Overview
overview
10Static
static
10setup_inst...32.exe
windows7-x64
10setup_inst...32.exe
windows10-2004-x64
10setup_inst...2b.exe
windows7-x64
7setup_inst...2b.exe
windows10-2004-x64
7setup_inst...61.exe
windows7-x64
1setup_inst...61.exe
windows10-2004-x64
1setup_inst...f8.exe
windows7-x64
10setup_inst...f8.exe
windows10-2004-x64
10setup_inst...34.exe
windows7-x64
6setup_inst...34.exe
windows10-2004-x64
6setup_inst...c2.exe
windows7-x64
3setup_inst...c2.exe
windows10-2004-x64
7setup_inst...cb.exe
windows7-x64
10setup_inst...cb.exe
windows10-2004-x64
10setup_inst...90.exe
windows7-x64
6setup_inst...90.exe
windows10-2004-x64
6setup_inst...79.exe
windows7-x64
10setup_inst...79.exe
windows10-2004-x64
10setup_inst...d8.exe
windows7-x64
10setup_inst...d8.exe
windows10-2004-x64
10setup_inst...3b.exe
windows7-x64
7setup_inst...3b.exe
windows10-2004-x64
7setup_inst...ac.exe
windows7-x64
6setup_inst...ac.exe
windows10-2004-x64
6setup_inst...38.exe
windows7-x64
10setup_inst...38.exe
windows10-2004-x64
10setup_inst...b5.exe
windows7-x64
3setup_inst...b5.exe
windows10-2004-x64
3setup_inst...b2.exe
windows7-x64
6setup_inst...b2.exe
windows10-2004-x64
7setup_inst...rl.dll
windows7-x64
3setup_inst...rl.dll
windows10-2004-x64
3Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11-11-2024 09:28
Behavioral task
behavioral1
Sample
setup_installer/Wed0901eb1dae126e32.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
setup_installer/Wed0901eb1dae126e32.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
setup_installer/Wed094c47c32b.exe
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
setup_installer/Wed094c47c32b.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
setup_installer/Wed096a1bff61.exe
Resource
win7-20241023-en
Behavioral task
behavioral6
Sample
setup_installer/Wed096a1bff61.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
setup_installer/Wed0971f17486f8.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
setup_installer/Wed0971f17486f8.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
setup_installer/Wed09977fdc12334.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
setup_installer/Wed09977fdc12334.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
setup_installer/Wed09abf83d9c2.exe
Resource
win7-20241010-en
Behavioral task
behavioral12
Sample
setup_installer/Wed09abf83d9c2.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
setup_installer/Wed09b2a8bc4f16cb.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
setup_installer/Wed09b2a8bc4f16cb.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
setup_installer/Wed09b3a5ca1a712d390.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
setup_installer/Wed09b3a5ca1a712d390.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
setup_installer/Wed09c42cad92c20f79.exe
Resource
win7-20241010-en
Behavioral task
behavioral18
Sample
setup_installer/Wed09c42cad92c20f79.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
setup_installer/Wed09cfb2f9758281d8.exe
Resource
win7-20240729-en
Behavioral task
behavioral20
Sample
setup_installer/Wed09cfb2f9758281d8.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
setup_installer/Wed09d27135e5a8b3b.exe
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
setup_installer/Wed09d27135e5a8b3b.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
setup_installer/Wed09d8d6edfaff2ac.exe
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
setup_installer/Wed09d8d6edfaff2ac.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
setup_installer/Wed09db0d52c38.exe
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
setup_installer/Wed09db0d52c38.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
setup_installer/Wed09e95ff6b5.exe
Resource
win7-20240708-en
Behavioral task
behavioral28
Sample
setup_installer/Wed09e95ff6b5.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
setup_installer/Wed09f257bb7877d00b2.exe
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
setup_installer/Wed09f257bb7877d00b2.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
setup_installer/libcurl.dll
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
setup_installer/libcurl.dll
Resource
win10v2004-20241007-en
General
-
Target
setup_installer/Wed09db0d52c38.exe
