Overview
overview
10Static
static
4LarvaLabsW...er.exe
windows7_x64
10LarvaLabsW...er.exe
windows10_x64
10ROGAIOSDK.dll
windows7_x64
3ROGAIOSDK.dll
windows10_x64
3RofPaketsoka.dll
windows7_x64
1RofPaketsoka.dll
windows10_x64
3ssleay32.dll
windows7_x64
1ssleay32.dll
windows10_x64
1storarc.dll
windows7_x64
1storarc.dll
windows10_x64
1storelib.dll
windows7_x64
1storelib.dll
windows10_x64
3storelibir-2.dll
windows7_x64
1storelibir-2.dll
windows10_x64
3Analysis
-
max time kernel
136s -
max time network
137s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
16-12-2021 16:12
Behavioral task
behavioral1
Sample
LarvaLabsWallet Launcher.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
LarvaLabsWallet Launcher.exe
Resource
win10-en-20211208
Behavioral task
behavioral3
Sample
ROGAIOSDK.dll
Resource
win7-en-20211208
Behavioral task
behavioral4
Sample
ROGAIOSDK.dll
Resource
win10-en-20211208
Behavioral task
behavioral5
Sample
RofPaketsoka.dll
Resource
win7-en-20211208
Behavioral task
behavioral6
Sample
RofPaketsoka.dll
Resource
win10-en-20211208
Behavioral task
behavioral7
Sample
ssleay32.dll
Resource
win7-en-20211208
Behavioral task
behavioral8
Sample
ssleay32.dll
Resource
win10-en-20211208
Behavioral task
behavioral9
Sample
storarc.dll
Resource
win7-en-20211208
Behavioral task
behavioral10
Sample
storarc.dll
Resource
win10-en-20211208
Behavioral task
behavioral11
Sample
storelib.dll
Resource
win7-en-20211208
Behavioral task
behavioral12
Sample
storelib.dll
Resource
win10-en-20211208
Behavioral task
behavioral13
Sample
storelibir-2.dll
Resource
win7-en-20211208
Behavioral task
behavioral14
Sample
storelibir-2.dll
Resource
win10-en-20211208
General
-
Target
LarvaLabsWallet Launcher.exe
-
Size
323.2MB
-
MD5
b18eaff37a9918535852c276a9f5f409
-
SHA1
e97ec59bec67c561774bc34b7275b5b644ff4864
-
SHA256
09383bbfa1491809d7d427c540221488ecc891196da1ce134fe5f145f8734abe
-
SHA512
2b5a822481b827a2eb6190812ff08ec79ade534a52221806b741d9b3ee9086e3e4bff8be85ad70dd0cd942a519ff1f5bf0406f8b046f3f80d5221a5a4627b92a
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/820-57-0x0000000001190000-0x00000000015C4000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
LarvaLabsWallet Launcher.exepid process 820 LarvaLabsWallet Launcher.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
LarvaLabsWallet Launcher.exetaskmgr.exechrome.exechrome.exechrome.exechrome.exechrome.exepid process 820 LarvaLabsWallet Launcher.exe 820 LarvaLabsWallet Launcher.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1416 chrome.exe 1172 chrome.exe 1172 chrome.exe 2616 chrome.exe 2480 chrome.exe 2648 chrome.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
taskmgr.exepid process 1772 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
LarvaLabsWallet Launcher.exetaskmgr.exedescription pid process Token: SeDebugPrivilege 820 LarvaLabsWallet Launcher.exe Token: SeDebugPrivilege 1772 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
taskmgr.exechrome.exepid process 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1172 chrome.exe 1172 chrome.exe 1172 chrome.exe 1172 chrome.exe 1172 chrome.exe 1172 chrome.exe 1172 chrome.exe 1172 chrome.exe 1172 chrome.exe 1172 chrome.exe 1172 chrome.exe 1172 chrome.exe 1172 chrome.exe 1172 chrome.exe 1172 chrome.exe 1172 chrome.exe 1172 chrome.exe 1172 chrome.exe 1172 chrome.exe 1172 chrome.exe 1172 chrome.exe 1172 chrome.exe 1172 chrome.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
taskmgr.exechrome.exepid process 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1172 chrome.exe 1172 chrome.exe 1172 chrome.exe 1172 chrome.exe 1172 chrome.exe 1172 chrome.exe 1172 chrome.exe 1172 chrome.exe 1172 chrome.exe 1172 chrome.exe 1172 chrome.exe 1172 chrome.exe 1172 chrome.exe 1172 chrome.exe 1172 chrome.exe 1172 chrome.exe 1172 chrome.exe 1172 chrome.exe 1172 chrome.exe 1172 chrome.exe 1172 chrome.exe 1172 chrome.exe 1172 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.exechrome.exedescription pid process target process PID 1832 wrote to memory of 1772 1832 cmd.exe taskmgr.exe PID 1832 wrote to memory of 1772 1832 cmd.exe taskmgr.exe PID 1832 wrote to memory of 1772 1832 cmd.exe taskmgr.exe PID 1172 wrote to memory of 1684 1172 chrome.exe chrome.exe PID 1172 wrote to memory of 1684 1172 chrome.exe chrome.exe PID 1172 wrote to memory of 1684 1172 chrome.exe chrome.exe PID 1172 wrote to memory of 812 1172 chrome.exe chrome.exe PID 1172 wrote to memory of 812 1172 chrome.exe chrome.exe PID 1172 wrote to memory of 812 1172 chrome.exe chrome.exe PID 1172 wrote to memory of 812 1172 chrome.exe chrome.exe PID 1172 wrote to memory of 812 1172 chrome.exe chrome.exe PID 1172 wrote to memory of 812 1172 chrome.exe chrome.exe