71e70a95591741d64cdc93dfb21a31ab0b83252f2ecf75bb0e8a4d72310928e2

Analysis

max time kernel
151s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 15:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
V6OficialVersion.exe
Size 68.8MB
Sample260910-s7lnpadf47
SHA256 71e70a95591741d64cdc93dfb21a31ab0b83252f2ecf75bb0e8a4d72310928e2
MD5 d58e6a36a8e6363cb07eadeb928592a7
SHA1 9ca0e9c576db23685a4489fa53882fd95ab8ffc2
SHA512 7414ef52374455772bf1c733acbfd2fdaf7589388cbec97556f8a044c70728363ca90f799199647856fc456af176b0d9f2cd0a60882b2aa86fbaceb1cf990454
SSDEEP 786432:A9d6t8g9QlR/Xnb8gP1MIxk9hPHCnYP7jGMYViVysmn4/SDhLm9MRpmPsM:A9duMRfnpaIxkPgYP7jsVGQXDhLCM/tM
TLSH
T18CF7DF0773E501A9E577E138CAAB9203E7B2B4161330D7DB329C03652F67AE45E7A760
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

credential_access discovery execution spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1552	powershell.exe

Uses browser remote debugging 2 TTPs 3 IoCs

Can be used to control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
2632	chrome.exe
4204	chrome.exe
3144	chrome.exe

Loads dropped DLL 3 IoCs

pid	Process
4004	V6OficialVersion.exe
4004	V6OficialVersion.exe
4004	V6OficialVersion.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2792	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3076	chrome.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	V6OficialVersion.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	V6OficialVersion.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	V6OficialVersion.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	V6OficialVersion.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	V6OficialVersion.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	V6OficialVersion.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	V6OficialVersion.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	V6OficialVersion.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	V6OficialVersion.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	V6OficialVersion.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	V6OficialVersion.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	V6OficialVersion.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	V6OficialVersion.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	V6OficialVersion.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	V6OficialVersion.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	V6OficialVersion.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	V6OficialVersion.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	V6OficialVersion.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	V6OficialVersion.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	V6OficialVersion.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	V6OficialVersion.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	V6OficialVersion.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	V6OficialVersion.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	V6OficialVersion.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335288175858336"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
4004	V6OficialVersion.exe
4004	V6OficialVersion.exe
4004	V6OficialVersion.exe
4004	V6OficialVersion.exe
1552	powershell.exe
1552	powershell.exe
1552	powershell.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1552	powershell.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2632	chrome.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4004 wrote to memory of 2792	4004	V6OficialVersion.exe	89
PID 2792 wrote to memory of 1552	2792	cmd.exe	90
PID 4004 wrote to memory of 2632	4004	V6OficialVersion.exe	92
PID 2632 wrote to memory of 5476	2632	chrome.exe	93
PID 2632 wrote to memory of 3056	2632	chrome.exe	94
PID 2632 wrote to memory of 3076	2632	chrome.exe	95
PID 2632 wrote to memory of 3576	2632	chrome.exe	96
PID 2632 wrote to memory of 4204	2632	chrome.exe	98
PID 2632 wrote to memory of 3144	2632	chrome.exe	99
PID 2632 wrote to memory of 2436	2632	chrome.exe	100
PID 2632 wrote to memory of 2676	2632	chrome.exe	105
PID 2632 wrote to memory of 2920	2632	chrome.exe	106
PID 2632 wrote to memory of 5540	2632	chrome.exe	107

