95ab8ffc2
SHA512 7414ef52374455772bf1c733acbfd2fdaf7589388cbec97556f8a044c70728363ca90f799199647856fc456af176b0d9f2cd0a60882b2aa86fbaceb1cf990454
SSDEEP 786432:A9d6t8g9QlR/Xnb8gP1MIxk9hPHCnYP7jGMYViVysmn4/SDhLm9MRpmPsM:A9duMRfnpaIxkPgYP7jsVGQXDhLCM/tM
TLSH
T18CF7DF0773E501A9E577E138CAAB9203E7B2B4161330D7DB329C03652F67AE45E7A760
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

credential_access discovery execution spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
708	powershell.exe

Uses browser remote debugging 2 TTPs 3 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
3912	chrome.exe
5972	chrome.exe
5672	chrome.exe

Loads dropped DLL 3 IoCs

pid	Process
1812	V6OficialVersion.exe
1812	V6OficialVersion.exe
1812	V6OficialVersion.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5984	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2200	chrome.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	V6OficialVersion.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	V6OficialVersion.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	V6OficialVersion.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	V6OficialVersion.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	V6OficialVersion.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	V6OficialVersion.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	V6OficialVersion.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	V6OficialVersion.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	V6OficialVersion.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	V6OficialVersion.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	V6OficialVersion.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	V6OficialVersion.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	V6OficialVersion.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	V6OficialVersion.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	V6OficialVersion.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	V6OficialVersion.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	V6OficialVersion.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	V6OficialVersion.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	V6OficialVersion.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	V6OficialVersion.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	V6OficialVersion.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	V6OficialVersion.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	V6OficialVersion.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	V6OficialVersion.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134295784192964853"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
1812	V6OficialVersion.exe
1812	V6OficialVersion.exe
1812	V6OficialVersion.exe
1812	V6OficialVersion.exe
708	powershell.exe
708	powershell.exe
708	powershell.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	708	powershell.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3912	chrome.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 5984	1812	V6OficialVersion.exe	91
PID 5984 wrote to memory of 708	5984	cmd.exe	92
PID 1812 wrote to memory of 3912	1812	V6OficialVersion.exe	94
PID 3912 wrote to memory of 1428	3912	chrome.exe	95
PID 3912 wrote to memory of 2624	3912	chrome.exe	96
PID 3912 wrote to memory of 2200	3912	chrome.exe	98
PID 3912 wrote to memory of 5408	3912	chrome.exe	99
PID 3912 wrote to memory of 5672	3912	chrome.exe	100
PID 3912 wrote to memory of 5972	3912	chrome.exe	101
PID 3912 wrote to memory of 5276	3912	chrome.exe	102
PID 3912 wrote to memory of 3428	3912	chrome.exe	106
PID 3912 wrote to memory of 3136	3912	chrome.exe	107
PID 3912 wrote to memory of 704	3912	chrome.exe	108

