Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/11/2024, 20:17

General

  • Target

    2bc1485a378ab0318666c52734de76dc.exe

  • Size

    651KB

  • MD5

    2bc1485a378ab0318666c52734de76dc

  • SHA1

    0904d272102b4f4b7d273d2ca1f06de4c8680ae7

  • SHA256

    c1f10a812f6faa73971f4fc34a9487ef2e7405e5d958019abd6efd63d47a74aa

  • SHA512

    e86abea71f54c1542c229a6d17e5dcba077503c377412f74d6f5516f66e88b7aa18afc125c451e272098056b4e264fb7b3327a8b4a4dfa07ebf3b9aa3d0415d0

  • SSDEEP

    12288:aI05L9+VustmJwTRBpZOGs1VV1VO/ecGuBEkiEeCxSvZqjVbC:4oLtmJwjOv1VV1mpGublxSBqd

Malware Config

Extracted

Family

stealc

Botnet

LogsDiller

C2

http://95.215.204.109

http://95.215.204.230

Attributes
  • url_path

    /40c4c76100b40ed8.php

Signatures

  • Stealc

    Stealc is an infostealer written in C++.

  • Stealc family
  • Downloads MZ/PE file
  • Uses browser remote debugging 2 TTPs 10 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 7 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 8 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 18 IoCs
  • Suspicious use of FindShellTrayWindow 51 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2bc1485a378ab0318666c52734de76dc.exe
    "C:\Users\Admin\AppData\Local\Temp\2bc1485a378ab0318666c52734de76dc.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4728
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
      2⤵
      • Uses browser remote debugging
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1492
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa81c9cc40,0x7ffa81c9cc4c,0x7ffa81c9cc58
        3⤵
          PID:4088
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1940,i,6712825722636376025,1439211312027337744,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2004 /prefetch:2
          3⤵
            PID:1276
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1844,i,6712825722636376025,1439211312027337744,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2460 /prefetch:3
            3⤵
              PID:2704
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2160,i,6712825722636376025,1439211312027337744,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2560 /prefetch:8
              3⤵
                PID:4152
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3148,i,6712825722636376025,1439211312027337744,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3168 /prefetch:1
                3⤵
                • Uses browser remote debugging
                PID:5092
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3172,i,6712825722636376025,1439211312027337744,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3220 /prefetch:1
                3⤵
                • Uses browser remote debugging
                PID:2152
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4220,i,6712825722636376025,1439211312027337744,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4516 /prefetch:1
                3⤵
                • Uses browser remote debugging
                PID:412
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4616,i,6712825722636376025,1439211312027337744,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4572 /prefetch:8
                3⤵
                  PID:1852
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4268,i,6712825722636376025,1439211312027337744,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4824 /prefetch:8
                  3⤵
                    PID:3876
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4732,i,6712825722636376025,1439211312027337744,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4796 /prefetch:8
                    3⤵
                      PID:2636
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4856,i,6712825722636376025,1439211312027337744,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4964 /prefetch:8
                      3⤵
                        PID:672
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4888,i,6712825722636376025,1439211312027337744,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4852 /prefetch:8
                        3⤵
                          PID:692
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4784,i,6712825722636376025,1439211312027337744,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4848 /prefetch:8
                          3⤵
                            PID:1016
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5288,i,6712825722636376025,1439211312027337744,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5032 /prefetch:8
                            3⤵
                              PID:1708
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4496,i,6712825722636376025,1439211312027337744,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5172 /prefetch:8
                              3⤵
                                PID:4296
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5444,i,6712825722636376025,1439211312027337744,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5252 /prefetch:2
                                3⤵
                                • Uses browser remote debugging
                                PID:3952
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
                              2⤵
                              • Uses browser remote debugging
                              • Enumerates system info in registry
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                              • Suspicious use of FindShellTrayWindow
                              PID:1608
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa825a46f8,0x7ffa825a4708,0x7ffa825a4718
                                3⤵
                                • Checks processor information in registry
                                • Enumerates system info in registry
                                • Suspicious behavior: EnumeratesProcesses
                                PID:3652
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,2333593784591916908,8652190555118612920,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
                                3⤵
                                  PID:4500
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,2333593784591916908,8652190555118612920,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
                                  3⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:4948
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,2333593784591916908,8652190555118612920,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
                                  3⤵
                                    PID:4164
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2108,2333593784591916908,8652190555118612920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
                                    3⤵
                                    • Uses browser remote debugging
                                    PID:4064
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2108,2333593784591916908,8652190555118612920,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3524 /prefetch:1
                                    3⤵
                                    • Uses browser remote debugging
                                    PID:2108
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2108,2333593784591916908,8652190555118612920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3956 /prefetch:1
                                    3⤵
                                    • Uses browser remote debugging
                                    PID:4196
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2108,2333593784591916908,8652190555118612920,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
                                    3⤵
                                    • Uses browser remote debugging
                                    PID:2884
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,2333593784591916908,8652190555118612920,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
                                    3⤵
                                      PID:2132
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,2333593784591916908,8652190555118612920,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
                                      3⤵
                                        PID:2308
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,2333593784591916908,8652190555118612920,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2608 /prefetch:2
                                        3⤵
                                          PID:4304
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,2333593784591916908,8652190555118612920,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2348 /prefetch:2
                                          3⤵
                                            PID:3952
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,2333593784591916908,8652190555118612920,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3604 /prefetch:2
                                            3⤵
                                              PID:444
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,2333593784591916908,8652190555118612920,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=4508 /prefetch:2
                                              3⤵
                                                PID:956
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,2333593784591916908,8652190555118612920,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=3684 /prefetch:2
                                                3⤵
                                                  PID:4712
                                              • C:\Windows\SysWOW64\cmd.exe
                                                "C:\Windows\system32\cmd.exe" /c start "" "C:\ProgramData\DAAAKFHIEG.exe"
                                                2⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:3600
                                                • C:\ProgramData\DAAAKFHIEG.exe
                                                  "C:\ProgramData\DAAAKFHIEG.exe"
                                                  3⤵
                                                  • Executes dropped EXE
                                                  • System Location Discovery: System Language Discovery
                                                  • Checks processor information in registry
                                                  PID:3008
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 3008 -s 1232
                                                    4⤵
                                                    • Program crash
                                                    PID:4712
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 2268
                                                2⤵
                                                • Program crash
                                                PID:4420
                                            • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                              "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                              1⤵
                                                PID:4164
                                              • C:\Windows\system32\svchost.exe
                                                C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                1⤵
                                                  PID:2792
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4728 -ip 4728
                                                  1⤵
                                                    PID:3032
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3008 -ip 3008
                                                    1⤵
                                                      PID:3720

