9fb63f6266dfbc7b3cb527d19134c13f51c2c3080c5242756296f2a7a090a200

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 11:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Phantomx.exe
Size 807KB
Sample260805-ncwsysen2t
SHA256 9fb63f6266dfbc7b3cb527d19134c13f51c2c3080c5242756296f2a7a090a200
MD5 8939944d8166c83426cdfe1abea64520
SHA1 eea496d870cfb52b959313edd3278e0682aa9ef0
SHA512 a34f45f02f486817ccc744152521da5fa4e9cb8ec18835bcc63616ad6e8385b9a0ed6d2ee58f81562dafa84fe3ac91fb4d097a15b5c7e78e1b60582131a2cb52
SSDEEP 12288:PNUplz80dKBPWk87r6Cb+Uwmr+5uMiPYd03tPdMLf:PNr+cIUk+Q/EgdMLf
TLSH
T16605AE6A76924E21D24A5372C1C7890087E6964736ABFB0F31C803D719437EEDE4A7DB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection discovery spyware stealer

Malware Config

Signatures

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 33 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	Phantomx.exe
Key opened	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Phantomx.exe
Key queried	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	Phantomx.exe
Key opened	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Phantomx.exe
Key queried	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	Phantomx.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	Phantomx.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Phantomx.exe
Key opened	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Phantomx.exe
Key opened	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Phantomx.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	Phantomx.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Phantomx.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	Phantomx.exe
Key queried	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	Phantomx.exe
Key queried	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Phantomx.exe
Key queried	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Phantomx.exe
Key opened	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Phantomx.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	Phantomx.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Phantomx.exe
Key queried	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Phantomx.exe
Key queried	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	Phantomx.exe
Key queried	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	Phantomx.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Phantomx.exe
Key queried	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Phantomx.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Phantomx.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Phantomx.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Phantomx.exe
Key queried	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	Phantomx.exe
Key queried	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Phantomx.exe
Key queried	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Phantomx.exe
Key opened	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Phantomx.exe
Key opened	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Phantomx.exe
Key queried	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Phantomx.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	Phantomx.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Phantomx.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5552	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2548	Phantomx.exe
2548	Phantomx.exe
2548	Phantomx.exe
2548	Phantomx.exe
2548	Phantomx.exe
2548	Phantomx.exe
2548	Phantomx.exe
2548	Phantomx.exe
2548	Phantomx.exe
2548	Phantomx.exe
2548	Phantomx.exe
2548	Phantomx.exe
2548	Phantomx.exe
2548	Phantomx.exe
2548	Phantomx.exe
2548	Phantomx.exe
2548	Phantomx.exe
2548	Phantomx.exe
2548	Phantomx.exe
2548	Phantomx.exe
2548	Phantomx.exe
2548	Phantomx.exe
2548	Phantomx.exe
2548	Phantomx.exe
2548	Phantomx.exe
2548	Phantomx.exe
2548	Phantomx.exe
2548	Phantomx.exe
2548	Phantomx.exe
2548	Phantomx.exe
2548	Phantomx.exe
2548	Phantomx.exe
2548	Phantomx.exe
2548	Phantomx.exe
2548	Phantomx.exe
2548	Phantomx.exe
2548	Phantomx.exe
3004	chrome.exe
3004	chrome.exe
2548	Phantomx.exe
2548	Phantomx.exe
2548	Phantomx.exe
2548	Phantomx.exe
2548	Phantomx.exe
2548	Phantomx.exe
2548	Phantomx.exe
2548	Phantomx.exe
2548	Phantomx.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
2548	Phantomx.exe
2548	Phantomx.exe
2548	Phantomx.exe
1568	chrome.exe
2548	Phantomx.exe
2548	Phantomx.exe
2548	Phantomx.exe
2548	Phantomx.exe
2548	Phantomx.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2548	Phantomx.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeDebugPrivilege	1568	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3004	chrome.exe
3004	chrome.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 3004	2548	Phantomx.exe	90
PID 3004 wrote to memory of 2848	3004	chrome.exe	91
PID 3004 wrote to memory of 1568	3004	chrome.exe	92
PID 3004 wrote to memory of 5552	3004	chrome.exe	93
PID 3004 wrote to memory of 4728	3004	chrome.exe	94
PID 3004 wrote to memory of 2888	3004	chrome.exe	95
PID 3004 wrote to memory of 5464	3004	chrome.exe	96
PID 3004 wrote to memory of 4600	3004	chrome.exe	97
PID 3004 wrote to memory of 1600	3004	chrome.exe	98
PID 3004 wrote to memory of 2676	3004	chrome.exe	99
PID 3004 wrote to memory of 1752	3004	chrome.exe	100
PID 3004 wrote to memory of 2276	3004	chrome.exe	101
PID 2548 wrote to memory of 1568	2548	Phantomx.exe	92
PID 2548 wrote to memory of 1568	2548	Phantomx.exe	92