C:\Users\Admin\AppData\Local\Temp\V6OficialVersion.exe
"C:\Users\Admin\AppData\Local\Temp\V6OficialVersion.exe"
1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.MessageBox]::Show('Ocorreu um erro no sistema!', 'Erro', [System.Windows.Forms.MessageBoxButtons]::OK, [System.Windows.Forms.MessageBoxIcon]::Error)""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2792
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.MessageBox]::Show('Ocorreu um erro no sistema!', 'Erro', [System.Windows.Forms.MessageBoxButtons]::OK, [System.Windows.Forms.MessageBoxIcon]::Error)"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-field-trial-config --disable-background-networking --disable-background-timer-throttling --disable-backgrounding-occluded-windows --disable-back-forward-cache --disable-breakpad --disable-client-side-phishing-detection --disable-component-extensions-with-background-pages --disable-component-update --no-default-browser-check --disable-default-apps --disable-dev-shm-usage --disable-extensions --disable-features=AvoidUnnecessaryBeforeUnloadCheckSync,BoundaryEventDispatchTracksNodeRemoval,DestroyProfileOnBrowserClose,DialMediaRouteProvider,GlobalMediaControls,HttpsUpgrades,LensOverlay,MediaRouter,PaintHolding,ThirdPartyStoragePartitioning,Translate,AutoDeElevate,RenderDocument,OptimizationHints --enable-features=CDPScreenshotNewSurface --allow-pre-commit-input --disable-hang-monitor --disable-ipc-flooding-protection --disable-popup-blocking --disable-prompt-on-repost --disable-renderer-backgrounding --force-color-profile=srgb --metrics-recording-only --no-first-run --password-store=basic --use-mock-keychain --no-service-autorun --export-tagged-pdf --disable-search-engine-choice-screen --unsafely-disable-devtools-self-xss-warnings --edge-skip-compat-layer-relaunch --enable-automation --disable-infobars --disable-search-engine-choice-screen --disable-sync --enable-unsafe-swiftshader --headless --hide-scrollbars --mute-audio --blink-settings=primaryHoverType=2,availableHoverTypes=2,primaryPointerType=4,availablePointerTypes=4 --no-sandbox --remote-debugging-port=5555 --profile-directory=Default --disable-gpu --disable-software-rasterizer --disable-dev-shm-usage --disable-accelerated-2d-canvas --no-sandbox --disable-setuid-sandbox --disable-extensions --disable-component-extensions-with-background-pages --disable-default-apps --mute-audio --no-zygote --disable-backgrounding-occluded-windows --memory-pressure-off --force-low-power-gpu "--user-data-dir=C:/Users/Admin/AppData/Local/Google/Chrome/User Data" --remote-debugging-pipe about:blank
  2⤵
  - Uses browser remote debugging
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2632
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffde398c728,0x7ffde398c734,0x7ffde398c740
    3⤵
    PID:5476
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --disable-breakpad --headless --enable-unsafe-swiftshader --noerrdialogs --user-data-dir="C:/Users/Admin/AppData/Local/Google/Chrome/User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAQAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --field-trial-handle=1772,i,5528846191806838361,16746487848275683185,262144 --enable-features=CDPScreenshotNewSurface --disable-features=AutoDeElevate,AvoidUnnecessaryBeforeUnloadCheckSync,BoundaryEventDispatchTracksNodeRemoval,DestroyProfileOnBrowserClose,DialMediaRouteProvider,GlobalMediaControls,HttpsUpgrades,LensOverlay,MediaRouter,OptimizationHints,PaintHolding,RenderDocument,ThirdPartyStoragePartitioning,Translate --variations-seed-version --mojo-platform-channel-handle=1848 /prefetch:2
    3⤵
    PID:3056
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --noerrdialogs --user-data-dir="C:/Users/Admin/AppData/Local/Google/Chrome/User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --field-trial-handle=1772,i,5528846191806838361,16746487848275683185,262144 --enable-features=CDPScreenshotNewSurface --disable-features=AutoDeElevate,AvoidUnnecessaryBeforeUnloadCheckSync,BoundaryEventDispatchTracksNodeRemoval,DestroyProfileOnBrowserClose,DialMediaRouteProvider,GlobalMediaControls,HttpsUpgrades,LensOverlay,MediaRouter,OptimizationHints,PaintHolding,RenderDocument,ThirdPartyStoragePartitioning,Translate --variations-seed-version --mojo-platform-channel-handle=1928 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3076
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --noerrdialogs --user-data-dir="C:/Users/Admin/AppData/Local/Google/Chrome/User Data" --force-high-res-timeticks=disabled --field-trial-handle=1772,i,5528846191806838361,16746487848275683185,262144 --enable-features=CDPScreenshotNewSurface --disable-features=AutoDeElevate,AvoidUnnecessaryBeforeUnloadCheckSync,BoundaryEventDispatchTracksNodeRemoval,DestroyProfileOnBrowserClose,DialMediaRouteProvider,GlobalMediaControls,HttpsUpgrades,LensOverlay,MediaRouter,OptimizationHints,PaintHolding,RenderDocument,ThirdPartyStoragePartitioning,Translate --variations-seed-version --mojo-platform-channel-handle=1156 /prefetch:13