                                                    Network

                                                          MITRE ATT&CK Enterprise v15

                                                          Replay Monitor

                                                          Loading Replay Monitor...

                                                          Downloads

                                                          • C:\ProgramData\DAAAKFHIEG.exe

                                                            Filesize

                                                            651KB

                                                            MD5

                                                            b6b5c883190b5b3673f37458954688a3

                                                            SHA1

                                                            5c78ab3671393286d5b101ab0ec05b6e52994920

                                                            SHA256

                                                            90bf1aea7c89baeed430c90a5d29709fa13391996d6258a3ef7c710431f3e663

                                                            SHA512

                                                            6ea8a3e02af9b60a64a68796640ca2061a3154d936292ed3eabb2717d73801c67a840096e926c9e753ccdacd44de831f2ba642b34badbf839c6d7f8ebdbb7655

                                                          • C:\ProgramData\chrome.dll

                                                            Filesize

                                                            676KB

                                                            MD5

                                                            eda18948a989176f4eebb175ce806255

                                                            SHA1

                                                            ff22a3d5f5fb705137f233c36622c79eab995897

                                                            SHA256

                                                            81a4f37c5495800b7cc46aea6535d9180dadb5c151db6f1fd1968d1cd8c1eeb4

                                                            SHA512

                                                            160ed9990c37a4753fc0f5111c94414568654afbedc05308308197df2a99594f2d5d8fe511fd2279543a869ed20248e603d88a0b9b8fb119e8e6131b0c52ff85

                                                          • C:\ProgramData\mozglue.dll

                                                            Filesize

                                                            593KB

                                                            MD5

                                                            c8fd9be83bc728cc04beffafc2907fe9

                                                            SHA1

                                                            95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                            SHA256

                                                            ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                            SHA512

                                                            fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                                          • C:\ProgramData\nss3.dll