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Phantomx.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Phantomx.exe

C:\Users\Admin\AppData\Local\Temp\Phantomx.exe
"C:\Users\Admin\AppData\Local\Temp\Phantomx.exe"
1⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:2548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pmlieced.1pk"
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3004
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\pmlieced.1pk /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\pmlieced.1pk\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\pmlieced.1pk --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffb77dbc728,0x7ffb77dbc734,0x7ffb77dbc740
    3⤵
    PID:2848
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pmlieced.1pk" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1604,i,3869110635784467027,13176466780589539448,262144 --field-trial-handle=1988,i,3949072054977846262,4687274884006811579,262144 --variations-seed-version --mojo-platform-channel-handle=1984 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1568
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pmlieced.1pk" --force-high-res-timeticks=disabled --metrics-shmem-handle=1892,i,13320999723898316425,645681829759805271,524288 --field-trial-handle=1988,i,3949072054977846262,4687274884006811579,262144 --variations-seed-version --mojo-platform-channel-handle=1992 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5552
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pmlieced.1pk" --force-high-res-timeticks=disabled --metrics-shmem-handle=2108,i,413223901429805119,12865449071430577884,524288 --field-trial-handle=1988,i,3949072054977846262,4687274884006811579,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:13
    3⤵
    PID:4728
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pmlieced.1pk" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2872,i,9343821381211892252,17838665045211182155,2097152 --field-trial-handle=1988,i,3949072054977846262,4687274884006811579,262144 --variations-seed-version --mojo-platform-channel-handle=2924 /prefetch:1
    3⤵
    PID:2888
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pmlieced.1pk" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2928,i,10136398028322297586,11327349837454497074,2097152 --field-trial-handle=1988,i,3949072054977846262,4687274884006811579,262144 --variations-seed-version --mojo-platform-channel-handle=3024 /prefetch:1
    3⤵
    PID:5464
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pmlieced.1pk" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3232,i,14360430918151486703,4951405714577862528,2097152 --field-trial-handle=1988,i,3949072054977846262,4687274884006811579,262144 --variations-seed-version --mojo-platform-channel-handle=3364 /prefetch:1
    3⤵
    PID:4600
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pmlieced.1pk" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3252,i,16064677245869816610,16831158447739167382,2097152 --field-trial-handle=1988,i,3949072054977846262,4687274884006811579,262144 --variations-seed-version --mojo-platform-channel-handle=3348 /prefetch:9
    3⤵
    PID:1600
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pmlieced.1pk" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3728,i,14806501616610605183,9824915288722872882,2097152 --field-trial-handle=1988,i,3949072054977846262,4687274884006811579,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:9
    3⤵
    PID:2676
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pmlieced.1pk" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4260,i,16996844756082055227,15290055880862098211,2097152 --field-trial-handle=1988,i,3949072054977846262,4687274884006811579,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
    3⤵
    PID:1752
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pmlieced.1pk" --force-high-res-timeticks=disabled --metrics-shmem-handle=4368,i,6847465901157999574,6986472842328237745,524288 --field-trial-handle=1988,i,3949072054977846262,4687274884006811579,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:14
    3⤵
    PID:2276

