71e70a95591741d64cdc93dfb21a31ab0b83252f2ecf75bb0e8a4d72310928e2

Analysis

user interaction
yes
max time kernel
151s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 02:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
V6OficialVersion.exe
Size 68.8MB
Sample260910-cx8gpstgmf
SHA256 71e70a95591741d64cdc93dfb21a31ab0b83252f2ecf75bb0e8a4d72310928e2
MD5 d58e6a36a8e6363cb07eadeb928592a7
SHA1 9ca0e9c576db23685a4489fa53882fd95ab8ffc2
SHA512 7414ef52374455772bf1c733acbfd2fdaf7589388cbec97556f8a044c70728363ca90f799199647856fc456af176b0d9f2cd0a60882b2aa86fbaceb1cf990454
SSDEEP 786432:A9d6t8g9QlR/Xnb8gP1MIxk9hPHCnYP7jGMYViVysmn4/SDhLm9MRpmPsM:A9duMRfnpaIxkPgYP7jsVGQXDhLCM/tM
TLSH
T18CF7DF0773E501A9E577E138CAAB9203E7B2B4161330D7DB329C03652F67AE45E7A760
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

credential_access discovery execution spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2704	powershell.exe

Uses browser remote debugging 2 TTPs 3 IoCs

Can be used to control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
2952	chrome.exe
488	chrome.exe
2600	chrome.exe

Loads dropped DLL 3 IoCs

pid	Process
5140	V6OficialVersion.exe
5140	V6OficialVersion.exe
5140	V6OficialVersion.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5668	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4636	chrome.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	V6OficialVersion.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	V6OficialVersion.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	V6OficialVersion.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	V6OficialVersion.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	V6OficialVersion.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	V6OficialVersion.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	V6OficialVersion.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	V6OficialVersion.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	V6OficialVersion.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	V6OficialVersion.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	V6OficialVersion.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	V6OficialVersion.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	V6OficialVersion.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	V6OficialVersion.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	V6OficialVersion.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	V6OficialVersion.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	V6OficialVersion.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	V6OficialVersion.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	V6OficialVersion.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	V6OficialVersion.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	V6OficialVersion.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	V6OficialVersion.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	V6OficialVersion.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	V6OficialVersion.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134334811182081218"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
5140	V6OficialVersion.exe
5140	V6OficialVersion.exe
5140	V6OficialVersion.exe
5140	V6OficialVersion.exe
2704	powershell.exe
2704	powershell.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2704	powershell.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe
Token: SeCreatePagefilePrivilege	2952	chrome.exe
Token: SeShutdownPrivilege	2952	chrome.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2952	chrome.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 5140 wrote to memory of 5668	5140	V6OficialVersion.exe	90
PID 5668 wrote to memory of 2704	5668	cmd.exe	91
PID 5140 wrote to memory of 2952	5140	V6OficialVersion.exe	93
PID 2952 wrote to memory of 5632	2952	chrome.exe	94
PID 2952 wrote to memory of 3400	2952	chrome.exe	95
PID 2952 wrote to memory of 4636	2952	chrome.exe	96
PID 2952 wrote to memory of 3128	2952	chrome.exe	97
PID 2952 wrote to memory of 2600	2952	chrome.exe	99
PID 2952 wrote to memory of 488	2952	chrome.exe	100
PID 2952 wrote to memory of 3908	2952	chrome.exe	101
PID 2952 wrote to memory of 5440	2952	chrome.exe	106
PID 2952 wrote to memory of 1788	2952	chrome.exe	107
PID 2952 wrote to memory of 4428	2952	chrome.exe	108