                                                            Filesize

                                                            2.0MB

                                                            MD5

                                                            1cc453cdf74f31e4d913ff9c10acdde2

                                                            SHA1

                                                            6e85eae544d6e965f15fa5c39700fa7202f3aafe

                                                            SHA256

                                                            ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                                                            SHA512

                                                            dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                                                            Filesize

                                                            649B

                                                            MD5

                                                            77c7406eaace7219544f5569470dd29f

                                                            SHA1

                                                            0f7992d928023397ed4cdf54483fe798a5386db4

                                                            SHA256

                                                            79612b71de5f997e49ce322e9a06920e5abc4ed00f0bfac55b2962d7de65943c

                                                            SHA512

                                                            d65ad8ab98dc1550bc306b51ff221a9751151b4bb9f2b239671b34dfd98c8e0ce16db9c3f809ef12cf6de18b2fd680fdb6ba31430d256ac3afeede094f109460

                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.83.1_0\_locales\en_CA\messages.json

                                                            Filesize

                                                            851B

                                                            MD5

                                                            07ffbe5f24ca348723ff8c6c488abfb8

                                                            SHA1

                                                            6dc2851e39b2ee38f88cf5c35a90171dbea5b690

                                                            SHA256

                                                            6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

                                                            SHA512

                                                            7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.83.1_0\dasherSettingSchema.json

                                                            Filesize

                                                            854B

                                                            MD5

                                                            4ec1df2da46182103d2ffc3b92d20ca5

                                                            SHA1

                                                            fb9d1ba3710cf31a87165317c6edc110e98994ce

                                                            SHA256

                                                            6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

                                                            SHA512

                                                            939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                                            Filesize

                                                            2B

                                                            MD5

                                                            d751713988987e9331980363e24189ce

                                                            SHA1

                                                            97d170e1550eee4afc0af065b78cda302a97674c

                                                            SHA256

                                                            4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                            SHA512

                                                            b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\0f082228-d487-41c0-a559-c9376fe1feb5.dmp

                                                            Filesize

                                                            838KB

                                                            MD5

                                                            3c94f904ff72154f1fa9d91aa85839dd

                                                            SHA1

                                                            a6557dfd36ee6f7ce1df8c9f869576401a205a83

                                                            SHA256

                                                            2442ccb52f9a84bacc60c03e33c50862520d69b63608d11107331356a731958d

                                                            SHA512

                                                            887c1f1cbfafe18bf60411181874c13638c5b8db8e3a0f66e8cdae4c2abb68bf5f109e35f0d29483fcfde9ced9094226d0157d27e868b6e490c6bce4ebb62973

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\0f21af13-f41f-4202-9a34-676b7e2db411.dmp

                                                            Filesize

                                                            838KB

                                                            MD5

                                                            04bd0ba3578492eaec82763cd56b0194

                                                            SHA1

                                                            85b4eef7f448f27bcb31830cae223eafcbc449ec

                                                            SHA256

                                                            cf45b74d68c8998e4bb60197571f7dc59e179e0ecb15547da9197332ce0e597f

                                                            SHA512

                                                            084b589a5570ca004d4bb15904fed37c02d208739c17864f36d9adbc611abe626d4cc1e82e4be4cbe646e698946e437640f07cf937bc73736a7fde0728aff28a

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\7ebc2870-3ec5-4a6d-8723-1bee41eb2c41.dmp

                                                            Filesize

                                                            838KB

                                                            MD5

                                                            7ad8281dac8e79a497241a4e13aba3dc

                                                            SHA1

                                                            4e14ce349401dc1c159e42836ad3e8adc3989c9c

                                                            SHA256

                                                            dea39e4e76be60ce7c43e81c23bd6b3c9cc82e1fab72c79d99504b1dafb2252f

                                                            SHA512

                                                            f7cbbf19b8c6f64fad57bb8dcc55833bbac12d6e024ac46cd486fe415ff3cef74c997a84dd25cf4e6c8b6ff2d4a0431926585c566f4593ec058a47f5cb633e2b

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\8e526d7a-0beb-4861-a2d0-9a62b3e5ecf1.dmp

                                                            Filesize

                                                            826KB

                                                            MD5

                                                            75c0e5513b94cb1ea08ed817ee13a3e1

                                                            SHA1

                                                            7b1c44eb2b6a6b1dd46a4f12ba5c3802009b220e

                                                            SHA256

                                                            46141fe9de47e55b8ae15ba91280f1b9454c46a3cdcbce7a8f4c60deeb16dd57

                                                            SHA512

                                                            57e12f7919fd4c6d11b883977bba937a14b5fbba636ecaf95087d4977d80a667d72ae66b30f26a18fc46a1ad9236798d793ba8847690d7adc2a5566ac4790efb

