socelars | 8c28fb5d64ea3cbbcb5da19eb30e6ec8f2acb4c16e0f935275117f49ec4b4b19

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
25-07-2024 10:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-07-25_f1f70ba64226076ff5ccc297301d7c93_avoslocker_wapomi.exe
Size

1.5MB
MD5

f1f70ba64226076ff5ccc297301d7c93
SHA1

68cfbd7f5888c0a89671a350db95d7b7b9dc8e26
SHA256

8c28fb5d64ea3cbbcb5da19eb30e6ec8f2acb4c16e0f935275117f49ec4b4b19
SHA512

f2de772227274695756afae89fa9fdbeb8c313ca5f3a7f365cbb7c9d070ea7e001ac2c75f8063219ec0ff9d086b3000ca6e6d23e9f18b6aed9cd331c7a8e3809
SSDEEP

24576:Mwpk4V9rRM1oDb+enGs2Q6E9ZBJRPHJTrFSJ84ufAQKF2fJmg:5pRc1OMcV/sJjAAQKYfYg

Score

10^/10

socelars aspackv2 credential_access discovery spyware stealer

Malware Config

Extracted

Family

socelars

https://sa-us-bucket.s3.us-east-2.amazonaws.com/jhvre24/

Signatures

Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
stealer socelars

Socelars payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4560-0-0x00000000003B0000-0x0000000000531000-memory.dmp	family_socelars
behavioral2/memory/4560-49-0x00000000003B0000-0x0000000000531000-memory.dmp	family_socelars
behavioral2/memory/4560-69-0x00000000003B0000-0x0000000000531000-memory.dmp	family_socelars

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\hvDQNG.exe	aspack_v212_v242

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exehvDQNG.exechrome.exechrome.exechrome.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation	hvDQNG.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation	chrome.exe

Executes dropped EXE 13 IoCs

Processes:

hvDQNG.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exeelevation_service.exechrome.exechrome.exechrome.exechrome.exe

pid	process
2728	hvDQNG.exe
1356	chrome.exe
712	chrome.exe
3700	chrome.exe
60	chrome.exe
4148	chrome.exe
1980	chrome.exe
4012	chrome.exe
3528	elevation_service.exe
1136	chrome.exe
3524	chrome.exe
4280	chrome.exe
3336	chrome.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops Chrome extension 1 IoCs

Processes:

2024-07-25_f1f70ba64226076ff5ccc297301d7c93_avoslocker_wapomi.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aieoplapobidheellikiicjfpamacpfd\11.23.45_0\manifest.json	2024-07-25_f1f70ba64226076ff5ccc297301d7c93_avoslocker_wapomi.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service
T1102

Processes:

flow ioc

35 iplogger.org

flow	ioc
35	iplogger.org

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	chrome.exe

Drops file in System32 directory 2 IoCs

Processes:

chrome.exe

description	ioc	process
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	chrome.exe
File created	\??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	chrome.exe

Drops file in Program Files directory 64 IoCs

Processes:

hvDQNG.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdate.exe	hvDQNG.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	hvDQNG.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	hvDQNG.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE	hvDQNG.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	hvDQNG.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	hvDQNG.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	hvDQNG.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	hvDQNG.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	hvDQNG.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe	hvDQNG.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	hvDQNG.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\YourPhone.exe	hvDQNG.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	hvDQNG.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	hvDQNG.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE	hvDQNG.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleApp.exe	hvDQNG.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe	hvDQNG.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	hvDQNG.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	hvDQNG.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.exe	hvDQNG.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe	hvDQNG.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	hvDQNG.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	hvDQNG.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	hvDQNG.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	hvDQNG.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	hvDQNG.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE	hvDQNG.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe	hvDQNG.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	hvDQNG.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	hvDQNG.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	hvDQNG.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe	hvDQNG.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe	hvDQNG.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	hvDQNG.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	hvDQNG.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe	hvDQNG.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	hvDQNG.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe	hvDQNG.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe	hvDQNG.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	hvDQNG.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	hvDQNG.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	hvDQNG.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe	hvDQNG.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	hvDQNG.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	hvDQNG.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	hvDQNG.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE	hvDQNG.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe	hvDQNG.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	hvDQNG.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	hvDQNG.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	hvDQNG.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Solitaire.exe	hvDQNG.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	hvDQNG.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	hvDQNG.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	hvDQNG.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe	hvDQNG.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	hvDQNG.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	hvDQNG.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	hvDQNG.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	hvDQNG.exe
File opened for modification	C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe	hvDQNG.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	hvDQNG.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	hvDQNG.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	hvDQNG.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