PID 1172 wrote to memory of 812 1172 chrome.exe chrome.exe PID 1172 wrote to memory of 812 1172 chrome.exe chrome.exe PID 1172 wrote to memory of 812 1172 chrome.exe chrome.exe PID 1172 wrote to memory of 812 1172 chrome.exe chrome.exe PID 1172 wrote to memory of 812 1172 chrome.exe chrome.exe PID 1172 wrote to memory of 812 1172 chrome.exe chrome.exe PID 1172 wrote to memory of 812 1172 chrome.exe chrome.exe PID 1172 wrote to memory of 812 1172 chrome.exe chrome.exe PID 1172 wrote to memory of 812 1172 chrome.exe chrome.exe PID 1172 wrote to memory of 812 1172 chrome.exe chrome.exe PID 1172 wrote to memory of 812 1172 chrome.exe chrome.exe PID 1172 wrote to memory of 812 1172 chrome.exe chrome.exe PID 1172 wrote to memory of 812 1172 chrome.exe chrome.exe PID 1172 wrote to memory of 812 1172 chrome.exe chrome.exe PID 1172 wrote to memory of 812 1172 chrome.exe chrome.exe PID 1172 wrote to memory of 812 1172 chrome.exe chrome.exe PID 1172 wrote to memory of 812 1172 chrome.exe chrome.exe PID 1172 wrote to memory of 812 1172 chrome.exe chrome.exe PID 1172 wrote to memory of 812 1172 chrome.exe chrome.exe PID 1172 wrote to memory of 812 1172 chrome.exe chrome.exe PID 1172 wrote to memory of 812 1172 chrome.exe chrome.exe PID 1172 wrote to memory of 812 1172 chrome.exe chrome.exe PID 1172 wrote to memory of 812 1172 chrome.exe chrome.exe PID 1172 wrote to memory of 812 1172 chrome.exe chrome.exe PID 1172 wrote to memory of 812 1172 chrome.exe chrome.exe PID 1172 wrote to memory of 812 1172 chrome.exe chrome.exe PID 1172 wrote to memory of 812 1172 chrome.exe chrome.exe PID 1172 wrote to memory of 812 1172 chrome.exe chrome.exe PID 1172 wrote to memory of 812 1172 chrome.exe chrome.exe PID 1172 wrote to memory of 812 1172 chrome.exe chrome.exe PID 1172 wrote to memory of 812 1172 chrome.exe chrome.exe PID 1172 wrote to memory of 812 1172 chrome.exe chrome.exe PID 1172 wrote to memory of 812 1172 chrome.exe chrome.exe PID 1172 wrote to memory of 812 1172 chrome.exe chrome.exe PID 1172 wrote to memory of 812 1172 chrome.exe chrome.exe PID 1172 wrote to memory of 1416 1172 chrome.exe chrome.exe PID 1172 wrote to memory of 1416 1172 chrome.exe chrome.exe PID 1172 wrote to memory of 1416 1172 chrome.exe chrome.exe PID 1172 wrote to memory of 1704 1172 chrome.exe chrome.exe PID 1172 wrote to memory of 1704 1172 chrome.exe chrome.exe PID 1172 wrote to memory of 1704 1172 chrome.exe chrome.exe PID 1172 wrote to memory of 1704 1172 chrome.exe chrome.exe PID 1172 wrote to memory of 1704 1172 chrome.exe chrome.exe PID 1172 wrote to memory of 1704 1172 chrome.exe chrome.exe PID 1172 wrote to memory of 1704 1172 chrome.exe chrome.exe PID 1172 wrote to memory of 1704 1172 chrome.exe chrome.exe PID 1172 wrote to memory of 1704 1172 chrome.exe chrome.exe PID 1172 wrote to memory of 1704 1172 chrome.exe chrome.exe PID 1172 wrote to memory of 1704 1172 chrome.exe chrome.exe PID 1172 wrote to memory of 1704 1172 chrome.exe chrome.exe PID 1172 wrote to memory of 1704 1172 chrome.exe chrome.exe PID 1172 wrote to memory of 1704 1172 chrome.exe chrome.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\LarvaLabsWallet Launcher.exe"C:\Users\Admin\AppData\Local\Temp\LarvaLabsWallet Launcher.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskmgr.exetaskmgr2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef5664f50,0x7fef5664f60,0x7fef5664f702⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1056,13715199853044032753,4499357900631972926,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1048 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1056,13715199853044032753,4499357900631972926,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1276 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1056,13715199853044032753,4499357900631972926,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1692 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1056,13715199853044032753,4499357900631972926,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1056,13715199853044032753,4499357900631972926,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2084 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1056,13715199853044032753,4499357900631972926,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1056,13715199853044032753,4499357900631972926,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3084 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1056,13715199853044032753,4499357900631972926,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3028 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1056,13715199853044032753,4499357900631972926,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3212 