C:\Users\Admin\AppData\Local\Temp\V6OficialVersion.exe
"C:\Users\Admin\AppData\Local\Temp\V6OficialVersion.exe"
1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.MessageBox]::Show('Ocorreu um erro no sistema!', 'Erro', [System.Windows.Forms.MessageBoxButtons]::OK, [System.Windows.Forms.MessageBoxIcon]::Error)""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5668
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.MessageBox]::Show('Ocorreu um erro no sistema!', 'Erro', [System.Windows.Forms.MessageBoxButtons]::OK, [System.Windows.Forms.MessageBoxIcon]::Error)"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-field-trial-config --disable-background-networking --disable-background-timer-throttling --disable-backgrounding-occluded-windows --disable-back-forward-cache --disable-breakpad --disable-client-side-phishing-detection --disable-component-extensions-with-background-pages --disable-component-update --no-default-browser-check --disable-default-apps --disable-dev-shm-usage --disable-extensions --disable-features=AvoidUnnecessaryBeforeUnloadCheckSync,BoundaryEventDispatchTracksNodeRemoval,DestroyProfileOnBrowserClose,DialMediaRouteProvider,GlobalMediaControls,HttpsUpgrades,LensOverlay,MediaRouter,PaintHolding,ThirdPartyStoragePartitioning,Translate,AutoDeElevate,RenderDocument,OptimizationHints --enable-features=CDPScreenshotNewSurface --allow-pre-commit-input --disable-hang-monitor --disable-ipc-flooding-protection --disable-popup-blocking --disable-prompt-on-repost --disable-renderer-backgrounding --force-color-profile=srgb --metrics-recording-only --no-first-run --password-store=basic --use-mock-keychain --no-service-autorun --export-tagged-pdf --disable-search-engine-choice-screen --unsafely-disable-devtools-self-xss-warnings --edge-skip-compat-layer-relaunch --enable-automation --disable-infobars --disable-search-engine-choice-screen --disable-sync --enable-unsafe-swiftshader --headless --hide-scrollbars --mute-audio --blink-settings=primaryHoverType=2,availableHoverTypes=2,primaryPointerType=4,availablePointerTypes=4 --no-sandbox --remote-debugging-port=5555 --profile-directory=Default --disable-gpu --disable-software-rasterizer --disable-dev-shm-usage --disable-accelerated-2d-canvas --no-sandbox --disable-setuid-sandbox --disable-extensions --disable-component-extensions-with-background-pages --disable-default-apps --mute-audio --no-zygote --disable-backgrounding-occluded-windows --memory-pressure-off --force-low-power-gpu "--user-data-dir=C:/Users/Admin/AppData/Local/Google/Chrome/User Data" --remote-debugging-pipe about:blank
  2⤵
  - Uses browser remote debugging
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2952
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffc6487c728,0x7ffc6487c734,0x7ffc6487c740
    3⤵
    PID:5632
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --disable-breakpad --headless --enable-unsafe-swiftshader --noerrdialogs --user-data-dir="C:/Users/Admin/AppData/Local/Google/Chrome/User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAQAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --field-trial-handle=1824,i,2759992459455433313,1230192993343962395,262144 --enable-features=CDPScreenshotNewSurface --disable-features=AutoDeElevate,AvoidUnnecessaryBeforeUnloadCheckSync,BoundaryEventDispatchTracksNodeRemoval,DestroyProfileOnBrowserClose,DialMediaRouteProvider,GlobalMediaControls,HttpsUpgrades,LensOverlay,MediaRouter,OptimizationHints,PaintHolding,RenderDocument,ThirdPartyStoragePartitioning,Translate --variations-seed-version --mojo-platform-channel-handle=1488 /prefetch:2
    3⤵
    PID:3400
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --noerrdialogs --user-data-dir="C:/Users/Admin/AppData/Local/Google/Chrome/User Data" --force-high-res-timeticks=disabled --field-trial-handle=1824,i,2759992459455433313,1230192993343962395,262144 --enable-features=CDPScreenshotNewSurface --disable-features=AutoDeElevate,AvoidUnnecessaryBeforeUnloadCheckSync,BoundaryEventDispatchTracksNodeRemoval,DestroyProfileOnBrowserClose,DialMediaRouteProvider,GlobalMediaControls,HttpsUpgrades,LensOverlay,MediaRouter,OptimizationHints,PaintHolding,RenderDocument,ThirdPartyStoragePartitioning,Translate --variations-seed-version --mojo-platform-channel-handle=1904 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4636
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --noerrdialogs --user-data-dir="C:/Users/Admin/AppData/Local/Google/Chrome/User Data" --force-high-res-timeticks=disabled --field-trial-handle=1824,i,2759992459455433313,1230192993343962395,262144 --enable-features=CDPScreenshotNewSurface --disable-features=AutoDeElevate,AvoidUnnecessaryBeforeUnloadCheckSync,BoundaryEventDispatchTracksNodeRemoval,DestroyProfileOnBrowserClose,DialMediaRouteProvider,GlobalMediaControls,HttpsUpgrades,LensOverlay,MediaRouter,OptimizationHints,PaintHolding,RenderDocument,ThirdPartyStoragePartitioning,Translate --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:13
