Analysis
-
max time kernel
188s -
max time network
189s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2024 19:34
Static task
static1
General
-
Target
Bootstrapper.exe
-
Size
800KB
-
MD5
02c70d9d6696950c198db93b7f6a835e
-
SHA1
30231a467a49cc37768eea0f55f4bea1cbfb48e2
-
SHA256
8f2e28588f2303bd8d7a9b0c3ff6a9cb16fa93f8ddc9c5e0666a8c12d6880ee3
-
SHA512
431d9b9918553bff4f4a5bc2a5e7b7015f8ad0e2d390bb4d5264d08983372424156524ef5587b24b67d1226856fc630aaca08edc8113097e0094501b4f08efeb
-
SSDEEP
12288:qhd8cjaLXVh84wEFkW1mocaBj6WtiRPpptHxQ0z:2ycjar84w5W4ocaBj6y2tHDz
Malware Config
Signatures
-
A potential corporate email address has been identified in the URL: [email protected]
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation Bootstrapper.exe -
Executes dropped EXE 1 IoCs
pid Process 1892 Solara.exe -
Loads dropped DLL 11 IoCs
pid Process 4740 MsiExec.exe 4740 MsiExec.exe 5040 MsiExec.exe 5040 MsiExec.exe 5040 MsiExec.exe 5040 MsiExec.exe 5040 MsiExec.exe 2104 MsiExec.exe 2104 MsiExec.exe 2104 MsiExec.exe 4740 MsiExec.exe -
Unexpected DNS network traffic destination 45 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 -
Blocklisted process makes network request 2 IoCs
flow pid Process 40 2912 msiexec.exe 43 2912 msiexec.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 65 pastebin.com 66 pastebin.com -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 301 api.ipify.org 303 api.ipify.org -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\nodejs\node_modules\npm\node_modules\function-bind\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@isaacs\string-locale-compare\LICENSE msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\readable-stream\lib\_stream_transform.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\nopt\lib\nopt.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmdiff\lib\format-diff.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\make-fetch-happen\lib\remote.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npm-query.html msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\minimatch\dist\mjs\index.js.map msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\cli-columns\license msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\semver\functions\rsort.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\depd\lib\compat\index.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\semver\ranges\subset.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\promise-spawn\LICENSE msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\wide-align\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\ca\verify\index.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\diff\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\MSVSUtil.py msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\make-fetch-happen\lib\agent.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\qrcode-terminal\lib\main.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\hosted-git-info\lib\parse-url.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\make-fetch-happen\lib\dns.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\events\tests\symbols.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\semver\ranges\min-satisfying.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\chalk\index.d.ts msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\lib\cli.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmpublish\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\package-json\lib\update-workspaces.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\tuf\trustroot.d.ts msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmversion\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\is-cidr\LICENSE msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\debug\src\common.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\man\man1\npm-owner.1 msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\readable-stream\readable.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\are-we-there-yet\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\minipass-fetch\LICENSE msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\tlog\index.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmsearch\README.md msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\concat-map\LICENSE msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\ca\verify\chain.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\https-proxy-agent\dist\index.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\mkdirp\readme.markdown msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\name-from-folder\lib\index.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\semver\README.md msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\lib\link-bins.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\iconv-lite\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\x509\verify.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-link.md msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\tuf-js\dist\utils\config.d.ts msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-uninstall.md msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\path-is-absolute\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\cacache\lib\util\move-file.