C:\Users\Admin\AppData\Local\Temp\V6OficialVersion.exe
"C:\Users\Admin\AppData\Local\Temp\V6OficialVersion.exe"
1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.MessageBox]::Show('Ocorreu um erro no sistema!', 'Erro', [System.Windows.Forms.MessageBoxButtons]::OK, [System.Windows.Forms.MessageBoxIcon]::Error)""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5984
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.MessageBox]::Show('Ocorreu um erro no sistema!', 'Erro', [System.Windows.Forms.MessageBoxButtons]::OK, [System.Windows.Forms.MessageBoxIcon]::Error)"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-field-trial-config --disable-background-networking --disable-background-timer-throttling --disable-backgrounding-occluded-windows --disable-back-forward-cache --disable-breakpad --disable-client-side-phishing-detection --disable-component-extensions-with-background-pages --disable-component-update --no-default-browser-check --disable-default-apps --disable-dev-shm-usage --disable-extensions --disable-features=AvoidUnnecessaryBeforeUnloadCheckSync,BoundaryEventDispatchTracksNodeRemoval,DestroyProfileOnBrowserClose,DialMediaRouteProvider,GlobalMediaControls,HttpsUpgrades,LensOverlay,MediaRouter,PaintHolding,ThirdPartyStoragePartitioning,Translate,AutoDeElevate,RenderDocument,OptimizationHints --enable-features=CDPScreenshotNewSurface --allow-pre-commit-input --disable-hang-monitor --disable-ipc-flooding-protection --disable-popup-blocking --disable-prompt-on-repost --disable-renderer-backgrounding --force-color-profile=srgb --metrics-recording-only --no-first-run --password-store=basic --use-mock-keychain --no-service-autorun --export-tagged-pdf --disable-search-engine-choice-screen --unsafely-disable-devtools-self-xss-warnings --edge-skip-compat-layer-relaunch --enable-automation --disable-infobars --disable-search-engine-choice-screen --disable-sync --enable-unsafe-swiftshader --headless --hide-scrollbars --mute-audio --blink-settings=primaryHoverType=2,availableHoverTypes=2,primaryPointerType=4,availablePointerTypes=4 --no-sandbox --remote-debugging-port=5555 --profile-directory=Default --disable-gpu --disable-software-rasterizer --disable-dev-shm-usage --disable-accelerated-2d-canvas --no-sandbox --disable-setuid-sandbox --disable-extensions --disable-component-extensions-with-background-pages --disable-default-apps --mute-audio --no-zygote --disable-backgrounding-occluded-windows --memory-pressure-off --force-low-power-gpu "--user-data-dir=C:/Users/Admin/AppData/Local/Google/Chrome/User Data" --remote-debugging-pipe about:blank
  2⤵
  - Uses browser remote debugging
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3912
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffba022c728,0x7ffba022c734,0x7ffba022c740
    3⤵
    PID:1428
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --disable-breakpad --headless --enable-unsafe-swiftshader --noerrdialogs --user-data-dir="C:/Users/Admin/AppData/Local/Google/Chrome/User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAQAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --field-trial-handle=1796,i,10528114047061965877,4173053790569793827,262144 --enable-features=CDPScreenshotNewSurface --disable-features=AutoDeElevate,AvoidUnnecessaryBeforeUnloadCheckSync,BoundaryEventDispatchTracksNodeRemoval,DestroyProfileOnBrowserClose,DialMediaRouteProvider,GlobalMediaControls,HttpsUpgrades,LensOverlay,MediaRouter,OptimizationHints,PaintHolding,RenderDocument,ThirdPartyStoragePartitioning,Translate --variations-seed-version --mojo-platform-channel-handle=1792 /prefetch:2
    3⤵
    PID:2624
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --noerrdialogs --user-data-dir="C:/Users/Admin/AppData/Local/Google/Chrome/User Data" --force-high-res-timeticks=disabled --field-trial-handle=1796,i,10528114047061965877,4173053790569793827,262144 --enable-features=CDPScreenshotNewSurface --disable-features=AutoDeElevate,AvoidUnnecessaryBeforeUnloadCheckSync,BoundaryEventDispatchTracksNodeRemoval,DestroyProfileOnBrowserClose,DialMediaRouteProvider,GlobalMediaControls,HttpsUpgrades,LensOverlay,MediaRouter,OptimizationHints,PaintHolding,RenderDocument,ThirdPartyStoragePartitioning,Translate --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2200
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --noerrdialogs --user-data-dir="C:/Users/Admin/AppData/Local/Google/Chrome/User Data" --force-high-res-timeticks=disabled --field-trial-handle=1796,i,10528114047061965877,4173053790569793827,262144 --enable-features=CDPScreenshotNewSurface --disable-features=AutoDeElevate,AvoidUnnecessaryBeforeUnloadCheckSync,BoundaryEventDispatchTracksNodeRemoval,DestroyProfileOnBrowserClose,DialMediaRouteProvider,GlobalMediaControls,HttpsUpgrades,LensOverlay,MediaRouter,OptimizationHints,PaintHolding,RenderDocument,ThirdPartyStoragePartitioning,Translate --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:13