-
Size
1.4MB
-
MD5
5810fe95f7fb43baf96de0e35f814d6c
-
SHA1
696118263629f3cdf300934ebc3499d1c14e0233
-
SHA256
45904081a41de45b5be01f59c5ebc0d9f6d577cea971d3b8ea2246df6036d8a9
-
SHA512
832c66baff50e389294628855729955eb156479faa45080cba88ece0ee035aeef32717432e63823cbb0f0e9088b90f017a5e2888b11a0f9ede2c9ff00f605ed1
-
SSDEEP
24576:oop4e+P7hGI5Yn3H4pIkOIkWsRhehSrob1gBckkcf6XKYQcjxW:xpQcZ62sa9kk6XKYQcdW
Malware Config
Signatures
-
Socelars family
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops Chrome extension 1 IoCs
Processes:
Wed09db0d52c38.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\hemlmgggokggmncimchkllhcjcaimcle\9.86.66_0\manifest.json Wed09db0d52c38.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Wed09db0d52c38.execmd.exetaskkill.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Wed09db0d52c38.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 4832 taskkill.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133757909287574964" chrome.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
chrome.exechrome.exepid process 2076 chrome.exe 2076 chrome.exe 3616 chrome.exe 3616 chrome.exe 3616 chrome.exe 3616 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
Processes:
chrome.exepid process 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
Wed09db0d52c38.exetaskkill.exechrome.exedescription pid process Token: SeCreateTokenPrivilege 4496 Wed09db0d52c38.exe Token: SeAssignPrimaryTokenPrivilege 4496 Wed09db0d52c38.exe Token: SeLockMemoryPrivilege 4496 Wed09db0d52c38.exe Token: SeIncreaseQuotaPrivilege 4496 Wed09db0d52c38.exe Token: SeMachineAccountPrivilege 4496 Wed09db0d52c38.exe Token: SeTcbPrivilege 4496 Wed09db0d52c38.exe Token: SeSecurityPrivilege 4496 Wed09db0d52c38.exe Token: SeTakeOwnershipPrivilege 4496 Wed09db0d52c38.exe Token: SeLoadDriverPrivilege 4496 Wed09db0d52c38.exe Token: SeSystemProfilePrivilege 4496 Wed09db0d52c38.exe Token: SeSystemtimePrivilege 4496 Wed09db0d52c38.exe Token: SeProfSingleProcessPrivilege 4496 Wed09db0d52c38.exe Token: SeIncBasePriorityPrivilege 4496 Wed09db0d52c38.exe Token: SeCreatePagefilePrivilege 4496 Wed09db0d52c38.exe Token: SeCreatePermanentPrivilege 4496 Wed09db0d52c38.exe Token: SeBackupPrivilege 4496 Wed09db0d52c38.exe Token: SeRestorePrivilege 4496 Wed09db0d52c38.exe Token: SeShutdownPrivilege 4496 Wed09db0d52c38.exe Token: SeDebugPrivilege 4496 Wed09db0d52c38.exe Token: SeAuditPrivilege 4496 Wed09db0d52c38.exe Token: SeSystemEnvironmentPrivilege 4496 Wed09db0d52c38.exe Token: SeChangeNotifyPrivilege 4496 Wed09db0d52c38.exe Token: SeRemoteShutdownPrivilege 4496 Wed09db0d52c38.exe Token: SeUndockPrivilege 4496 Wed09db0d52c38.exe Token: SeSyncAgentPrivilege 4496 Wed09db0d52c38.exe Token: SeEnableDelegationPrivilege 4496 Wed09db0d52c38.exe Token: SeManageVolumePrivilege 4496 Wed09db0d52c38.exe Token: SeImpersonatePrivilege 4496 Wed09db0d52c38.exe Token: SeCreateGlobalPrivilege 4496 Wed09db0d52c38.exe Token: 31 4496 Wed09db0d52c38.exe Token: 32 4496 Wed09db0d52c38.exe Token: 33 4496 Wed09db0d52c38.exe Token: 34 4496 Wed09db0d52c38.exe Token: 35 4496 Wed09db0d52c38.exe Token: SeDebugPrivilege 4832 taskkill.exe Token: SeShutdownPrivilege 2076 chrome.exe Token: SeCreatePagefilePrivilege 2076 chrome.exe Token: SeShutdownPrivilege 2076 chrome.exe Token: SeCreatePagefilePrivilege 2076 chrome.exe Token: SeShutdownPrivilege 2076 chrome.exe Token: SeCreatePagefilePrivilege 2076 chrome.exe Token: SeShutdownPrivilege 2076 chrome.exe Token: SeCreatePagefilePrivilege 2076 chrome.exe Token: SeShutdownPrivilege 2076 chrome.exe Token: SeCreatePagefilePrivilege 2076 chrome.exe Token: SeShutdownPrivilege 2076 chrome.exe Token: SeCreatePagefilePrivilege 2076 chrome.exe Token: SeShutdownPrivilege 2076 chrome.exe Token: SeCreatePagefilePrivilege 2076 chrome.exe Token: SeShutdownPrivilege 2076 chrome.exe Token: SeCreatePagefilePrivilege 2076 chrome.exe Token: SeShutdownPrivilege 2076 chrome.exe Token: SeCreatePagefilePrivilege 2076 chrome.exe Token: SeShutdownPrivilege 2076 chrome.exe Token: SeCreatePagefilePrivilege 2076 chrome.exe Token: SeShutdownPrivilege 2076 chrome.exe Token: SeCreatePagefilePrivilege 2076 chrome.exe Token: SeShutdownPrivilege 2076 chrome.exe Token: SeCreatePagefilePrivilege 