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\999ab739-b75b-421f-8dd4-bb2f968a6701.dmp

                                                            Filesize

                                                            826KB

                                                            MD5

                                                            1bed361275ec8e66b8825915e8dd1035

                                                            SHA1

                                                            9ffdcbfb3909f283f09226f523b512bcaf253c7c

                                                            SHA256

                                                            cbd09eb16cac3d21ceb1cb121469591446284421e152a7ad6cfc06af77e4f50b

                                                            SHA512

                                                            337c3bcccfc4f4bf55dc2ae39ed07f29c4bebab9142e2568c7233e252477cb8a2a59da83562a492b05f4fcfe74a48e6798221f77290c46a179b3f64a0c63df32

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\ba90290d-5543-4bf6-bdc0-c4dc55c86b6a.dmp

                                                            Filesize

                                                            830KB

                                                            MD5

                                                            fb209ecac0cb831a88d0f46708a05ad4

                                                            SHA1

                                                            8ea364c0feb15ee5e55086b1e7ca0dc10aba04f8

                                                            SHA256

                                                            3d014f03e0c1d897face8687f4036db291c5873428c493501b53d7d83c8b66c3

                                                            SHA512

                                                            1f3560d0f599d32e4a0e41472f08c4682a7714fcdf3aa2c978a6cf288f059c11ea7e075940f67075c09ed710aae89e81caefc3008b2c17b8983934ae0d05c9a2

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\f4c231da-0cb3-4ff2-afa3-7026cd31a467.dmp

                                                            Filesize

                                                            830KB

                                                            MD5

                                                            3d735839c042d7f6bca6de2407112b61

                                                            SHA1

                                                            1ead93192679b0e6a0f5aaecbc4bbca7c1cd6109

                                                            SHA256

                                                            67bb4e3de61ee3e85924a5b7dd1e041681af9535ab4479f3b6952ced77deda91

                                                            SHA512

                                                            906ef17db2b8a216ad5a7552d17c7a59c53f112a434372cd942abaff5f40d1f60858f14f34ac417d2cd36e391460d99d2b1cddcec0d1176a8fe381da6bbea967

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                            Filesize

                                                            152B

                                                            MD5

                                                            7de1bbdc1f9cf1a58ae1de4951ce8cb9

                                                            SHA1

                                                            010da169e15457c25bd80ef02d76a940c1210301

                                                            SHA256

                                                            6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e

                                                            SHA512

                                                            e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                            Filesize

                                                            152B

                                                            MD5

                                                            85ba073d7015b6ce7da19235a275f6da

                                                            SHA1

                                                            a23c8c2125e45a0788bac14423ae1f3eab92cf00

                                                            SHA256

                                                            5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617

                                                            SHA512

                                                            eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                            Filesize

                                                            152B

                                                            MD5

                                                            3fa394c60b383e101daef39f12b1c6e3

                                                            SHA1

                                                            9cbe773a30e9e112e6adb75e316ff26a2a76f47a

                                                            SHA256

                                                            2dbca453bba5ad54e5f34dc9e6005a79291b34b715f254364fcd8045eca54cf5

                                                            SHA512

                                                            5ad53aa09f3984b7aa5919a6b9a58871dc2ade6bde8798d583ada7b9a9f7a108d522c432a507833265d9229597c47a019e3310466a1c05d8a9c8e3a341f61dfb

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                            Filesize

                                                            152B

                                                            MD5

                                                            eae6774ab49725f30bc57fe0924db42a

                                                            SHA1

                                                            b1cc389a2e0bedffa807bacec4c9e4573627f366

                                                            SHA256

                                                            b2a95c455a2fb514bd0806e83c51a255181adf2e5394c8e462a70784a79e52e2

                                                            SHA512

                                                            599773cecf9115c562a8b9ea00235e8cfa3cfb6a0e1933c86d10b4925bf13f6b60cc01220bb97ac9ff2c388c9f3fd98fa638f39663d54578742cb22318a369af

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\86a2bd55-f3e5-491b-8ac4-e24ff485e70f.tmp