    3⤵
    PID:3576
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:/Users/Admin/AppData/Local/Google/Chrome/User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-back-forward-cache --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --no-zygote --remote-debugging-pipe --remote-debugging-port=5555 --allow-pre-commit-input --blink-settings=primaryHoverType=2,availableHoverTypes=2,primaryPointerType=4,availablePointerTypes=4 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1772,i,5528846191806838361,16746487848275683185,262144 --enable-features=CDPScreenshotNewSurface --disable-features=AutoDeElevate,AvoidUnnecessaryBeforeUnloadCheckSync,BoundaryEventDispatchTracksNodeRemoval,DestroyProfileOnBrowserClose,DialMediaRouteProvider,GlobalMediaControls,HttpsUpgrades,LensOverlay,MediaRouter,OptimizationHints,PaintHolding,RenderDocument,ThirdPartyStoragePartitioning,Translate --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:4204
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:/Users/Admin/AppData/Local/Google/Chrome/User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-back-forward-cache --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --no-zygote --remote-debugging-pipe --remote-debugging-port=5555 --allow-pre-commit-input --blink-settings=primaryHoverType=2,availableHoverTypes=2,primaryPointerType=4,availablePointerTypes=4 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1772,i,5528846191806838361,16746487848275683185,262144 --enable-features=CDPScreenshotNewSurface --disable-features=AutoDeElevate,AvoidUnnecessaryBeforeUnloadCheckSync,BoundaryEventDispatchTracksNodeRemoval,DestroyProfileOnBrowserClose,DialMediaRouteProvider,GlobalMediaControls,HttpsUpgrades,LensOverlay,MediaRouter,OptimizationHints,PaintHolding,RenderDocument,ThirdPartyStoragePartitioning,Translate --variations-seed-version --mojo-platform-channel-handle=2784 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:3144
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --noerrdialogs --user-data-dir="C:/Users/Admin/AppData/Local/Google/Chrome/User Data" --force-high-res-timeticks=disabled --field-trial-handle=1772,i,5528846191806838361,16746487848275683185,262144 --enable-features=CDPScreenshotNewSurface --disable-features=AutoDeElevate,AvoidUnnecessaryBeforeUnloadCheckSync,BoundaryEventDispatchTracksNodeRemoval,DestroyProfileOnBrowserClose,DialMediaRouteProvider,GlobalMediaControls,HttpsUpgrades,LensOverlay,MediaRouter,OptimizationHints,PaintHolding,RenderDocument,ThirdPartyStoragePartitioning,Translate --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:14
    3⤵
    PID:2436
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --noerrdialogs --user-data-dir="C:/Users/Admin/AppData/Local/Google/Chrome/User Data" --force-high-res-timeticks=disabled --field-trial-handle=1772,i,5528846191806838361,16746487848275683185,262144 --enable-features=CDPScreenshotNewSurface --disable-features=AutoDeElevate,AvoidUnnecessaryBeforeUnloadCheckSync,BoundaryEventDispatchTracksNodeRemoval,DestroyProfileOnBrowserClose,DialMediaRouteProvider,GlobalMediaControls,HttpsUpgrades,LensOverlay,MediaRouter,OptimizationHints,PaintHolding,RenderDocument,ThirdPartyStoragePartitioning,Translate --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:14
    3⤵
    PID:2676
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --noerrdialogs --user-data-dir="C:/Users/Admin/AppData/Local/Google/Chrome/User Data" --force-high-res-timeticks=disabled --field-trial-handle=1772,i,5528846191806838361,16746487848275683185,262144 --enable-features=CDPScreenshotNewSurface --disable-features=AutoDeElevate,AvoidUnnecessaryBeforeUnloadCheckSync,BoundaryEventDispatchTracksNodeRemoval,DestroyProfileOnBrowserClose,DialMediaRouteProvider,GlobalMediaControls,HttpsUpgrades,LensOverlay,MediaRouter,OptimizationHints,PaintHolding,RenderDocument,ThirdPartyStoragePartitioning,Translate --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:14
    3⤵
    PID:2920
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --noerrdialogs --user-data-dir="C:/Users/Admin/AppData/Local/Google/Chrome/User Data" --force-high-res-timeticks=disabled --field-trial-handle=1772,i,5528846191806838361,16746487848275683185,262144 --enable-features=CDPScreenshotNewSurface --disable-features=AutoDeElevate,AvoidUnnecessaryBeforeUnloadCheckSync,BoundaryEventDispatchTracksNodeRemoval,DestroyProfileOnBrowserClose,DialMediaRouteProvider,GlobalMediaControls,HttpsUpgrades,LensOverlay,MediaRouter,OptimizationHints,PaintHolding,RenderDocument,ThirdPartyStoragePartitioning,Translate --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:14
    3⤵
    PID:5540