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\gyp\CONTRIBUTING.md msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\cacache\lib\content\read.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\lib\utils\config\definition.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\lib\utils\npm-usage.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\make-fetch-happen\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\iconv-lite\encodings\tables\shiftjis.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\supports-color\index.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\npm-packlist\lib\index.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\lib\deepest-nesting-target.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\abort-controller\browser.mjs msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmpack\lib\index.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\semver\node_modules\lru-cache\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\docs\content\using-npm\removal.md msiexec.exe -
Drops file in Windows directory 21 IoCs
description ioc Process File created C:\Windows\Installer\e57cf37.msi msiexec.exe File opened for modification C:\Windows\Installer\MSID498.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIE6BC.tmp msiexec.exe File opened for modification C:\Windows\Installer\{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}\NodeIcon msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSID438.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID477.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIDC59.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIDEFB.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE6FC.tmp msiexec.exe File created C:\Windows\Installer\e57cf3b.msi msiexec.exe File created C:\Windows\Installer\SourceHash{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC} msiexec.exe File opened for modification C:\Windows\Installer\MSIAA4.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1052.tmp msiexec.exe File opened for modification C:\Windows\Installer\e57cf37.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIDEBB.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8AE.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI94B.tmp msiexec.exe File created C:\Windows\Installer\{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}\NodeIcon msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wevtutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 3264 ipconfig.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008110495d4aa4cb41b6757eb2472c6e5100000000020000000000106600000001000020000000c1f22d72febf11797f3d1ba9fae95997834365846dd5b0d1016f7c419cd7ec20000000000e8000000002000020000000a8cc89f7daae04271029061b58f1c3d3464d0df3b1d527ca833e66fa6a8c7d3e20000000d3a7ce42b83f5ddabf098dcb8011cc04d18c57cffad31dea3756b7287438fd88400000001c12aada81759325be9400aefd965ba75341826c5ef87eb9b8157b2cb8fa7bf2939a0fe1608c3c4b81b521f141406d18451ded53fba0b2125aa5280e9d2c0936 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{D97DB045-C09B-11EF-A7EA-CA65FB447F0B} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2916308469" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2916308469" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008110495d4aa4cb41b6757eb2472c6e51000000000200000000001066000000010000200000009831aea9c4cb75b033937200aae2938e985317fa2600604fab215980f20c38b2000000000e8000000002000020000000d46d197573e0e7e14f3553d969440a6813ea2a84929e095f97a9773e4bc3dc09200000005d6810760ec0f114a5febcd19e058a181584781f2a6097ca80033636bfdd87c8400000003b7ce81d40dfed16e82a368d18453dab6e33421905695e8db110a33c9b5fd27c45fbb61b7ca4cb7823b09d3f319cf01c366cf315e8fae0d138c922b36a343f58 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31151272" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40a98daea854db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31151272" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50ee88aea854db01 iexplore.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133793697359611019" chrome.exe -
Modifies registry class 31 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\Version = "303038464" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\EnvironmentPathNode = "EnvironmentPath" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\ProductName = "Node.js" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A3A70C74FE2431248AD5F8A59570C782\5B532AFE1A6C6E24B99C208A5DF6C1CD msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\corepack msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\PackageCode = "347C7A52EDBDC9A498427C0BC7ABB536" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\PackageName = "node-v18.16.0-x64.