                                                            Filesize

                                                            1B

                                                            MD5

                                                            5058f1af8388633f609cadb75a75dc9d

                                                            SHA1

                                                            3a52ce780950d4d969792a2559cd519d7ee8c727

                                                            SHA256

                                                            cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

                                                            SHA512

                                                            0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                            Filesize

                                                            5KB

                                                            MD5

                                                            bd9e169ae1626344463bdd64cf489ec2

                                                            SHA1

                                                            657660a6d92649cc64496d8825b2772629980d8b

                                                            SHA256

                                                            eaa3cf35cd371e802dfa0064ab7f7350ad470d9d1cc5e434f5975bb2b7aa1779

                                                            SHA512

                                                            e2b02d6d35503ee00a6b7d8500f853a38eb6239e05eb2920467ae0d910cf093151e279083637af99dab8bfc889f3574dfe2803e1a0721acb5414d66bbcb90222

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

                                                            Filesize

                                                            264KB

                                                            MD5

                                                            f50f89a0a91564d0b8a211f8921aa7de

                                                            SHA1

                                                            112403a17dd69d5b9018b8cede023cb3b54eab7d

                                                            SHA256

                                                            b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                                            SHA512

                                                            bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                                          • C:\Users\Admin\AppData\Local\Temp\scoped_dir1492_478752469\8b301a1f-82b2-4fb7-9d67-ac8278d10dca.tmp

                                                            Filesize

                                                            132KB

                                                            MD5

                                                            da75bb05d10acc967eecaac040d3d733

                                                            SHA1

                                                            95c08e067df713af8992db113f7e9aec84f17181

                                                            SHA256

                                                            33ae9b8f06dc777bb1a65a6ba6c3f2a01b25cd1afc291426b46d1df27ea6e7e2

                                                            SHA512

                                                            56533de53872f023809a20d1ea8532cdc2260d40b05c5a7012c8e61576ff092f006a197f759c92c6b8c429eeec4bb542073b491ddcfd5b22cd4ecbe1a8a7c6ef

                                                          • C:\Users\Admin\AppData\Local\Temp\scoped_dir1492_478752469\CRX_INSTALL\_locales\en_CA\messages.json

                                                            Filesize

                                                            711B

                                                            MD5

                                                            558659936250e03cc14b60ebf648aa09

                                                            SHA1

                                                            32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

                                                            SHA256

                                                            2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

                                                            SHA512

                                                            1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

                                                          • memory/3008-870-0x0000000000400000-0x0000000002BA7000-memory.dmp

                                                            Filesize

                                                            39.7MB

                                                          • memory/3008-868-0x0000000000400000-0x0000000002BA7000-memory.dmp

                                                            Filesize

                                                            39.7MB

                                                          • memory/4728-63-0x00000000047B0000-0x000000000488A000-memory.dmp

                                                            Filesize

                                                            872KB

                                                          • memory/4728-494-0x0000000000400000-0x0000000002BA7000-memory.dmp

                                                            Filesize

                                                            39.7MB

                                                          • memory/4728-58-0x0000000002E10000-0x0000000002F10000-memory.dmp

                                                            Filesize

                                                            1024KB

                                                          • memory/4728-62-0x0000000000400000-0x0000000002BA7000-memory.dmp

                                                            Filesize

                                                            39.7MB

                                                          • memory/4728-4-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                                            Filesize

                                                            972KB

                                                          • memory/4728-3-0x0000000000400000-0x00000000006ED000-memory.dmp

                                                            Filesize

                                                            2.9MB

                                                          • memory/4728-2-0x00000000047B0000-0x000000000488A000-memory.dmp

                                                            Filesize

                                                            872KB

                                                          • memory/4728-867-0x0000000000400000-0x00000000006ED000-memory.dmp

                                                            Filesize

                                                            2.9MB

                                                          • memory/4728-865-0x0000000000400000-0x0000000002BA7000-memory.dmp

                                                            Filesize

                                                            39.7MB

                                                          • memory/4728-866-0x0000000000400000-0x0000000002BA7000-memory.dmp

                                                            Filesize

                                                            39.7MB

                                                          • memory/4728-74-0x0000000000400000-0x00000000006ED000-memory.dmp

                                                            Filesize

                                                            2.9MB

                                                          • memory/4728-1-0x0000000002E10000-0x0000000002F10000-memory.dmp

                                                            Filesize

                                                            1024KB