2076 chrome.exe Token: SeShutdownPrivilege 2076 chrome.exe Token: SeCreatePagefilePrivilege 2076 chrome.exe Token: SeShutdownPrivilege 2076 chrome.exe Token: SeCreatePagefilePrivilege 2076 chrome.exe Token: SeShutdownPrivilege 2076 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe 2076 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Wed09db0d52c38.execmd.exechrome.exedescription pid process target process PID 4496 wrote to memory of 3436 4496 Wed09db0d52c38.exe cmd.exe PID 4496 wrote to memory of 3436 4496 Wed09db0d52c38.exe cmd.exe PID 4496 wrote to memory of 3436 4496 Wed09db0d52c38.exe cmd.exe PID 3436 wrote to memory of 4832 3436 cmd.exe taskkill.exe PID 3436 wrote to memory of 4832 3436 cmd.exe taskkill.exe PID 3436 wrote to memory of 4832 3436 cmd.exe taskkill.exe PID 4496 wrote to memory of 2076 4496 Wed09db0d52c38.exe chrome.exe PID 4496 wrote to memory of 2076 4496 Wed09db0d52c38.exe chrome.exe PID 2076 wrote to memory of 3148 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 3148 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 3776 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 3776 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 3776 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 3776 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 3776 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 3776 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 3776 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 3776 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 3776 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 3776 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 3776 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 3776 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 3776 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 3776 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 3776 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 3776 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 3776 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 3776 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 3776 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 3776 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 3776 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 3776 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 3776 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 3776 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 3776 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 3776 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 3776 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 3776 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 3776 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 3776 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 3868 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 3868 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 4528 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 4528 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 4528 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 4528 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 4528 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 4528 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 4528 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 4528 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 4528 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 4528 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 4528 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 4528 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 4528 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 4528 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 4528 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 4528 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 4528 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 4528 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 4528 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 4528 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 4528 2076 chrome.exe chrome.exe PID 2076 wrote to memory of 4528 2076 chrome.exe chrome.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup_installer\Wed09db0d52c38.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer\Wed09db0d52c38.exe"1⤵