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1056,13715199853044032753,4499357900631972926,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3296 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1056,13715199853044032753,4499357900631972926,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3424 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1056,13715199853044032753,4499357900631972926,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3428 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1056,13715199853044032753,4499357900631972926,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3436 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1056,13715199853044032753,4499357900631972926,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4012 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1056,13715199853044032753,4499357900631972926,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4128 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1056,13715199853044032753,4499357900631972926,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3276 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1056,13715199853044032753,4499357900631972926,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3980 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1056,13715199853044032753,4499357900631972926,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3828 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1056,13715199853044032753,4499357900631972926,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3296 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1056,13715199853044032753,4499357900631972926,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3388 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1056,13715199853044032753,4499357900631972926,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3852 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1056,13715199853044032753,4499357900631972926,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3716 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1056,13715199853044032753,4499357900631972926,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3260 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1056,13715199853044032753,4499357900631972926,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3920 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1056,13715199853044032753,4499357900631972926,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1056,13715199853044032753,4499357900631972926,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1056,13715199853044032753,4499357900631972926,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1056,13715199853044032753,4499357900631972926,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2956 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1056,13715199853044032753,4499357900631972926,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1900 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1056,13715199853044032753,4499357900631972926,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1872 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\??\pipe\crashpad_1172_IHCIYALKDHSDRDBLMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/820-68-0x0000000074CE0000-0x0000000074D6F000-memory.dmpFilesize
572KB
-
memory/820-56-0x0000000074800000-0x000000007484A000-memory.dmpFilesize
296KB
-
memory/820-66-0x0000000001190000-0x0000000001191000-memory.dmpFilesize
4KB
-
memory/820-60-0x00000000756C0000-0x000000007576C000-memory.dmpFilesize
688KB
-
memory/820-61-0x0000000075140000-0x0000000075187000-memory.dmpFilesize
284KB
-
memory/820-62-0x0000000076AC0000-0x0000000076B17000-memory.dmpFilesize
348KB
-
memory/820-63-0x00000000001E0000-0x0000000000225000-memory.dmpFilesize
276KB
-
memory/820-65-0x0000000074B80000-0x0000000074CDC000-memory.dmpFilesize
1.4MB
-
memory/820-58-0x0000000000090000-0x0000000000091000-memory.dmpFilesize
4KB
-
memory/820-57-0x0000000001190000-0x00000000015C4000-memory.dmpFilesize
4.2MB
-
memory/820-71-0x0000000075AC0000-0x000000007670A000-memory.dmpFilesize
12.3MB
-
memory/820-70-0x0000000005180000-0x0000000005181000-memory.dmpFilesize
4KB
-
memory/820-72-0x0000000073750000-0x0000000073767000-memory.dmpFilesize
92KB
-
memory/820-73-0x0000000075100000-0x0000000075135000-memory.dmpFilesize
212KB
-
memory/820-74-0x000000006E030000-0x000000006E1C0000-memory.dmpFilesize
1.6MB
-
memory/820-75-0x00000000746F0000-0x0000000074707000-memory.dmpFilesize
92KB
-
memory/820-55-0x0000000075AC1000-0x0000000075AC3000-memory.dmpFilesize
8KB
-
memory/1772-77-0x000007FEFB731000-0x000007FEFB733000-memory.dmpFilesize
8KB
-
memory/1772-76-0x0000000000000000-mapping.dmp