    3⤵
    PID:5408
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:/Users/Admin/AppData/Local/Google/Chrome/User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-back-forward-cache --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --no-zygote --remote-debugging-pipe --remote-debugging-port=5555 --allow-pre-commit-input --blink-settings=primaryHoverType=2,availableHoverTypes=2,primaryPointerType=4,availablePointerTypes=4 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1796,i,10528114047061965877,4173053790569793827,262144 --enable-features=CDPScreenshotNewSurface --disable-features=AutoDeElevate,AvoidUnnecessaryBeforeUnloadCheckSync,BoundaryEventDispatchTracksNodeRemoval,DestroyProfileOnBrowserClose,DialMediaRouteProvider,GlobalMediaControls,HttpsUpgrades,LensOverlay,MediaRouter,OptimizationHints,PaintHolding,RenderDocument,ThirdPartyStoragePartitioning,Translate --variations-seed-version --mojo-platform-channel-handle=2928 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:5672
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:/Users/Admin/AppData/Local/Google/Chrome/User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-back-forward-cache --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --no-zygote --remote-debugging-pipe --remote-debugging-port=5555 --allow-pre-commit-input --blink-settings=primaryHoverType=2,availableHoverTypes=2,primaryPointerType=4,availablePointerTypes=4 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1796,i,10528114047061965877,4173053790569793827,262144 --enable-features=CDPScreenshotNewSurface --disable-features=AutoDeElevate,AvoidUnnecessaryBeforeUnloadCheckSync,BoundaryEventDispatchTracksNodeRemoval,DestroyProfileOnBrowserClose,DialMediaRouteProvider,GlobalMediaControls,HttpsUpgrades,LensOverlay,MediaRouter,OptimizationHints,PaintHolding,RenderDocument,ThirdPartyStoragePartitioning,Translate --variations-seed-version --mojo-platform-channel-handle=2932 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:5972
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --noerrdialogs --user-data-dir="C:/Users/Admin/AppData/Local/Google/Chrome/User Data" --force-high-res-timeticks=disabled --field-trial-handle=1796,i,10528114047061965877,4173053790569793827,262144 --enable-features=CDPScreenshotNewSurface --disable-features=AutoDeElevate,AvoidUnnecessaryBeforeUnloadCheckSync,BoundaryEventDispatchTracksNodeRemoval,DestroyProfileOnBrowserClose,DialMediaRouteProvider,GlobalMediaControls,HttpsUpgrades,LensOverlay,MediaRouter,OptimizationHints,PaintHolding,RenderDocument,ThirdPartyStoragePartitioning,Translate --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:14
    3⤵
    PID:5276
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --noerrdialogs --user-data-dir="C:/Users/Admin/AppData/Local/Google/Chrome/User Data" --force-high-res-timeticks=disabled --field-trial-handle=1796,i,10528114047061965877,4173053790569793827,262144 --enable-features=CDPScreenshotNewSurface --disable-features=AutoDeElevate,AvoidUnnecessaryBeforeUnloadCheckSync,BoundaryEventDispatchTracksNodeRemoval,DestroyProfileOnBrowserClose,DialMediaRouteProvider,GlobalMediaControls,HttpsUpgrades,LensOverlay,MediaRouter,OptimizationHints,PaintHolding,RenderDocument,ThirdPartyStoragePartitioning,Translate --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:14
    3⤵
    PID:3428
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --noerrdialogs --user-data-dir="C:/Users/Admin/AppData/Local/Google/Chrome/User Data" --force-high-res-timeticks=disabled --field-trial-handle=1796,i,10528114047061965877,4173053790569793827,262144 --enable-features=CDPScreenshotNewSurface --disable-features=AutoDeElevate,AvoidUnnecessaryBeforeUnloadCheckSync,BoundaryEventDispatchTracksNodeRemoval,DestroyProfileOnBrowserClose,DialMediaRouteProvider,GlobalMediaControls,HttpsUpgrades,LensOverlay,MediaRouter,OptimizationHints,PaintHolding,RenderDocument,ThirdPartyStoragePartitioning,Translate --variations-seed-version --mojo-platform-channel-handle=4652 /prefetch:14
    3⤵
    PID:3136
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --noerrdialogs --user-data-dir="C:/Users/Admin/AppData/Local/Google/Chrome/User Data" --force-high-res-timeticks=disabled --field-trial-handle=1796,i,10528114047061965877,4173053790569793827,262144 --enable-features=CDPScreenshotNewSurface --disable-features=AutoDeElevate,AvoidUnnecessaryBeforeUnloadCheckSync,BoundaryEventDispatchTracksNodeRemoval,DestroyProfileOnBrowserClose,DialMediaRouteProvider,GlobalMediaControls,HttpsUpgrades,LensOverlay,MediaRouter,OptimizationHints,PaintHolding,RenderDocument,ThirdPartyStoragePartitioning,Translate --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:14
    3⤵
    PID:704