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\EnvironmentPathNpmModules = "EnvironmentPath" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3350944739-639801879-157714471-1000\{160EB058-415C-48CA-8E22-1EB9DE13FA53} chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\DocumentationShortcuts msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\EnvironmentPath msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\NodeEtwSupport = "NodeRuntime" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\Net msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A3A70C74FE2431248AD5F8A59570C782 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\Language = "1033" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\ProductIcon = "C:\\Windows\\Installer\\{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}\\NodeIcon" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\NodeRuntime msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\npm msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\DeploymentFlags = "3" msiexec.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 4600 Bootstrapper.exe 4600 Bootstrapper.exe 2912 msiexec.exe 2912 msiexec.exe 1892 Solara.exe 4676 chrome.exe 4676 chrome.exe 5808 chrome.exe 5808 chrome.exe 5808 chrome.exe 5808 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs
pid Process 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1716 WMIC.exe Token: SeSecurityPrivilege 1716 WMIC.exe Token: SeTakeOwnershipPrivilege 1716 WMIC.exe Token: SeLoadDriverPrivilege 1716 WMIC.exe Token: SeSystemProfilePrivilege 1716 WMIC.exe Token: SeSystemtimePrivilege 1716 WMIC.exe Token: SeProfSingleProcessPrivilege 1716 WMIC.exe Token: SeIncBasePriorityPrivilege 1716 WMIC.exe Token: SeCreatePagefilePrivilege 1716 WMIC.exe Token: SeBackupPrivilege 1716 WMIC.exe Token: SeRestorePrivilege 1716 WMIC.exe Token: SeShutdownPrivilege 1716 WMIC.exe Token: SeDebugPrivilege 1716 WMIC.exe Token: SeSystemEnvironmentPrivilege 1716 WMIC.exe Token: SeRemoteShutdownPrivilege 1716 WMIC.exe Token: SeUndockPrivilege 1716 WMIC.exe Token: SeManageVolumePrivilege 1716 WMIC.exe Token: 33 1716 WMIC.exe Token: 34 1716 WMIC.exe Token: 35 1716 WMIC.exe Token: 36 1716 WMIC.exe Token: SeIncreaseQuotaPrivilege 1716 WMIC.exe Token: SeSecurityPrivilege 1716 WMIC.exe Token: SeTakeOwnershipPrivilege 1716 WMIC.exe Token: SeLoadDriverPrivilege 1716 WMIC.exe Token: SeSystemProfilePrivilege 1716 WMIC.exe Token: SeSystemtimePrivilege 1716 WMIC.exe Token: SeProfSingleProcessPrivilege 1716 WMIC.exe Token: SeIncBasePriorityPrivilege 1716 WMIC.exe Token: SeCreatePagefilePrivilege 1716 WMIC.exe Token: SeBackupPrivilege 1716 WMIC.exe Token: SeRestorePrivilege 1716 WMIC.exe Token: SeShutdownPrivilege 1716 WMIC.exe Token: SeDebugPrivilege 1716 WMIC.exe Token: SeSystemEnvironmentPrivilege 1716 WMIC.exe Token: SeRemoteShutdownPrivilege 1716 WMIC.exe Token: SeUndockPrivilege 1716 WMIC.exe Token: SeManageVolumePrivilege 1716 WMIC.exe Token: 33 1716 WMIC.exe Token: 34 1716 WMIC.exe Token: 35 1716 WMIC.exe Token: 36 1716 WMIC.exe Token: SeDebugPrivilege 4600 Bootstrapper.exe Token: SeShutdownPrivilege 2864 msiexec.exe Token: SeIncreaseQuotaPrivilege 2864 msiexec.exe Token: SeSecurityPrivilege 2912 msiexec.exe Token: SeCreateTokenPrivilege 2864 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2864 msiexec.exe Token: SeLockMemoryPrivilege 2864 msiexec.exe Token: SeIncreaseQuotaPrivilege 2864 msiexec.exe Token: SeMachineAccountPrivilege 2864 msiexec.exe Token: SeTcbPrivilege 2864 msiexec.exe Token: SeSecurityPrivilege 2864 msiexec.exe Token: SeTakeOwnershipPrivilege 2864 msiexec.exe Token: SeLoadDriverPrivilege 2864 msiexec.exe Token: SeSystemProfilePrivilege 2864 msiexec.exe Token: SeSystemtimePrivilege 2864 msiexec.exe Token: SeProfSingleProcessPrivilege 2864 msiexec.exe Token: SeIncBasePriorityPrivilege 2864 msiexec.exe Token: SeCreatePagefilePrivilege 2864 msiexec.exe Token: SeCreatePermanentPrivilege 2864 msiexec.exe Token: SeBackupPrivilege 2864 msiexec.exe Token: SeRestorePrivilege 2864 msiexec.exe Token: SeShutdownPrivilege 2864 msiexec.exe -
Suspicious use of FindShellTrayWindow 27 IoCs
pid Process 3952 iexplore.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe 4676 chrome.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3952 iexplore.exe 3952 iexplore.exe 2072 IEXPLORE.EXE 2072 IEXPLORE.EXE 2072 IEXPLORE.EXE 2072 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4600 wrote to memory of 744 4600 Bootstrapper.exe 84 PID 4600 wrote to memory of 744 4600 Bootstrapper.exe 84 PID 744 wrote to memory of 3264 744 cmd.exe 86 PID 744 wrote to memory of 3264 744 cmd.exe 86 PID 4600 wrote to memory of 4004 4600 Bootstrapper.exe 89 PID 4600 wrote to memory of 4004 4600 Bootstrapper.exe 89 PID 4004 wrote to memory of 1716 4004 cmd.exe 91 PID 4004 wrote to memory of 1716 4004 cmd.exe 91 PID 4600 wrote to memory of 2864 4600 Bootstrapper.exe 98 PID 4600 wrote to memory of 2864 4600 Bootstrapper.exe 98 PID 2912 wrote to memory of 4740 2912 msiexec.exe 104 PID 2912 wrote to memory of 4740 2912 msiexec.exe 104 PID 2912 wrote to memory of 5040 2912 msiexec.exe 105 PID 2912 wrote to memory of 5040 2912 msiexec.exe 105 PID 2912 wrote to memory of 5040 2912 msiexec.exe 105 PID 2912 wrote to memory of 2104 2912 msiexec.exe 111 PID 2912 wrote to memory of 2104 2912 msiexec.exe 111 PID 2912 wrote to memory of 2104 2912 msiexec.exe 111 PID 2104 wrote to memory of 4692 2104 MsiExec.exe 112 PID 2104 wrote to memory of 4692 2104 MsiExec.exe 