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6076

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dpapi.node

Path C:\Users\Admin\.cache\pkg\7c97d3a751ddcfa2b5503a6a8952009d024acd27505472048d75e01e311f2c5a\@primno\dpapi\build\Release\dpapi.node
Size 133KB
SHA256 7c97d3a751ddcfa2b5503a6a8952009d024acd27505472048d75e01e311f2c5a
MD5 deac691f8f6d26789fb71f5867865700
SHA1 c0ab610b47b09b42c0d2f7a202d6a9fdedfd1e50
SHA512 2d3abc1564034e804eb614ef86b56e0d133d113488c7f45b6531f5cc711db8aa36631c056d94dd2b2f275dc99acca001261fefa8f9a34940cebaa2ad44d56270
SSDEEP 3072:9Xbs12OIS8X759w1pltgyC7ybxMMb+ZmPXrqA:ynIS8X75mJtUybeMX2A
TLSH
T102D35C57B3A440BBE0B7C27885970A45D3B2B8254B31ABEF07A4465A1F137E0DD3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

koffi.node

Path C:\Users\Admin\.cache\pkg\a6caa84c1f8c459215a783318b818d3fa1b260d2d821c22c22864cd2af216490\koffi\build\koffi\win32_x64\koffi.node
Size 2.3MB
SHA256 a6caa84c1f8c459215a783318b818d3fa1b260d2d821c22c22864cd2af216490
MD5 ebe3666be392b02383d411e846317b76
SHA1 69a87af1f3e7175ef6f681f419d0d18f35038195
SHA512 b473fd70c1b874a8b400283110de077dde62cd3bc5dc7a50334f1b62b3c1d5e07e8a3aee63db14b12aa5f7c3ff495cf21411ff61c6433462698eec743c9a1ff4
SSDEEP 24576:QIURRJEkuyU3d7pJP2JJ4Gvop6geUTnefOE:QIURJETyUN7ph2JKwFJ
TLSH
T125B5DE064758C8E9D83EB072B4176776E56A221B083D62DF04F48D61082ABFD5DAFFC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