cmd.execmd.exetaskkill.exe2024-07-25_f1f70ba64226076ff5ccc297301d7c93_avoslocker_wapomi.exehvDQNG.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-07-25_f1f70ba64226076ff5ccc297301d7c93_avoslocker_wapomi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hvDQNG.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

3268 taskkill.exe

pid	process
3268	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133663758350993140"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

chrome.exechrome.exe

pid process

1356 chrome.exe
1356 chrome.exe
3336 chrome.exe
3336 chrome.exe
3336 chrome.exe
3336 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

Processes:

chrome.exe

pid process

1356 chrome.exe
1356 chrome.exe
1356 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

2024-07-25_f1f70ba64226076ff5ccc297301d7c93_avoslocker_wapomi.exetaskkill.exechrome.exe

description	pid	process
Token: SeCreateTokenPrivilege	4560	2024-07-25_f1f70ba64226076ff5ccc297301d7c93_avoslocker_wapomi.exe
Token: SeAssignPrimaryTokenPrivilege	4560	2024-07-25_f1f70ba64226076ff5ccc297301d7c93_avoslocker_wapomi.exe
Token: SeLockMemoryPrivilege	4560	2024-07-25_f1f70ba64226076ff5ccc297301d7c93_avoslocker_wapomi.exe
Token: SeIncreaseQuotaPrivilege	4560	2024-07-25_f1f70ba64226076ff5ccc297301d7c93_avoslocker_wapomi.exe
Token: SeMachineAccountPrivilege	4560	2024-07-25_f1f70ba64226076ff5ccc297301d7c93_avoslocker_wapomi.exe
Token: SeTcbPrivilege	4560	2024-07-25_f1f70ba64226076ff5ccc297301d7c93_avoslocker_wapomi.exe
Token: SeSecurityPrivilege	4560	2024-07-25_f1f70ba64226076ff5ccc297301d7c93_avoslocker_wapomi.exe
Token: SeTakeOwnershipPrivilege	4560	2024-07-25_f1f70ba64226076ff5ccc297301d7c93_avoslocker_wapomi.exe
Token: SeLoadDriverPrivilege	4560	2024-07-25_f1f70ba64226076ff5ccc297301d7c93_avoslocker_wapomi.exe
Token: SeSystemProfilePrivilege	4560	2024-07-25_f1f70ba64226076ff5ccc297301d7c93_avoslocker_wapomi.exe
Token: SeSystemtimePrivilege	4560	2024-07-25_f1f70ba64226076ff5ccc297301d7c93_avoslocker_wapomi.exe
Token: SeProfSingleProcessPrivilege	4560	2024-07-25_f1f70ba64226076ff5ccc297301d7c93_avoslocker_wapomi.exe
Token: SeIncBasePriorityPrivilege	4560	2024-07-25_f1f70ba64226076ff5ccc297301d7c93_avoslocker_wapomi.exe
Token: SeCreatePagefilePrivilege	4560	2024-07-25_f1f70ba64226076ff5ccc297301d7c93_avoslocker_wapomi.exe
Token: SeCreatePermanentPrivilege	4560	2024-07-25_f1f70ba64226076ff5ccc297301d7c93_avoslocker_wapomi.exe
Token: SeBackupPrivilege	4560	2024-07-25_f1f70ba64226076ff5ccc297301d7c93_avoslocker_wapomi.exe
Token: SeRestorePrivilege	4560	2024-07-25_f1f70ba64226076ff5ccc297301d7c93_avoslocker_wapomi.exe
Token: SeShutdownPrivilege	4560	2024-07-25_f1f70ba64226076ff5ccc297301d7c93_avoslocker_wapomi.exe
Token: SeDebugPrivilege	4560	2024-07-25_f1f70ba64226076ff5ccc297301d7c93_avoslocker_wapomi.exe