    3⤵
    PID:3128
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:/Users/Admin/AppData/Local/Google/Chrome/User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-back-forward-cache --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --no-zygote --remote-debugging-pipe --remote-debugging-port=5555 --allow-pre-commit-input --blink-settings=primaryHoverType=2,availableHoverTypes=2,primaryPointerType=4,availablePointerTypes=4 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1824,i,2759992459455433313,1230192993343962395,262144 --enable-features=CDPScreenshotNewSurface --disable-features=AutoDeElevate,AvoidUnnecessaryBeforeUnloadCheckSync,BoundaryEventDispatchTracksNodeRemoval,DestroyProfileOnBrowserClose,DialMediaRouteProvider,GlobalMediaControls,HttpsUpgrades,LensOverlay,MediaRouter,OptimizationHints,PaintHolding,RenderDocument,ThirdPartyStoragePartitioning,Translate --variations-seed-version --mojo-platform-channel-handle=2784 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2600
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:/Users/Admin/AppData/Local/Google/Chrome/User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-back-forward-cache --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --no-zygote --remote-debugging-pipe --remote-debugging-port=5555 --allow-pre-commit-input --blink-settings=primaryHoverType=2,availableHoverTypes=2,primaryPointerType=4,availablePointerTypes=4 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1824,i,2759992459455433313,1230192993343962395,262144 --enable-features=CDPScreenshotNewSurface --disable-features=AutoDeElevate,AvoidUnnecessaryBeforeUnloadCheckSync,BoundaryEventDispatchTracksNodeRemoval,DestroyProfileOnBrowserClose,DialMediaRouteProvider,GlobalMediaControls,HttpsUpgrades,LensOverlay,MediaRouter,OptimizationHints,PaintHolding,RenderDocument,ThirdPartyStoragePartitioning,Translate --variations-seed-version --mojo-platform-channel-handle=2796 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:488
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --noerrdialogs --user-data-dir="C:/Users/Admin/AppData/Local/Google/Chrome/User Data" --force-high-res-timeticks=disabled --field-trial-handle=1824,i,2759992459455433313,1230192993343962395,262144 --enable-features=CDPScreenshotNewSurface --disable-features=AutoDeElevate,AvoidUnnecessaryBeforeUnloadCheckSync,BoundaryEventDispatchTracksNodeRemoval,DestroyProfileOnBrowserClose,DialMediaRouteProvider,GlobalMediaControls,HttpsUpgrades,LensOverlay,MediaRouter,OptimizationHints,PaintHolding,RenderDocument,ThirdPartyStoragePartitioning,Translate --variations-seed-version --mojo-platform-channel-handle=4112 /prefetch:14
    3⤵
    PID:3908
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --noerrdialogs --user-data-dir="C:/Users/Admin/AppData/Local/Google/Chrome/User Data" --force-high-res-timeticks=disabled --field-trial-handle=1824,i,2759992459455433313,1230192993343962395,262144 --enable-features=CDPScreenshotNewSurface --disable-features=AutoDeElevate,AvoidUnnecessaryBeforeUnloadCheckSync,BoundaryEventDispatchTracksNodeRemoval,DestroyProfileOnBrowserClose,DialMediaRouteProvider,GlobalMediaControls,HttpsUpgrades,LensOverlay,MediaRouter,OptimizationHints,PaintHolding,RenderDocument,ThirdPartyStoragePartitioning,Translate --variations-seed-version --mojo-platform-channel-handle=260 /prefetch:14
    3⤵
    PID:5440
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --noerrdialogs --user-data-dir="C:/Users/Admin/AppData/Local/Google/Chrome/User Data" --force-high-res-timeticks=disabled --field-trial-handle=1824,i,2759992459455433313,1230192993343962395,262144 --enable-features=CDPScreenshotNewSurface --disable-features=AutoDeElevate,AvoidUnnecessaryBeforeUnloadCheckSync,BoundaryEventDispatchTracksNodeRemoval,DestroyProfileOnBrowserClose,DialMediaRouteProvider,GlobalMediaControls,HttpsUpgrades,LensOverlay,MediaRouter,OptimizationHints,PaintHolding,RenderDocument,ThirdPartyStoragePartitioning,Translate --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:14
    3⤵
    PID:1788
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --noerrdialogs --user-data-dir="C:/Users/Admin/AppData/Local/Google/Chrome/User Data" --force-high-res-timeticks=disabled --field-trial-handle=1824,i,2759992459455433313,1230192993343962395,262144 --enable-features=CDPScreenshotNewSurface --disable-features=AutoDeElevate,AvoidUnnecessaryBeforeUnloadCheckSync,BoundaryEventDispatchTracksNodeRemoval,DestroyProfileOnBrowserClose,DialMediaRouteProvider,GlobalMediaControls,HttpsUpgrades,LensOverlay,MediaRouter,OptimizationHints,PaintHolding,RenderDocument,ThirdPartyStoragePartitioning,Translate --variations-seed-version --mojo-platform-channel-handle=4620 /prefetch:14
    3⤵
    PID:4428