better_sqlite3.node

Path C:\Users\Admin\.cache\pkg\d895a929771b5ff67e65f07840b6257b31bc1597ee0c28f34c3406aecabbf993\better-sqlite3\build\Release\better_sqlite3.node
Size 1.8MB
SHA256 d895a929771b5ff67e65f07840b6257b31bc1597ee0c28f34c3406aecabbf993
MD5 e02e71bb676ffd73f4df01fdbbea1c34
SHA1 d27d951bdb6c47670fb05a0793dc06bf4655cf7b
SHA512 4a1700e67b2de91846a621ff18ebf8e0e5796522b052613a9fa3c575e370a303bb430783ad6996749fd8edfc0b1dc7e81d9842a97a6870dc1906a715d49e5ba0
SSDEEP 49152:KgyH7PyMsVvMiKG472nzEB/JHtUnk8p/SysLALVjd:5yH7PyfZwWrn
TLSH
T1E3958C4BE2B400FDC167C079860B560BEB76B41527745BEB1690CA696F23FE217BE324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 d4821e9de1cff540bd1b029f0b0d1bc9e0dbdb6940e8c69766b73e5b1c062557
MD5 f4723bd54da144d7aad836a89b9295af
SHA1 c01af6a5a1bc14ef963cecbdd7cc05a18ac96e92
SHA512 25616a6bd2e57cdc9e084b4bb6968de9ee3eb9999f2e1995548d8962bb20d9c357b2c481239bf703dec9f9f35159de22b70604d2dbb3e53ea01620a2c14111a5
TLSH
T1AB31AFF783B4857D8A1192E4DB11AF1FCE6D0524031C387688D86E1B87E29B2D11579F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 4ebe227f9354480184d782821a1955781f05a23dad4f19d2a93c2ca8b32cbd86
MD5 0374a29f394b3e18a0b5033f87d65668
SHA1 e7d365bae768043e0acf78daece6b3d6998dbc18
SHA512 1a67ddcfd9827615e3ca380163f57a34192954d426e53464ed8d1e127adbff8e43a0e20688b45447f6e8b2775073a6f7fffb1cb19a36c2057ac032073c2cdc72
SSDEEP 192:yRwlAmkv7zvAPRp2s9EHsb+WNnKb1PqFc2SeszFcVyIsnAUgG:yRwlFA/6X7mwSPqy2MzF4G
TLSH
T12032B63EBA10693B6CCBC219FA25BB93D7F5102671942E80EBFC892C15E75CD221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 101b168f1b566b98163883262566b18a4867fa4005a21e5d76ef2b1de5f07844
MD5 74491f37464dcffdc95bf7f194d1f39d
SHA1 8a1060bffc44db1e047259229a4d9b430a15fbd5
SHA512 6560b7b8d2522f32db8dca812a76b60e1971058649f161519188eed95129726ad6fb5f55f8a16d4c5f55556d4b19f8682823ec0bb5fe391ebe9f0c9e3540d6aa
SSDEEP 192:yRwlAmkv7zvBPRpFs9EHsb+WNnKb1Pq2vc2SeszFuVyIsnAUgY:yRwlFA/xX6mwSPqr2MzFmY
TLSH
T19442B63EB910693B6DCBD219F925BB53D3F5602261902E84EBFC8E2C15E75CD221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 a31e74e35692b53f74e771d8c6a6ff97fdc02cc9dd1b36df084db90aabf4feef
MD5 b2693f5222f8f6b4c679b3a1dea311f1
SHA1 fe19699972ddbe7621bdc9748b86b8f3f35dceef
SHA512 27f5f047b2e9039e785f8da0072b341f506172b7f21c5378c6e1922088d2bbe0ee248a38c3b6ec2956a06adf7d3e55243f0ff4a217325d1437fe060f59d6381a
SSDEEP 192:e3Q4K6NE+97KxkXqK4I40pUZNCgVLHrKHfFKslEi5PRXzKD/8E+d+ErUkKN9t7vU:WQjZ07KxkXqKf/pUZNCgVLH2Hfgsljhz
TLSH
T19E32E967A48E9E3F4FDCD90DDC126F8BACB5029662780C2493FB6D0803957CA114A5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 02dc5a33ff6120bdbb050d24b79bdcb613d1c9f352921d07fbb584f2130e2ea6
MD5 0b2f561ca1f2556f3ecb2bdc94896690
SHA1 ee79ba492a15b5742e80fdaede014640ada952b5
SHA512 cec87adf65ab05484a965592a3f94ad06cf79d93b5432e4ae053fc17c10b1ad9d90df5ec766c40296170d7a6aefc3067174f704b47f51b0d3d912b6c61b74370
SSDEEP 192:tC0PtbKFKu00UUSbi1iUz9UmMBkPQ2mRUBB:tCWtmFK6oi1+BBknme3
TLSH
T143D13AB1A82D9C735AF7D596B4032603CEB4912FAA415F94CACE0F1D01EB5ED1343627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 a699ae587ea1dc9eed1a53d6d0bcedb56680c3abb60879873734391880b9194e
MD5 6d4461af5c05d4a0ca83aa45511888d1
SHA1 ac66c1cc7fcf9182e174a2d6df1ae7730bb87bda
SHA512 a6fb725d522f5b04d1caa27a5f4af9a3737dbcb05dc1527ab580ec37bef72480aaf2ed62a92641b990a40586a678d4af481f71867cdef97313fe8232df4f8ea4
SSDEEP 96:xC0d+EZUAbKFKu0d6aF7QuGJfmbE13IERDotok5PlDQB60GyvnnXmlbKmb0v4a:xC0PtbKFKu00UUSb/iDUDVUECXmlbK7
TLSH
T195A12C72A4698D7359B6D549B9A62B03CF74E12BAE229F54D9CD0F0C14FB0DC0342627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 f8a64f98372049bde0dba55062661d7e3a8a3a7aed130b035c726e920cbfce22
MD5 6d467ce2b9f9e88767646cef093cbbc1
SHA1 b80f99c9a390e253c9958ba0387f9a96000980bd
SHA512 e1945042b156bcbf7aa57d428688b12b16ca2ff98ea18fb153e2a61566bc53f4a1842b1032f33a91cec0f302ff1beb24a3f0f7e82b8a1234410b4c3800674bf7
SSDEEP 192:tt0PtbKFKu00UUSbi1iUz9UmMBkPQ2mRUBB:ttWtmFK6oi1+BBknme3
TLSH
T1EFD129B1A82D9C735AF6D596B4032603CEB4A12FAA415FA4CACE0F1D01EB5ED1347627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1552-232-0x00007FFDE2BC0000-0x00007FFDE3564000-memory.dmp