Token: SeAuditPrivilege	4560	2024-07-25_f1f70ba64226076ff5ccc297301d7c93_avoslocker_wapomi.exe
Token: SeSystemEnvironmentPrivilege	4560	2024-07-25_f1f70ba64226076ff5ccc297301d7c93_avoslocker_wapomi.exe
Token: SeChangeNotifyPrivilege	4560	2024-07-25_f1f70ba64226076ff5ccc297301d7c93_avoslocker_wapomi.exe
Token: SeRemoteShutdownPrivilege	4560	2024-07-25_f1f70ba64226076ff5ccc297301d7c93_avoslocker_wapomi.exe
Token: SeUndockPrivilege	4560	2024-07-25_f1f70ba64226076ff5ccc297301d7c93_avoslocker_wapomi.exe
Token: SeSyncAgentPrivilege	4560	2024-07-25_f1f70ba64226076ff5ccc297301d7c93_avoslocker_wapomi.exe
Token: SeEnableDelegationPrivilege	4560	2024-07-25_f1f70ba64226076ff5ccc297301d7c93_avoslocker_wapomi.exe
Token: SeManageVolumePrivilege	4560	2024-07-25_f1f70ba64226076ff5ccc297301d7c93_avoslocker_wapomi.exe
Token: SeImpersonatePrivilege	4560	2024-07-25_f1f70ba64226076ff5ccc297301d7c93_avoslocker_wapomi.exe
Token: SeCreateGlobalPrivilege	4560	2024-07-25_f1f70ba64226076ff5ccc297301d7c93_avoslocker_wapomi.exe
Token: 31	4560	2024-07-25_f1f70ba64226076ff5ccc297301d7c93_avoslocker_wapomi.exe
Token: 32	4560	2024-07-25_f1f70ba64226076ff5ccc297301d7c93_avoslocker_wapomi.exe
Token: 33	4560	2024-07-25_f1f70ba64226076ff5ccc297301d7c93_avoslocker_wapomi.exe
Token: 34	4560	2024-07-25_f1f70ba64226076ff5ccc297301d7c93_avoslocker_wapomi.exe
Token: 35	4560	2024-07-25_f1f70ba64226076ff5ccc297301d7c93_avoslocker_wapomi.exe
Token: SeDebugPrivilege	3268	taskkill.exe
Token: SeShutdownPrivilege	1356	chrome.exe
Token: SeCreatePagefilePrivilege	1356	chrome.exe
Token: SeShutdownPrivilege	1356	chrome.exe
Token: SeCreatePagefilePrivilege	1356	chrome.exe
Token: SeShutdownPrivilege	1356	chrome.exe
Token: SeCreatePagefilePrivilege	1356	chrome.exe
Token: SeShutdownPrivilege	1356	chrome.exe
Token: SeCreatePagefilePrivilege	1356	chrome.exe
Token: SeShutdownPrivilege	1356	chrome.exe
Token: SeCreatePagefilePrivilege	1356	chrome.exe
Token: SeShutdownPrivilege	1356	chrome.exe
Token: SeCreatePagefilePrivilege	1356	chrome.exe
Token: SeShutdownPrivilege	1356	chrome.exe
Token: SeCreatePagefilePrivilege	1356	chrome.exe
Token: SeShutdownPrivilege	1356	chrome.exe
Token: SeCreatePagefilePrivilege	1356	chrome.exe
Token: SeShutdownPrivilege	1356	chrome.exe
Token: SeCreatePagefilePrivilege	1356	chrome.exe
Token: SeShutdownPrivilege	1356	chrome.exe
Token: SeCreatePagefilePrivilege	1356	chrome.exe
Token: SeShutdownPrivilege	1356	chrome.exe
Token: SeCreatePagefilePrivilege	1356	chrome.exe
Token: SeShutdownPrivilege	1356	chrome.exe
Token: SeCreatePagefilePrivilege	1356	chrome.exe
Token: SeShutdownPrivilege	1356	chrome.exe
Token: SeCreatePagefilePrivilege	1356	chrome.exe
Token: SeShutdownPrivilege	1356	chrome.exe
Token: SeCreatePagefilePrivilege	1356	chrome.exe
Token: SeShutdownPrivilege	1356	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