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3652

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1996

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dpapi.node

Path C:\Users\Admin\.cache\pkg\7c97d3a751ddcfa2b5503a6a8952009d024acd27505472048d75e01e311f2c5a\@primno\dpapi\build\Release\dpapi.node
Size 133KB
SHA256 7c97d3a751ddcfa2b5503a6a8952009d024acd27505472048d75e01e311f2c5a
MD5 deac691f8f6d26789fb71f5867865700
SHA1 c0ab610b47b09b42c0d2f7a202d6a9fdedfd1e50
SHA512 2d3abc1564034e804eb614ef86b56e0d133d113488c7f45b6531f5cc711db8aa36631c056d94dd2b2f275dc99acca001261fefa8f9a34940cebaa2ad44d56270
SSDEEP 3072:9Xbs12OIS8X759w1pltgyC7ybxMMb+ZmPXrqA:ynIS8X75mJtUybeMX2A
TLSH
T102D35C57B3A440BBE0B7C27885970A45D3B2B8254B31ABEF07A4465A1F137E0DD3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

koffi.node

Path C:\Users\Admin\.cache\pkg\a6caa84c1f8c459215a783318b818d3fa1b260d2d821c22c22864cd2af216490\koffi\build\koffi\win32_x64\koffi.node
Size 2.3MB
SHA256 a6caa84c1f8c459215a783318b818d3fa1b260d2d821c22c22864cd2af216490
MD5 ebe3666be392b02383d411e846317b76
SHA1 69a87af1f3e7175ef6f681f419d0d18f35038195
SHA512 b473fd70c1b874a8b400283110de077dde62cd3bc5dc7a50334f1b62b3c1d5e07e8a3aee63db14b12aa5f7c3ff495cf21411ff61c6433462698eec743c9a1ff4
SSDEEP 24576:QIURRJEkuyU3d7pJP2JJ4Gvop6geUTnefOE:QIURJETyUN7ph2JKwFJ
TLSH
T125B5DE064758C8E9D83EB072B4176776E56A221B083D62DF04F48D61082ABFD5DAFFC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

better_sqlite3.node

Path C:\Users\Admin\.cache\pkg\d895a929771b5ff67e65f07840b6257b31bc1597ee0c28f34c3406aecabbf993\better-sqlite3\build\Release\better_sqlite3.node
Size 1.8MB
SHA256 d895a929771b5ff67e65f07840b6257b31bc1597ee0c28f34c3406aecabbf993
MD5 e02e71bb676ffd73f4df01fdbbea1c34
SHA1 d27d951bdb6c47670fb05a0793dc06bf4655cf7b
SHA512 4a1700e67b2de91846a621ff18ebf8e0e5796522b052613a9fa3c575e370a303bb430783ad6996749fd8edfc0b1dc7e81d9842a97a6870dc1906a715d49e5ba0
SSDEEP 49152:KgyH7PyMsVvMiKG472nzEB/JHtUnk8p/SysLALVjd:5yH7PyfZwWrn
TLSH
T1E3958C4BE2B400FDC167C079860B560BEB76B41527745BEB1690CA696F23FE217BE324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