- Drops Chrome extension
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4832
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"2⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffff846cc40,0x7ffff846cc4c,0x7ffff846cc583⤵PID:3148
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1856,i,9421900835783662441,11684518526042440307,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1848 /prefetch:23⤵PID:3776
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1824,i,9421900835783662441,11684518526042440307,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2096 /prefetch:33⤵PID:3868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2252,i,9421900835783662441,11684518526042440307,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2224 /prefetch:83⤵PID:4528
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3148,i,9421900835783662441,11684518526042440307,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3192 /prefetch:13⤵PID:2872
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3156,i,9421900835783662441,11684518526042440307,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3208 /prefetch:13⤵PID:2220
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4564,i,9421900835783662441,11684518526042440307,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4520 /prefetch:13⤵PID:5028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4744,i,9421900835783662441,11684518526042440307,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4768 /prefetch:83⤵PID:4140
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4904,i,9421900835783662441,11684518526042440307,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4912 /prefetch:83⤵PID:2376
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4972,i,9421900835783662441,11684518526042440307,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4964 /prefetch:83⤵PID:1304
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4776,i,9421900835783662441,11684518526042440307,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4796 /prefetch:83⤵PID:3972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4724,i,9421900835783662441,11684518526042440307,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4696 /prefetch:83⤵PID:1672
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5220,i,9421900835783662441,11684518526042440307,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5232 /prefetch:83⤵PID:1580
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5224,i,9421900835783662441,11684518526042440307,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4656 /prefetch:83⤵PID:4172
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5256,i,9421900835783662441,11684518526042440307,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5140 /prefetch:83⤵PID:3412
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5396,i,9421900835783662441,11684518526042440307,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5276 /prefetch:23⤵PID:2376
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5280,i,9421900835783662441,11684518526042440307,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5232 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:3616
-
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:3416
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:1892
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
649B
MD5be99c97ee7b4689fcb347cba2c8b980c
SHA10474871973d111ceb8ab3ba6f7e695ad03bb961d
SHA256f044328b1d19ab3ab6db38cff6a908c98599ef38258d93575ae09f0bfbc37bc9
SHA5129c2d0150cad799bf073345665e4edb444c69ed233cc5e551cf15463303d8edc29e72fa9f22b39a9835954ea8595e60522afc1aabc31abe6a45c34d4a165cc971
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.83.1_0\_locales\en_CA\messages.json
Filesize851B
MD507ffbe5f24ca348723ff8c6c488abfb8
SHA16dc2851e39b2ee38f88cf5c35a90171dbea5b690
SHA2566895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c
SHA5127ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.83.1_0\dasherSettingSchema.json
Filesize854B
MD54ec1df2da46182103d2ffc3b92d20ca5