chrome.exe

pid	process
1356	chrome.exe
1356	chrome.exe
1356	chrome.exe
1356	chrome.exe
1356	chrome.exe
1356	chrome.exe
1356	chrome.exe
1356	chrome.exe
1356	chrome.exe
1356	chrome.exe
1356	chrome.exe
1356	chrome.exe
1356	chrome.exe
1356	chrome.exe
1356	chrome.exe
1356	chrome.exe
1356	chrome.exe
1356	chrome.exe
1356	chrome.exe
1356	chrome.exe
1356	chrome.exe
1356	chrome.exe
1356	chrome.exe
1356	chrome.exe
1356	chrome.exe
1356	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
1356	chrome.exe
1356	chrome.exe
1356	chrome.exe
1356	chrome.exe
1356	chrome.exe
1356	chrome.exe
1356	chrome.exe
1356	chrome.exe
1356	chrome.exe
1356	chrome.exe
1356	chrome.exe
1356	chrome.exe
1356	chrome.exe
1356	chrome.exe
1356	chrome.exe
1356	chrome.exe
1356	chrome.exe
1356	chrome.exe
1356	chrome.exe
1356	chrome.exe
1356	chrome.exe
1356	chrome.exe
1356	chrome.exe
1356	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

2024-07-25_f1f70ba64226076ff5ccc297301d7c93_avoslocker_wapomi.exehvDQNG.execmd.exechrome.exe