39fcca77-4966-480c-bd47-3effe5e34e89.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\39fcca77-4966-480c-bd47-3effe5e34e89.tmp
Size 12KB
SHA256 ec5a64f531e55f0fb519923a934575c01eb50fa80e6e94c7a593b6629cf8b6e4
MD5 4bada95bbb76dbe7dd9e83dd29b95ef4
SHA1 f8ba6cae70a349ea0b9409eab04026649d4d5ed5
SHA512 0dc6aa065b4b502e3b83db2a5f6e055d81d47be9e9d02419c1fda487cb3a892e8bd84738130b724389fc71ae46d1bead4d1cafd06faed98b2149be7f7194c731
SSDEEP 192:3Ri5qgL+Dv7Yv6PRpQW9SHsb+WNnH04P2tTaCeUcFVyIsnAUgY:3Ri5P+70UX3EwvP8atRzY
TLSH
T11942B62EB910693B6DD7C729F9257B53D6F6102225902F84E7FC892C25E76CC6227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 71da8e7e9a0625d1d9ec95e91fbde2033011cad258eebfab9aa5e877e6d3f143
MD5 72f08f0f158bb4c83a84afb014da7840
SHA1 2e5759ba93805270587d88bdc4d56413ea6dc3b0
SHA512 551b143f890e8ee45bec0d4efe7bc7922c9840d7900778cf7ca3ae33a18186e0effd2a2ab88dada50cb1ab9cea3af0492afe9c326ded908b72a758aa880ce888
TLSH
T141318BF783A4857E8A1192E4EB11AF1FCE7E0624031C386688D46E2B83E2872D11479F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 79462d417f5c759eae94ff0a88672a5446412b8b7520e78172de7427c8447988
MD5 115f183330bef6ad5509596ec9915672
SHA1 c98c02ad228a3caa8576110fd06cb7c0e124ef44
SHA512 3474f67c4681f3bf8fba5f64a5d3d0427719c8809af37d8f4af165bc14b9cbfcb40f4726572938aafc256d287d624e75530632fc96db4214b862f254f780d148
SSDEEP 192:3Ri5qgL+9v7YvAPRp2W9SHsb+WNnH04P2NtTaCeUc9VyIsnAUgG:3Ri5P+906XFEwvP23atRLG
TLSH
T19A32B62EB910693B6CDBC329FA257B53D6F6102225942EC4E7FC892C25D36CC622B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 10fe5935b5b11ef94a1608dd64d504bdfdb2b0d82e02aa051f857b3ecc0b3f6f
MD5 1d7d6da630b53fe370e5504a79db300a
SHA1 82bf3781be82c774ca8ab38f817be6e4a0ce67d6
SHA512 49adea7c7ed2eac6fd269874283effde9542306458a65a9792414faa4aa7714c33c982a43e97c57282b56dbc26f45d7a2b5c44db98f925c5b83d0c522a81cf47
SSDEEP 192:3Ri5qgL+8v7YvAPRp2W9SHsb+WNnH04PttTaCeUchVyIsnAUgY:3Ri5P+o06XFEwvPXatRHY
TLSH
T1FB32B72EB910693B6DDBC329FA257B53D7F6102225942F84E7FC892C25E76CC6227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 4c47278084b7e101de6067922965a67f24611ec38b438ff45c72cebc59f71413
MD5 7600618f86b6f03725a6a6344ea7c173
SHA1 0642e2220a3106a3532dc4bf96e37eb7b232b853
SHA512 5e2fc61072d43020f4e8c388c7c3d4f80823091ad3000771a8aa01600df53a93cba56512473a835c783a503db533697b6d60db692766ef755710e79177456c0b
SSDEEP 192:eG14K6ms7KxkXqK4I40pUZNCgVLHrKHfFKslE88OXzKD/l0+ErUkKN9L6y/kSUK6:D1jts7KxkXqKf/pUZNCgVLH2HfgsluOZ
TLSH
T12F32D727A48D5A3F0FE8D40DDC136F8B6DB5029267780D2496FF9D0803A97CA125A5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 526a9b83f889b985fc0d8ef51fc04d1968aa4ea20384bafddff7085bedcbe6e3
MD5 aaf6d1e1464607f4511ecc664adf938f
SHA1 da5086a05bd9aadb41cd1a9e1877ea30e25749e0
SHA512 3b24699d7f4ec43bcd41197e5812b5ddb89ac1776f4af8236f6ad13c8f7a3c77db3bebe2ce14b1100e6d9cdc9575981fa16eab0aa40be1fbcc298e8841509438
SSDEEP 96:nMC0d+VUJ7oKfVHrSJEYvJVHQRDotok559DKB6EGyvP/e+0l4ZPEOLv4a:MC08UR5rYv3eDUDjagae+0l4ZsOP
TLSH
T181A10877E86A8DBBA976C58571462B43CEB5B17FA521AE90E9DC1F0C01AB0EC1301623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 57ab7987003db02c9b7748aade58106ac0868bfa09ae2c1e78cf66a0811f626f
MD5 d7946f4babbe63dde4b15e91bd57b177
SHA1 3f1a9702b8f8c17f19b1eb6fecbacee2ef9a2eee
SHA512 6e407bad761f910b2cdfa81c1aa817c0b5d296df071a7506b72fd724ade96f71a76470942a9cce6e785f85c378250052b7c3dd7acb10da4dd173a799b0c44442
SSDEEP 192:cC08UR5rYvWCiUzNagae4ilCcTQHVl4dPUHh+:cC0nYvWC8c4il9ToqiE
TLSH
T164D12ABAF47EED7359E29595B0036A47CEA561BF9650AEA0EED80F0D01E71EC1302113
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 13106237d231a277fb2e4abf00616d991ab1907f3f3e50d64d534745cef81ccc
MD5 0b79804a7a055cb2dfef292c9f7e74bc
SHA1 b95814b1487041393276ee4c54aa49d03b4ce371
SHA512 ad7bab8e8c4008f72b7d7ae2274d12b777fc9008d6cf854e3acfe2c291b64e88e90db6b498b598b2f935866a6f46584bc7bc3482c6f1a5ed5b9c455db3d3215c
SSDEEP 192:ct08UR5rYvWCiUzNagae4ilCcTQHVl4dPUHh+:ct0nYvWC8c4il9ToqiE
TLSH
T140D12ABAF47E9D7359E2D595B0037A47CEA561BF9650AEA0EED80F0D01E75EC1302123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2704-135-0x00007FFC64890000-0x00007FFC65234000-memory.dmp