SHA1fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA2566c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
SHA512939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
-
Filesize
2KB
MD5dc6148c321c3b0461a0197514989afb6
SHA1e246cdf29769aebc0baa6264efd1b7fec7991827
SHA256781a09fd4eab5bed5d81492580b4cf5f948491f67463b2162edfe721e214cac4
SHA512b951a70135fac2c7f430f2de18f4fc539d21113d13dd300c5f01ff0287af44e9cf15d921b8e4c19858f957db8d4164a6da45ee1754fbebb1f80914c4cdd4fdb9
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
356B
MD50eb40ea879646393cc2f439108fe7d33
SHA1247cc0b1cdfe3a41dc00ea1a9cc872c482e3b755
SHA25613aff694a5735db40097aee41177a9c9bceb36220e40424d3ca568954d468383
SHA5123fcacc41966adfb2cc407d1f9f26008e2a5900899b79fd19bc19339eafabae98cf352378ac0354517253681c94e46690d1f54e5ddc7f4ff090491841f0c2c134
-
Filesize
9KB
MD5131fb3f0828a39bfdaa7de0dd3c3f186
SHA156d61b407b342afb59ac41c3082e5aea93bbcdb8
SHA25655b1163d7d9df4a3d80fbd3a02dc59504c633b24837b6ae181205907bc25b93e
SHA5120a63e50ba6968e84c68e0a7094dd499abe51d3e2ac6e8fb28e55d9c6c07996d54b60c413b32aa97b236919b6cbb88586afa297da41cb30d16b15c47123465421
-
Filesize
9KB
MD5a7abbb191a4226ac8e9d9dd604f899ed
SHA1defd272c65c333681a7437dec99f046b69a013c8
SHA256616fcef3c0ac8296e506bf7c741cfe9eeffaa56150bfb186a712152f620e8dc0
SHA512937424bae3e2bfca4ce068bd4a011d213c71c2362118f89b4aaed47cecdda7c2253eb4ff1c6eb46c61b0c9a00626765dd30d91117c89e09685f658415c36cba8
-
Filesize
9KB
MD5b4133c435daa68294978e2168a25e5d4
SHA16ba43b0d9978a48779d46b76ec796fc43dbfe8d9
SHA256600101eed503a89b2ef24bf44ebe20f23b7bdc7567710d154c9e1a3af53a3536
SHA512beeb8bb682cd0f58349e87e9a52b3280d9504c29fe238a63b5bfa69cc3820b155f576fce46d33eba8ea83a886465215eb076eb1247c35a3e5c6ef7d6b9aa5d41
-
Filesize
9KB
MD547fe52e1e31c5e985232287d2dd5f96d
SHA1c6a5dcb647c13cb52e94bb85cb183d46b0cd96a2
SHA256cbcf7c874e27b6fd8c0912bd84f84e05ce1be3d93e2dc8fb50a39d6cc2473fe0
SHA512fd4aff4789cc5a61296f7cf92fa783926e04529252fde51ceb8d5c866af440847be22126430a843f4b253a51282f2c0fb3fcef118a99567eaccbf52b51193bd0
-
Filesize
18KB
MD54e52a7e6ab05faaaf0e0c605191c63e2
SHA1c464190eb817eac2de38fa811d0d0772fe8f5d19
SHA256c062762a6f174bfe3bf436cee08376113d2fef597ba32e583e1c54c2c5e5eac0
SHA51286107d0c56b6130cb56e6814e6b18f7790ba0398b89ec13203515765a84f4acaa360205fa253439084affcfa7ea38dbfd073249c7c5dd9d12e921e7a582ec0e9
-
Filesize
19KB
MD5e11f24ae7f06e7c8448cecef71bcc237
SHA196f1821f053049b745b4d729370fb3db276d59b2
SHA25687eaa0fdb7be4f26ea364f1835a639d641dfceeb4e7f0aa0945b545c83337cdb
SHA5122ea25b60a6a94e2fcf88c5f8cac6616fa1a85b53358e53d9085387d823ec2a9766b10d97f59d594d69e7730dac5cd0b5a6c079cd9eb124d786989cf6d1370604
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize72B
MD548a139a520597dbafc8ac128d7acc83c
SHA188691b6f2ee44341178d5981f64cd7a546055ae6
SHA256dbd69ae435343d0cd52dfef39e2b81fe6b3ae5cc2d597ed62b22ab169769a852
SHA51291136fd76b6dbf7a6f28184af6387defc0a2ef62a8d4a6a96baefc03400bfb0a4be6f9f9a08716f7d19cb035b91e92fd297f3a49551e4a89521200ff69914822
-
Filesize
232KB
MD585be8f3856639024fde5a5a52194734a
SHA174ad593c3a46a0b8c6a4c877745c48403d8d22dc
SHA2561c5b6d645e6a1f259efe5766d5f112aee89c7082e0aff5018c1bda04cab240f9
SHA5126e2babde21f5cd8a1c571968f44d31cc952c4dd1fb320c415822fe30eef7f036e9e67c90d20baa9743675863625887541a58ffe04cc81f9566f5b692ff6b4a2c
-
Filesize
232KB
MD5a6abcd4c66cf2019e7211864fed3df5f
SHA16822d9b3136b091d8807da8bd343ae83379f895f
SHA2566ddd94b2ca8ea29aa06fd646bc896bfe6bae499ef2bea26ed421597b1a22dfc3
SHA512c2e9dc3908963f18a9cdfe62d3070e7f92e91cc8e41dadd60bffdbce53c0f4344eed543fbd3c0282f10123d107d2750ddb89910d7906ceae1a868397deaba45b
-
Filesize
132KB
MD5da75bb05d10acc967eecaac040d3d733
SHA195c08e067df713af8992db113f7e9aec84f17181
SHA25633ae9b8f06dc777bb1a65a6ba6c3f2a01b25cd1afc291426b46d1df27ea6e7e2
SHA51256533de53872f023809a20d1ea8532cdc2260d40b05c5a7012c8e61576ff092f006a197f759c92c6b8c429eeec4bb542073b491ddcfd5b22cd4ecbe1a8a7c6ef
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir2076_2137306157\CRX_INSTALL\_locales\en_CA\messages.json
Filesize711B
MD5558659936250e03cc14b60ebf648aa09
SHA132f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA2562445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
SHA5121632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e