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2528

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dpapi.node

Path C:\Users\Admin\.cache\pkg\7c97d3a751ddcfa2b5503a6a8952009d024acd27505472048d75e01e311f2c5a\@primno\dpapi\build\Release\dpapi.node
Size 133KB
SHA256 7c97d3a751ddcfa2b5503a6a8952009d024acd27505472048d75e01e311f2c5a
MD5 deac691f8f6d26789fb71f5867865700
SHA1 c0ab610b47b09b42c0d2f7a202d6a9fdedfd1e50
SHA512 2d3abc1564034e804eb614ef86b56e0d133d113488c7f45b6531f5cc711db8aa36631c056d94dd2b2f275dc99acca001261fefa8f9a34940cebaa2ad44d56270
SSDEEP 3072:9Xbs12OIS8X759w1pltgyC7ybxMMb+ZmPXrqA:ynIS8X75mJtUybeMX2A
TLSH
T102D35C57B3A440BBE0B7C27885970A45D3B2B8254B31ABEF07A4465A1F137E0DD3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

koffi.node

Path C:\Users\Admin\.cache\pkg\a6caa84c1f8c459215a783318b818d3fa1b260d2d821c22c22864cd2af216490\koffi\build\koffi\win32_x64\koffi.node
Size 2.3MB
SHA256 a6caa84c1f8c459215a783318b818d3fa1b260d2d821c22c22864cd2af216490
MD5 ebe3666be392b02383d411e846317b76
SHA1 69a87af1f3e7175ef6f681f419d0d18f35038195
SHA512 b473fd70c1b874a8b400283110de077dde62cd3bc5dc7a50334f1b62b3c1d5e07e8a3aee63db14b12aa5f7c3ff495cf21411ff61c6433462698eec743c9a1ff4
SSDEEP 24576:QIURRJEkuyU3d7pJP2JJ4Gvop6geUTnefOE:QIURJETyUN7ph2JKwFJ
TLSH
T125B5DE064758C8E9D83EB072B4176776E56A221B083D62DF04F48D61082ABFD5DAFFC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