Download

memory/2704-161-0x00007FFC64890000-0x00007FFC65234000-memory.dmp

Download

memory/2704-209-0x00007FFC64890000-0x00007FFC65234000-memory.dmp

Download

memory/2704-186-0x00007FFC64890000-0x00007FFC65234000-memory.dmp

Download

memory/2704-169-0x00007FFC64890000-0x00007FFC65234000-memory.dmp

Download

memory/2704-163-0x00007FFC64890000-0x00007FFC65234000-memory.dmp

Download

memory/2704-224-0x00007FFC64890000-0x00007FFC65234000-memory.dmp

Download

memory/2704-189-0x00007FFC64890000-0x00007FFC65234000-memory.dmp

Download

memory/2704-160-0x00007FFC64890000-0x00007FFC65234000-memory.dmp

Download

memory/2704-156-0x00007FFC64890000-0x00007FFC65234000-memory.dmp

Download

memory/2704-115-0x00007FFC64890000-0x00007FFC65234000-memory.dmp

Download

memory/2704-110-0x0000022666230000-0x0000022666252000-memory.dmp

Download

memory/2704-111-0x00007FFC64890000-0x00007FFC65234000-memory.dmp

Download

memory/2704-106-0x00007FFC64890000-0x00007FFC65234000-memory.dmp

Download

memory/2704-105-0x00007FFC64A1F000-0x00007FFC64A20000-memory.dmp

Download