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\pmlieced.1pk\Crashpad\settings.dat
Size 40B
SHA256 1e63842e0128167037562f0afdfcd59e09fb29d7a515adca02bcc43d43f3aeb1
MD5 fde19b2483cc10403549059e6a4bf496
SHA1 7c8febd8f893d499854bbc78f924cc580713f8a6
SHA512 f4352bfdc5933116e9f79781ee2998eabe3d7a8ec9b18e2a1cf3c2daae2e07af6e2d110d7cf5eb31c16bdca28f8735d62442d6896357f7ac542674df2b2e8c46
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\pmlieced.1pk\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 17195822c92949975b3858f8cf8a5606930c63c0875b53e65809f0c9615256a9
MD5 07f7958c4894f53a3166c7207f60620b
SHA1 9ba6f63b70f3c950812ae22e924d97cc8206e213
SHA512 0db5a2f670a0c873d1b2062ce7850603beadb97cd51426ce5647d8295f2b505210477f5dd570d1c65c39a64be137d752c72db10e1476375477ae22337011e5d5
SSDEEP 6:/FoEXEMZkNY9JFnxywEyS8h5ulv9NEsCnjmp3+Pl6/:d7XzaNY9JLyxySAuVMQ3+P
TLSH
T18213123FC5485E22C27C203BA08FEB794B70C41286A3851382B02050F515B57204AE85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\pmlieced.1pk\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 d49c3f1738d33651f8a7e30695393d90d861b7125f6b575eba7c228bd6fb1b67
MD5 0ec0db7def500c4249476ea13ef1a6b6
SHA1 176c5245ab37131ca6d25573a25618cde02426b7
SHA512 3371c7aa926d58a37b895ae469b035a42523378d71812db074f43fb2d521c6700429b7be5cdc15eda3bcf8bb634f702df0f4b78bb7a52d1ad73faacb02e9827a
SSDEEP 24:plkqCcLO1SsPBY6kf2lk3z/mizblQZniqinw6M1CwNO/sXHEwUml5WMmCwNX:pl9ESs5YNP3zlblQCM1XgUXTUSsMmXJ
TLSH
T1034444FB1905DACAEB2CCEF15D51513CDE33A1162CAAACBBF62900B252509E730385A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\pmlieced.1pk\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 9947159ba0ee3bd03be482d5f6964387d258839aeb2ac4a39c34edcd142b1546
MD5 3aabb2cad54cb5cae81bb1d77de30d95
SHA1 ee847689d9cc0b6045fd11bed003590096582f18
SHA512 a435bf8f2d3b27f57100fdbadccce613be173455eb98e04f9523a5e2ce3fdb6fce30404ad701b6fa2196a53c835ec9822067ae907e26261895af7fe02d3787fb
SSDEEP 768:mfDPLSgcRUv+24ZUfDPLSgcRUv+I42UfDPLSgcRUv+T4vUfDPLSgcRUv+D4:WhJ8
TLSH
T114161BB64E647947D781EAB0BBC8DE183CB122CDEC925C92F52252695BD0FC41BC521E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\pmlieced.1pk\Default\Cache\Cache_Data\f_000001
Size 38KB
SHA256 51ff4b2c4dd15581fdf440abdd8d02933f4b61f360b20b03af6fb8a58a1f5f24
MD5 4c676c9953880b6120ac2cafc2a91432
SHA1 b77787fc4195f22262caf74370d48ee0492c3668
SHA512 40187029189001f00f9fdfecbb9453bc095b4a6257ecceb2f1e0d17f8fe6388be30119ea3b11e855814702cfe69f57a73b3a39b8ea11bf44471ee4a46f3da0c1
SSDEEP 768:+kpHfe4R24QXgQST62j3vFhXRI1HWW/FgpcfraBf5Ca75+YuOIGi2Dm:dpHL2jXZSTdj/FhXRE2WCqOBf5fuOVm
TLSH
T15D03F2A0A369B036E684FB9CC541302972509BBDFE9A171B4EF08DD73163F55D229C62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\pmlieced.1pk\Default\Cache\Cache_Data\index
Size 256KB
SHA256 faa669493a05f29bbd9a05e69c70d6a5d446a7b8c252fd4dc7b714b366365ef5