Download

memory/1552-165-0x00007FFDE2BC0000-0x00007FFDE3564000-memory.dmp

Download

memory/1552-207-0x00007FFDE2BC0000-0x00007FFDE3564000-memory.dmp

Download

memory/1552-112-0x00007FFDE2BC0000-0x00007FFDE3564000-memory.dmp

Download

memory/1552-111-0x00007FFDE2BC0000-0x00007FFDE3564000-memory.dmp

Download

memory/1552-108-0x0000021572520000-0x0000021572542000-memory.dmp

Download

memory/1552-201-0x00007FFDE2BC0000-0x00007FFDE3564000-memory.dmp

Download

memory/1552-205-0x00007FFDE2BC0000-0x00007FFDE3564000-memory.dmp

Download

memory/1552-206-0x00007FFDE2BC0000-0x00007FFDE3564000-memory.dmp

Download

memory/1552-200-0x00007FFDE2BC0000-0x00007FFDE3564000-memory.dmp

Download

memory/1552-185-0x00007FFDE2BC0000-0x00007FFDE3564000-memory.dmp

Download

memory/1552-183-0x00007FFDE2BC0000-0x00007FFDE3564000-memory.dmp

Download

memory/1552-110-0x00007FFDE2BC0000-0x00007FFDE3564000-memory.dmp

Download

memory/1552-105-0x00007FFDE2D4F000-0x00007FFDE2D50000-memory.dmp

Download