description	pid	process	target process
PID 4560 wrote to memory of 2728	4560	2024-07-25_f1f70ba64226076ff5ccc297301d7c93_avoslocker_wapomi.exe	hvDQNG.exe
PID 4560 wrote to memory of 2728	4560	2024-07-25_f1f70ba64226076ff5ccc297301d7c93_avoslocker_wapomi.exe	hvDQNG.exe
PID 4560 wrote to memory of 2728	4560	2024-07-25_f1f70ba64226076ff5ccc297301d7c93_avoslocker_wapomi.exe	hvDQNG.exe
PID 2728 wrote to memory of 812	2728	hvDQNG.exe	cmd.exe
PID 2728 wrote to memory of 812	2728	hvDQNG.exe	cmd.exe
PID 2728 wrote to memory of 812	2728	hvDQNG.exe	cmd.exe
PID 4560 wrote to memory of 1708	4560	2024-07-25_f1f70ba64226076ff5ccc297301d7c93_avoslocker_wapomi.exe	cmd.exe
PID 4560 wrote to memory of 1708	4560	2024-07-25_f1f70ba64226076ff5ccc297301d7c93_avoslocker_wapomi.exe	cmd.exe
PID 4560 wrote to memory of 1708	4560	2024-07-25_f1f70ba64226076ff5ccc297301d7c93_avoslocker_wapomi.exe	cmd.exe
PID 1708 wrote to memory of 3268	1708	cmd.exe	taskkill.exe
PID 1708 wrote to memory of 3268	1708	cmd.exe	taskkill.exe
PID 1708 wrote to memory of 3268	1708	cmd.exe	taskkill.exe
PID 4560 wrote to memory of 1356	4560	2024-07-25_f1f70ba64226076ff5ccc297301d7c93_avoslocker_wapomi.exe	chrome.exe
PID 4560 wrote to memory of 1356	4560	2024-07-25_f1f70ba64226076ff5ccc297301d7c93_avoslocker_wapomi.exe	chrome.exe
PID 1356 wrote to memory of 712	1356	chrome.exe	chrome.exe
PID 1356 wrote to memory of 712	1356	chrome.exe	chrome.exe
PID 1356 wrote to memory of 3700	1356	chrome.exe	chrome.exe
PID 1356 wrote to memory of 3700	1356	chrome.exe	chrome.exe
PID 1356 wrote to memory of 3700	1356	chrome.exe	chrome.exe
PID 1356 wrote to memory of 3700	1356	chrome.exe	chrome.exe
PID 1356 wrote to memory of 3700	1356	chrome.exe	chrome.exe
PID 1356 wrote to memory of 3700	1356	chrome.exe	chrome.exe
PID 1356 wrote to memory of 3700	1356	chrome.exe	chrome.exe
PID 1356 wrote to memory of 3700	1356	chrome.exe	chrome.exe
PID 1356 wrote to memory of 3700	1356	chrome.exe	chrome.exe
PID 1356 wrote to memory of 3700	1356	chrome.exe	chrome.exe
PID 1356 wrote to memory of 3700	1356	chrome.exe	chrome.exe
PID 1356 wrote to memory of 3700	1356	chrome.exe	chrome.exe
PID 1356 wrote to memory of 3700	1356	chrome.exe	chrome.exe
PID 1356 wrote to memory of 3700	1356	chrome.exe	chrome.exe
PID 1356 wrote to memory of 3700	1356	chrome.exe	chrome.exe
PID 1356 wrote to memory of 3700	1356	chrome.exe	chrome.exe
PID 1356 wrote to memory of 3700	1356	chrome.exe	chrome.exe
PID 1356 wrote to memory of 3700	1356	chrome.exe	chrome.exe
PID 1356 wrote to memory of 3700	1356	chrome.exe	chrome.exe
PID 1356 wrote to memory of 3700	1356	chrome.exe	chrome.exe
PID 1356 wrote to memory of 3700	1356	chrome.exe	chrome.exe
PID 1356 wrote to memory of 3700	1356	chrome.exe	chrome.exe
PID 1356 wrote to memory of 3700	1356	chrome.exe	chrome.exe
PID 1356 wrote to memory of 3700	1356	chrome.exe	chrome.exe
PID 1356 wrote to memory of 3700	1356	chrome.exe	chrome.exe
PID 1356 wrote to memory of 3700	1356	chrome.exe	chrome.exe
PID 1356 wrote to memory of 3700	1356	chrome.exe	chrome.exe
PID 1356 wrote to memory of 3700	1356	chrome.exe	chrome.exe
PID 1356 wrote to memory of 3700	1356	chrome.exe	chrome.exe
PID 1356 wrote to memory of 3700	1356	chrome.exe	chrome.exe
PID 1356 wrote to memory of 60	1356	chrome.exe	chrome.exe
PID 1356 wrote to memory of 60	1356	chrome.exe	chrome.exe
PID 1356 wrote to memory of 4148	1356	chrome.exe	chrome.exe
PID 1356 wrote to memory of 4148	1356	chrome.exe	chrome.exe
PID 1356 wrote to memory of 4148	1356	chrome.exe	chrome.exe
PID 1356 wrote to memory of 4148	1356	chrome.exe	chrome.exe
PID 1356 wrote to memory of 4148	1356	chrome.exe	chrome.exe
PID 1356 wrote to memory of 4148	1356	chrome.exe	chrome.exe
PID 1356 wrote to memory of 4148	1356	chrome.exe	chrome.exe
PID 1356 wrote to memory of 4148	1356	chrome.exe	chrome.exe
PID 1356 wrote to memory of 4148	1356	chrome.exe	chrome.exe
PID 1356 wrote to memory of 4148	1356	chrome.exe	chrome.exe
PID 1356 wrote to memory of 4148	1356	chrome.exe	chrome.exe
PID 1356 wrote to memory of 4148	1356	chrome.exe	chrome.exe
PID 1356 wrote to memory of 4148	1356	chrome.exe	chrome.exe
PID 1356 wrote to memory of 4148	1356	chrome.exe	chrome.exe
PID 1356 wrote to memory of 4148	1356	chrome.exe	chrome.exe
PID 1356 wrote to memory of 4148	1356	chrome.exe	chrome.exe