better_sqlite3.node

Path C:\Users\Admin\.cache\pkg\d895a929771b5ff67e65f07840b6257b31bc1597ee0c28f34c3406aecabbf993\better-sqlite3\build\Release\better_sqlite3.node
Size 1.8MB
SHA256 d895a929771b5ff67e65f07840b6257b31bc1597ee0c28f34c3406aecabbf993
MD5 e02e71bb676ffd73f4df01fdbbea1c34
SHA1 d27d951bdb6c47670fb05a0793dc06bf4655cf7b
SHA512 4a1700e67b2de91846a621ff18ebf8e0e5796522b052613a9fa3c575e370a303bb430783ad6996749fd8edfc0b1dc7e81d9842a97a6870dc1906a715d49e5ba0
SSDEEP 49152:KgyH7PyMsVvMiKG472nzEB/JHtUnk8p/SysLALVjd:5yH7PyfZwWrn
TLSH
T1E3958C4BE2B400FDC167C079860B560BEB76B41527745BEB1690CA696F23FE217BE324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 6b050b55778ab8bca72fd1bdb6dd4f5f9912ecd322e416ec5e7fdd1b3bff5477
MD5 d48e0a54f02483589c584a2213c7bfef
SHA1 545e89b0ddea3ad653bbf9f64bdf1ef661623f04
SHA512 4705471d6ab36a69e49198d0f825d23d225a4b7a8462a00439d1bb00f73672a57a0b10dedc0b1ff4f1c66c7cdfa9bd047574ea14e583ece51ad349c0a9b23083
TLSH
T18D418CF7C3D8957D890156F8AB156E1BCD290E18431D3C66C8D4AE1FA7E2871D21068E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 aa2588e88c2c8f97ee2761463c032e21fdb420804dc40855820327edda7d0dab
MD5 f64596ba0cf481b6d12a53b99bd80313
SHA1 d7db620a2f4702a9acbc9d296662997381551faa
SHA512 6efa8b22bd6d26fb1a719f151951b49aa0be9589d12f87b3d82ee94cec1f78ac93bfecb8804878634bf7ffb677a0e2299fa4aab49098b1e8f5a51d924f1b15f1
SSDEEP 192:3REkqgYEv7YvgPRpOW9SHsb+WNn1vPgIUEkwFVyIsnAUgY:3REksg06X9Ew1P3TY
TLSH
T1D442A61FB910693B6DDBD629FA257B93D7F6102265902E88E7FC8A2C24E75CC2317017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 7a6f0e26c04bac2cd077c418100c792c571911bc49e07d55833de7c504bad59c
MD5 e5a35a9cf8fac185d950bfae50f8c036
SHA1 ad1fec168f64f861b6c21cb1ab56e53f0db7a5a1
SHA512 c6f451616c59fa2d32951335ad376b03df9a52207ffa1c45bba1699850eeb054d4a9d04b41cc67d41529ab3cb6766e266bb16d5dcf68e51bba9bc4a4515b326a
SSDEEP 192:3REkqgYEv7YvAPRp2W9SHsb+WNn1vPKHVyIsnAUgR:3REksg06XFEw1PiR
TLSH
T1D522951FB914653B6DDBD22AFA257B93D3F6102265A02E84E7FC8A2C24D79CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 4c47278084b7e101de6067922965a67f24611ec38b438ff45c72cebc59f71413
MD5 7600618f86b6f03725a6a6344ea7c173
SHA1 0642e2220a3106a3532dc4bf96e37eb7b232b853
SHA512 5e2fc61072d43020f4e8c388c7c3d4f80823091ad3000771a8aa01600df53a93cba56512473a835c783a503db533697b6d60db692766ef755710e79177456c0b
SSDEEP 192:eG14K6ms7KxkXqK4I40pUZNCgVLHrKHfFKslE88OXzKD/l0+ErUkKN9L6y/kSUK6:D1jts7KxkXqKf/pUZNCgVLH2HfgsluOZ
TLSH
T12F32D727A48D5A3F0FE8D40DDC136F8B6DB5029267780D2496FF9D0803A97CA125A5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 b6949248bee6ca922fef3fffe4f02d2f7cef65246bcf5e17f2e97a8c3875bf99
MD5 05cd9ae8952a0ab6fc568e4833406123
SHA1 33c9dd42172f58b1a1143aa8b751f38f4b151ded
SHA512 c9c9ea8591915113fcf9c64fb0ffa992d50bea824ca3151eb54d206d9f6a62c495b207c5a7612cc702a83b3d690a8718fcc3ea7c8cc00923d37595c16e99c5e7
SSDEEP 96:nMC0d+VUJ7oKfVHrSJEYvJVHQRDotok5Rd9DRSB6EGyvP/e+0qI+ZPEOLv4a:MC08UR5rYv3eDUD1Ygae+0SZsOP
TLSH
T1BBA11A77A46A8D7BA976C48575422B43CEB5B07BE921AE94E9ED1F0C01E70EC1301623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 4795764cc8dec25e8b71f7a9a5640d1e500f989964ad82576cc4ba4fe3290eca
MD5 0d2d5d4ece7df8b84ea1c327ca3a43fb
SHA1 a0f6e1d28273369119551c5f020ba47a3acd2498
SHA512 3dc20f5341fd5ab05305036c857031c3cfb57a6cf5096b977f0b547fbfe6f1f14034215a83516d2a5ea2e6c6822d49039c5c4662c6f4662b294accf87a08bf8a
SSDEEP 192:Mt08UR5rYvJ5iUzfYYae4ilCcTKHVSPUHhV+:Mt0nYvJ5kU4il9T6Ssr+
TLSH
T17ED118BBB46E9C3759F69495B1036B47CEB5A06FD6506EA4EAE90F0C01D75EC1302223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 cd929facbf0359a8898d6690d0725a04f31d303a922fec89bd643cb353be2a85
MD5 33fdc4acf69607863e2d0d4cfb310184
SHA1 74f0c94afa19c5782c8a39f7427c4f094de21bc2
SHA512 e553f38a216bbd5a5ea103c56e07b73d4ccacec4cb03d00b2135e3059463e4f4c53a55286506bf02afd8e006c3bcb17d9981e91b99b55fc08f9cac15e8d33640
SSDEEP 192:MC08UR5rYvJ5iUzfYYae4ilCcT5HVSPUHhV+:MC0nYvJ5kU4il9TvSsr+
TLSH
T162D119BBB46DDC3759F69495B1036B47CEB5A06FD650AEA4EAE90F0C01D75EC1302123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/708-113-0x00007FFBA7A40000-0x00007FFBA83E4000-memory.dmp