MD5 1e9c5d87b4b3f87997c3871f8c6cc141
SHA1 b6a2b0480d0d31958a12e4e0ab3f577a23041138
SHA512 2c95c6b5d5b65c24c60d5a6ce34fc165c3342f83ef92d1c6e12e74a0a5f3d723d06c6bd8a16c3cc54c0f7faa50a755ce762b2a173a6099edf2e2d30e6875bde3
SSDEEP 3:LsLllfltlNllklkXluGSllx/ncNtlNlXl3Nl/lOll//5Ntl5llll/gl:LsRt13lPsgNt0ltBtlll
TLSH
T19144016EA3996F15C6E402FEC443CBA453B5C846DE8E8743AB0476202CC1B906E0F1A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\pmlieced.1pk\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 92b1acb8ac65e79bd3a06f8a2345e82d6be771aa3d6957cac4fc7f14fe5cadde
MD5 860231c4b79ef1cf6b79a24f08e4bd4b
SHA1 4d1246a5acf76becb7d3aad900bd7ad53c094a6a
SHA512 133cb82e4889b580803c2ee5365dd8bce379edb361fdb7b97f6bd49951dffd2565db491054bcaf61edcc864d6affd3be04ee6c9aaff2e17316508e72879f0478
TLSH
T14FE02B91C74C4F0DD32D96F7CEB643494B0E92C42ABE7603A880C2C233125341288123
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\pmlieced.1pk\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 22b631d45dea9084348aa230c271bbd0f8df8cac87553f2f1c62ca9a93043668
MD5 c029ca10d103e807ba0d24eed90c40df
SHA1 3ef98989b3f1c077d8d581f14d90a3c2e3062bc5
SHA512 f18daeac1660a5b3b039daa88a891878ebf7c76efe8fc38c088263752e8637ef0fd33eccc4a4f03eb0484a68e8fa3324ad0186b6e00fee8f2802f4f7ca8b2578
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\pmlieced.1pk\Default\DawnGraphiteCache\index
Size 256KB
SHA256 75d36cd27de86f22551834c78c30de8ea8798dae2c309c527cc9619778a07084
MD5 bb8af133a995efad30ac03653efe1a8c
SHA1 99a828e99d92e790646e7ea316670877cf1365ad
SHA512 8f99ea5d63a404932c2835c3ff8d0c648452c3f1989ac9bc749d1881272966bed7bac178b176cc3bd87a943f673041f8936e6146cc9499730a5c3e952a112cfb
SSDEEP 3:LstlNllklkXluI6+:LsX3lPuI
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\pmlieced.1pk\Default\DawnWebGPUCache\index
Size 256KB
SHA256 3bce467dc7fa4f88719623242e8d0c873d57b664d5b5dec7f90260c382d4e138
MD5 c5586dc944d11c177c6375c9c070b26e
SHA1 5107953b25db8c4a589fdac54877173edd7f9a66
SHA512 ffd10cf30e732e0cbadceb6f357e26cac694137ca7c225b4f9f134b6405a27cf79300132db74332d689b82a28ee58ffb69ab50a8d4c4c7e77ee09e741c681919
SSDEEP 3:LstlNllklkXlnET:LsX3lP
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\pmlieced.1pk\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\pmlieced.1pk\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\pmlieced.1pk\Default\GPUCache\index
Size 256KB
SHA256 73dff7724f7bdd2c320603a1c16e2489cc7e14f113e70652e8ff35089d342563
MD5 f189c6c37958176746563c7843a47cc9
SHA1 eed7c241dbe4df4de058b3bbc687a655317788cf
SHA512 f446d9153d0164d49c42fa22cb6b764c19811872c95c44519ad25aea1471ff28a8ad6c6896093ae0bca542d9dabdbaa1cd5caa78952598961021ac47347eae51
SSDEEP 3:LstlNllklkXlzfKll:LsX3lPja
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\pmlieced.1pk\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