C:\Users\Admin\AppData\Local\Temp\2024-07-25_f1f70ba64226076ff5ccc297301d7c93_avoslocker_wapomi.exe
"C:\Users\Admin\AppData\Local\Temp\2024-07-25_f1f70ba64226076ff5ccc297301d7c93_avoslocker_wapomi.exe"
1⤵
- Drops Chrome extension
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Users\Admin\AppData\Local\Temp\hvDQNG.exe
  C:\Users\Admin\AppData\Local\Temp\hvDQNG.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2728
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\57c35cd8.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:812
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im chrome.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1708
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Checks system information in the registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1356
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa8171cc40,0x7ffa8171cc4c,0x7ffa8171cc58
    3⤵
    - Executes dropped EXE
    PID:712
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1868,i,9665951439767109013,25819635492015305,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=1864 /prefetch:2
    3⤵
    - Executes dropped EXE
    PID:3700
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2136,i,9665951439767109013,25819635492015305,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=2188 /prefetch:3
    3⤵
    - Executes dropped EXE
    PID:60
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2248,i,9665951439767109013,25819635492015305,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=2200 /prefetch:8
    3⤵
    - Executes dropped EXE
    PID:4148
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3112,i,9665951439767109013,25819635492015305,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=3128 /prefetch:1
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:1980
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3132,i,9665951439767109013,25819635492015305,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=3180 /prefetch:1
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:4012
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4544,i,9665951439767109013,25819635492015305,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=4532 /prefetch:1
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:1136
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4732,i,9665951439767109013,25819635492015305,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=4892 /prefetch:8
    3⤵
    - Executes dropped EXE
    PID:3524
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4340,i,9665951439767109013,25819635492015305,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=5004 /prefetch:8
    3⤵
    - Executes dropped EXE
    PID:4280
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1164,i,9665951439767109013,25819635492015305,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=5100 /prefetch:8
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    PID:3336

C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3528

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe

Filesize
1.6MB

MD5
2c99645742665024db8e389c2870bcb9

SHA1
6e556ee19a2a1731ac56b69d0e83257e439a818f

SHA256
ab708ef464fa5e8222459d786512279840efa919b05e66b0f2c473d8db4becee

SHA512
25a7f8434e83341d9f8d68e2f8c7f088f2e84a707fc6db3f18bc1c098a2511380f92d8efde768f5113bc52734f640a08ba356f9a31d551da6ddf58d4884170a5

Download Submit
C:\Program Files\Google\Chrome\Application\chrome.exe

Filesize
2.6MB

MD5
c0e615c4c4f31cc9d9c8e1f7db1fd19e

SHA1
e561a25b4d70209d6f9a98fc6755b7bcbebbfad1

SHA256
bcbb6c63044144a41ced7051ddcd55e60439c72d2de9a230a4c5d5696ba5601d

SHA512
f345c22444c7e3e67fcf4d604b750a44a849881f173e1912ffc5526fc21c3ed9c03aa68a7f3f0c01f6793588fd183319824871fc9d118e4af03ee77a87ca2ae3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
5a0ee3453acd15d48b629646eae78add