Download

memory/708-125-0x00007FFBA7A40000-0x00007FFBA83E4000-memory.dmp

Download

memory/708-191-0x00007FFBA7A40000-0x00007FFBA83E4000-memory.dmp

Download

memory/708-192-0x00007FFBA7A40000-0x00007FFBA83E4000-memory.dmp

Download

memory/708-195-0x00007FFBA7A40000-0x00007FFBA83E4000-memory.dmp

Download

memory/708-196-0x00007FFBA7A40000-0x00007FFBA83E4000-memory.dmp

Download

memory/708-176-0x00007FFBA7A40000-0x00007FFBA83E4000-memory.dmp

Download

memory/708-175-0x00007FFBA7A40000-0x00007FFBA83E4000-memory.dmp

Download

memory/708-169-0x00007FFBA7A40000-0x00007FFBA83E4000-memory.dmp

Download

memory/708-189-0x00007FFBA7A40000-0x00007FFBA83E4000-memory.dmp

Download

memory/708-236-0x00007FFBA7A40000-0x00007FFBA83E4000-memory.dmp

Download

memory/708-115-0x00007FFBA7A40000-0x00007FFBA83E4000-memory.dmp

Download

memory/708-114-0x00007FFBA7A40000-0x00007FFBA83E4000-memory.dmp

Download

memory/708-112-0x00007FFBA7A40000-0x00007FFBA83E4000-memory.dmp

Download

memory/708-111-0x00007FFBA7A40000-0x00007FFBA83E4000-memory.dmp

Download

memory/708-109-0x00007FFBA7A40000-0x00007FFBA83E4000-memory.dmp

Download

memory/708-108-0x000001ED84C50000-0x000001ED84C72000-memory.dmp

Download

memory/708-105-0x00007FFBA7BCF000-0x00007FFBA7BD0000-memory.dmp

Download