README

Path C:\Users\Admin\AppData\Local\Temp\pmlieced.1pk\Default\README
Size 180B
SHA256 c43668eec4a8d88a5b3a06a84f8846853fe33e54293c2db56899a5a5dfb4d944
MD5 883d62acd72005f3ad7a14500d482033
SHA1 e5900fe43fb18083bf6a483b926b9888f29ca018
SHA512 97bb1bde74057761788436de519765ea4e6ba1ad3a02d082704e8b3efca3ef69d3db6e65b65e5f5f90205e72c164d82779cf754d52ec05d944df49f10d822a6d
TLSH
T13CC01222958335AD511A81B2690162824A128831E42E9A61A6DE844C1704A63A2507DB
MD5 SHA1 SHA512 TLSH

Submit Download

2cc80dabc69f58b6_0

Path C:\Users\Admin\AppData\Local\Temp\pmlieced.1pk\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0
Size 472B
SHA256 7433e2de592bac3d53e34206cd580d140d107eae0defa146b238d209d3b34c87
MD5 d1d6b5a71725264ad4893180b3baa615
SHA1 d1c1cef579f3a8b1d517c2171d6aa37390634fc3
SHA512 6f50f6f08b9c5fc7fdb614ee423f14cf2b2407c2488d7b5a0cfe8a497174ae194d4f564bda132d3180963213e24fa8bb6b25c158a5ac8734d2a73bc87f2068a1
TLSH
T1C2F0A3560D498974D71845F2CBD7735D87172628D93E5255B954821CD494F6CC8909C2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\pmlieced.1pk\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 48B
SHA256 2fb1b477e7dcaa29416da703166a41c413da4e50cc842c305d9d5c21fa031085
MD5 a4ca7f74976ffc8950601cf25d50a342
SHA1 03643f4fa6cfc418fd61e32186750395d589bd24
SHA512 d30a4962f421ce8ec8bcd151623ba6905048884f03eb58bc1d2a5e55150ba364a937c53459ef6fc94ab7443d6fccf0ae1907539bd3d656d812c9ea011a5caa81
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\pmlieced.1pk\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\pmlieced.1pk\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 dbeeb188c48c1f1ae82932cd21b7de60e7e6a696aee74926d3526336d25c4afb
MD5 e8b0bdc189c1a7a9488eb76f9d3a679e
SHA1 8e5111fc2def594a63145151d28097c886daa242
SHA512 bbf2a4cd617f46f7e1269d095a8fa00f3e98512c405f85d003894512d4797353fd952778aaaec3b1cc9a50ea4805ce5db83af1817bafb2d1f42e1f7666bb8b9d
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\pmlieced.1pk\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\pmlieced.1pk\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\pmlieced.1pk\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\pmlieced.1pk\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\pmlieced.1pk\GrShaderCache\index
Size 256KB
SHA256 36c23c9a01f593068d91f5b81c8cac5bf0438b6b4cbcbe4a7276965b4c5613c8
MD5 336cbc2f76cea6796f2bbe4dfaec27ce
SHA1 7ed41824194a5ddfdd8066423d32279289f316d9
SHA512 f6fefa8b1680e44fad59d2a333161e5c55243e1c86cc7ad43c32758de4ee1a45dced880ef0d6e7e2b210c712c15628cd9026e9a8f96d01434817df4d4a1f2af5
SSDEEP 3:LstlNllklkXloI6:LsX3lPo
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\pmlieced.1pk\GraphiteDawnCache\index
Size 256KB
SHA256 8e4c46c0f16730350695a747823d59a97cf49a6651ef6f2228baa87b87088d46
MD5 c36ca75a9b1ba95f1bf7eff6990ee17f
SHA1 192676c621bc85d2a74c1f9298a0876bd837845b
SHA512 3ef55e2cedbb147e2fce84d2846cbb3a93adf6dcdf4dfeeda16abe70af5b7155e022ba7ad8bf1b4b08f0e842d577fce6a73fea08f40a92944736905017b4405a
SSDEEP 3:LstlNllklkXlj5:LsX3lP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Temp\pmlieced.1pk\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\pmlieced.1pk\Local State
Size 1KB
SHA256 c66953a5c7598b84fcd87899a86453b17c3d37ae1a54d0852b72570b66ade6c0
MD5 a0702077da8fefa252763031da067e93
SHA1 d90e47b3e423932d3e3ac9ca58576965eb08d990
SHA512 e74f19f5b7f428da116db727ca2b8b8dc9e56baa687cae4672f5edf7caf9fd43d6262f8c60a3e63fcc37c6a7d191286d5bad035c91f78c6936b8c564c18f755c
TLSH
T18D1175B0342477B53481890DD914A6939E71633BE917494C2FCD36E42AF6BAD220393C
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1568-138-0x000001787A910000-0x000001787AA02000-memory.dmp

Download

memory/2548-140-0x00000000749D0000-0x000000007518C000-memory.dmp

Download

memory/2548-150-0x00000000749D0000-0x000000007518C000-memory.dmp

Download

memory/2548-0-0x00000000749E2000-0x00000000749E3000-memory.dmp

Download

memory/2548-139-0x00000000749D0000-0x000000007518C000-memory.dmp

Download

memory/2548-107-0x00000000749D0000-0x000000007518C000-memory.dmp

Download

memory/2548-13-0x00000000749D0000-0x000000007518C000-memory.dmp

Download

memory/2548-12-0x00000000749E2000-0x00000000749E3000-memory.dmp

Download

memory/2548-207-0x00000000074A0000-0x00000000074B2000-memory.dmp

Download

memory/2548-11-0x00000000077E0000-0x0000000007830000-memory.dmp

Download

memory/2548-10-0x0000000007540000-0x00000000075D2000-memory.dmp

Download

memory/2548-9-0x0000000007A60000-0x000000000801A000-memory.dmp

Download

memory/2548-8-0x0000000007330000-0x0000000007396000-memory.dmp

Download

memory/2548-7-0x0000000007250000-0x0000000007282000-memory.dmp

Download

memory/2548-6-0x0000000006DE0000-0x0000000006ED2000-memory.dmp

Download

memory/2548-5-0x0000000005810000-0x000000000585C000-memory.dmp

Download

memory/2548-4-0x00000000058B0000-0x0000000005988000-memory.dmp

Download

memory/2548-3-0x0000000005540000-0x00000000055BC000-memory.dmp

Download

memory/2548-2-0x00000000749D0000-0x000000007518C000-memory.dmp

Download

memory/2548-1-0x0000000000820000-0x00000000008F0000-memory.dmp

Download

memory/2548-208-0x00000000749D0000-0x000000007518C000-memory.dmp

Download