SHA1
04619f9ef1784f2557b6acbeaca3c8963b4d9a23

SHA256
a2dd38c9a08eb2b734c0baecd78586c6ea35030ea52b6eeaec41806ad92db2c6

SHA512
caaa126be8bf5774ad2b77b8da643935665b24024147e023761a1477bc724dcfb42c451ed3ad1648fc728b7344868fb0305b9fbec48eda18fca8762acb15c78a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
00a37263d99891e9e6f74a95acd8715f

SHA1
921d7e304d1f456718fbe0d88ae8ce7fd4d3460d

SHA256
1a3ebb40e7a3ff2949f4cbee6f0f267dd3aa5b7f0d6f7f8fdf2790acec8706b0

SHA512
cf790b89b39f934726013b0873f6eb9da9e0b700ea3bc20bfbc75c0bf479272352248da45a147d49ed93df4d55af5b7c56eb941f5c192f032b091265239843dc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
7fd149dd9a48d99b7e90e802f2bf15b1

SHA1
da52a766411776936e51106304e5b1756fee0c05

SHA256
63d0d9ae8b5a32b58843ddbeb81b8ac8ea5af8d39576ad8d11a740c785581603

SHA512
60732de0135dd989c98c12fe6fb8b062d646aaf1037f31b09292de6e7b68a3769e4fe2ef9e812b2de97514345e964172deb8de16f124ba1cdb69deeda7c251dc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
2b2e89250bc20ea37aa0d1936e5b31d8

SHA1
cdd587b58a2b1ac670fb89c2334d03172f59bae5

SHA256
2af0e9ba5ae482d82ff96ad33736b021a1cfb3e093ba9294cf57644e4799a49b

SHA512
1977a8f1efce0b28086c714afbc629bfb09f428c4991104fe876a0a59b3c1290b394b89e1263cffb5e9987f2cffc868635c42e20ec7d4c6e78592afa23d4786e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
47e2303aa73aa5ea8652f36fbffa53b3

SHA1
d4c1a4d622484de37f8a04dfaa55dec47070a088

SHA256
2d9973bfd17c83fe066e0335f047299aceee92af1dab6ec539ec9ed44c8b3235

SHA512
072e7d6449e1023f7dafd0f29b5ec2773fb4748bff9226478e7d8ca26d49e5709552b7b5e66cb7caf94f7183477203b71df25d0016daa867986749e2a8792d73

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
6ac8376ac67d2b9548428db8e0695ee5

SHA1
598a4b138a84ce96dbda5b658ff66205fdb697a2

SHA256
ec944d0cb7240cf5486166dafaf9894483e8ac3184dfec92271fdd2aff51fc2c

SHA512
721beb461ff2901a44b84d52fa9c5406374460bb941a28d5d9d7b4856f3e5409ca2c2943db0c7607011d1cfedfd360e501d963a132e0246e937c3a48568ac259

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
236680aabf019a9182cbfab19c44ab47

SHA1
e42d4ead012304060d9b88401cb1ff43589986c0

SHA256
5edaf44d23db6c85808593c646381a0be093320c723296f3b564299e1d4a1850

SHA512
607bcb90d6b623eac04eaf08d06d136d7403515ecdd984ded6addfc89ea604b166efdcfd807ed9f6e8e896a30454f8a98ea4e4074848e5295fe1a9596181918d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
17KB

MD5
e7ebd8da77053af55ac38fca9cff88e0

SHA1
593253d191958cec8fb58a7d76063a336eeed14e

SHA256
06154ca1940a2b34cd85460d29e9dcee19fa71204fd73f15910dbeb2c9cc14dd

SHA512
305e867f256bfb0a0c098bd64ce1cb1cf1faababcb1c496e6910764f7106d14d09dc964e02055edd155318ed6623ac7a2f40ecb0033d0d8165c0d3fb1740f589

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
17KB

MD5
3773e29da7150b8613a694a95c85ab8b

SHA1
1cf2cce8715174488ec5d0e0fae6322a02823e25

SHA256
539d03e14c5abf93d1f7c74238a22dc800dc67b9c32d9ed4137729f96c75542c

SHA512
1e0890e24df161c265d21daf039caa1770a71e710dc61230e4331991569090ced358877d0de0b095983ebaa61e8fae6fbead7f2e42b921860c459d454a74dfdf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
188KB

MD5
97e54dac039502c07812952a5b29b37b

SHA1
52b31c0e2fb5afac57f8f791992d93c41f2a4372

SHA256
833edfba441b4cb1dcd574c67025a74eaee48ef371c3937dd406770a543a0282

SHA512
a9fc465903ba43f52f9dc5ba39de3f70a726c45a7f795a1f9daf2c7217c10cb8e8892b68aa801431e67faa96f50bfb176756e64b74db13e1848528701c98194c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
188KB

MD5
5b1e5d3555335abe426f575ea63730c2

SHA1
f3d16030cd6d6815d347901130ea79ab28c23a3d

SHA256
fcc83f864779d0430cba606ad9c320de25311737f944237739687f872d24d96a

SHA512
ac2f44317007eee6a5552227df27dbd9086b1af0e10b939483c4880f9b748703fca65dba1cfda6b21e6b302b616b0d368f783af621d90d6f7c65a62deddb86e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MQYRE6E5\k2[1].rar

Filesize
4B

MD5
d3b07384d113edec49eaa6238ad5ff00

SHA1
f1d2d2f924e986ac86fdf7b36c94bcdf32beec15

SHA256
b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c

SHA512
0cf9180a764aba863a67b6d72f0918bc131c6772642cb2dce5a34f0a702f9470ddc2bf125c12198b1995c233c34b4afd346c54a2334c350a948a51b6e8b4e6b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\57c35cd8.bat

Filesize
187B

MD5
383bada5452f18b24389fb6320886168

SHA1
e6d1803a72de910bfb9c6eee3f23e5bc6edeb789

SHA256
e39624859a9e0cb8348da75629fb0bab68a84c6a865a1f0c77fd556a3cc5e600

SHA512
e6bd5f63c1001c5696ac9184e6ba746ea8a5534d106ffa180c8e908614a126fb4b28f4aaef0e64a6548c37febf3082ec5884654d4abd30d18e96b94807458eaf

Download Submit
C:\Users\Admin\AppData\Local\Temp\5E027492.exe

Filesize
4B

MD5
20879c987e2f9a916e578386d499f629

SHA1
c7b33ddcc42361fdb847036fc07e880b81935d5d

SHA256
9f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31

SHA512
bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f

Download Submit
C:\Users\Admin\AppData\Local\Temp\hvDQNG.exe

Filesize
15KB

MD5
f7d21de5c4e81341eccd280c11ddcc9a

SHA1
d4e9ef10d7685d491583c6fa93ae5d9105d815bd

SHA256
4485df22c627fa0bb899d79aa6ff29bc5be1dbc3caa2b7a490809338d54b7794

SHA512
e4553b86b083996038bacfb979ad0b86f578f95185d8efac34a77f6cc73e491d4f70e1449bbc9eb1d62f430800c1574101b270e1cb0eeed43a83049a79b636a3

Download Submit
\??\pipe\crashpad_1356_KWTPPGKCCSVXYRFW

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2728-5-0x0000000000FA0000-0x0000000000FA9000-memory.dmp

Filesize
36KB

Download
memory/2728-47-0x0000000000FA0000-0x0000000000FA9000-memory.dmp

Filesize
36KB

Download
memory/4560-0-0x00000000003B0000-0x0000000000531000-memory.dmp

Filesize
1.5MB

Download
memory/4560-69-0x00000000003B0000-0x0000000000531000-memory.dmp

Filesize
1.5MB

Download
memory/4560-49-0x00000000003B0000-0x0000000000531000-memory.dmp

Filesize
1.5MB

Download