112 PID 2104 wrote to memory of 4692 2104 MsiExec.exe 112 PID 4692 wrote to memory of 2652 4692 wevtutil.exe 114 PID 4692 wrote to memory of 2652 4692 wevtutil.exe 114 PID 4600 wrote to memory of 1892 4600 Bootstrapper.exe 120 PID 4600 wrote to memory of 1892 4600 Bootstrapper.exe 120 PID 3952 wrote to memory of 2072 3952 iexplore.exe 129 PID 3952 wrote to memory of 2072 3952 iexplore.exe 129 PID 3952 wrote to memory of 2072 3952 iexplore.exe 129 PID 4676 wrote to memory of 3728 4676 chrome.exe 134 PID 4676 wrote to memory of 3728 4676 chrome.exe 134 PID 4676 wrote to memory of 1528 4676 chrome.exe 135 PID 4676 wrote to memory of 1528 4676 chrome.exe 135 PID 4676 wrote to memory of 1528 4676 chrome.exe 135 PID 4676 wrote to memory of 1528 4676 chrome.exe 135 PID 4676 wrote to memory of 1528 4676 chrome.exe 135 PID 4676 wrote to memory of 1528 4676 chrome.exe 135 PID 4676 wrote to memory of 1528 4676 chrome.exe 135 PID 4676 wrote to memory of 1528 4676 chrome.exe 135 PID 4676 wrote to memory of 1528 4676 chrome.exe 135 PID 4676 wrote to memory of 1528 4676 chrome.exe 135 PID 4676 wrote to memory of 1528 4676 chrome.exe 135 PID 4676 wrote to memory of 1528 4676 chrome.exe 135 PID 4676 wrote to memory of 1528 4676 chrome.exe 135 PID 4676 wrote to memory of 1528 4676 chrome.exe 135 PID 4676 wrote to memory of 1528 4676 chrome.exe 135 PID 4676 wrote to memory of 1528 4676 chrome.exe 135 PID 4676 wrote to memory of 1528 4676 chrome.exe 135 PID 4676 wrote to memory of 1528 4676 chrome.exe 135 PID 4676 wrote to memory of 1528 4676 chrome.exe 135 PID 4676 wrote to memory of 1528 4676 chrome.exe 135 PID 4676 wrote to memory of 1528 4676 chrome.exe 135 PID 4676 wrote to memory of 1528 4676 chrome.exe 135 PID 4676 wrote to memory of 1528 4676 chrome.exe 135 PID 4676 wrote to memory of 1528 4676 chrome.exe 135 PID 4676 wrote to memory of 1528 4676 chrome.exe 135 PID 4676 wrote to memory of 1528 4676 chrome.exe 135 PID 4676 wrote to memory of 1528 4676 chrome.exe 135 PID 4676 wrote to memory of 1528 4676 chrome.exe 135 PID 4676 wrote to memory of 1528 4676 chrome.exe 135 PID 4676 wrote to memory of 1528 4676 chrome.exe 135 PID 4676 wrote to memory of 2228 4676 chrome.exe 136 PID 4676 wrote to memory of 2228 4676 chrome.exe 136 PID 4676 wrote to memory of 640 4676 chrome.exe 137 PID 4676 wrote to memory of 640 4676 chrome.exe 137
Processes
-
C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Windows\SYSTEM32\cmd.exe"cmd" /c ipconfig /all2⤵
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:3264
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c wmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("1.1.1.1", "1.0.0.1")2⤵
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Windows\System32\Wbem\WMIC.exewmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("1.1.1.1", "1.0.0.1")3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1716
-
-
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi" /qn2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2864
-
-
C:\ProgramData\Solara\Solara.exe"C:\ProgramData\Solara\Solara.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1892
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 25C84A20A443E1E3279D1C7F50F6C7102⤵
- Loads dropped DLL
PID:4740
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding E0C4981B805229987514198A22AD9CC52⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5040
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A38F63F163CDF11B92D5CAB20D6ADF6B E Global\MSI00002⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Windows\SysWOW64\wevtutil.exe"wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Windows\System32\wevtutil.exe"wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man" /fromwow644⤵PID:2652
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\SendDisconnect.gif1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3952 CREDAT:17410 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2072
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1532
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff9977ccc40,0x7ff9977ccc4c,0x7ff9977ccc582⤵PID:3728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1832,i,5480202517799719826,13474995736116360751,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1844 /prefetch:22⤵PID:1528
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2128,i,5480202517799719826,13474995736116360751,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2176 /prefetch:32⤵PID:2228
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=1764,i,5480202517799719826,13474995736116360751,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2300 /prefetch:82⤵PID:640
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3136,i,5480202517799719826,13474995736116360751,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3144 /prefetch:12⤵PID:852
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3236,i,5480202517799719826,13474995736116360751,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3164 /prefetch:12⤵PID:4412
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3128,i,5480202517799719826,13474995736116360751,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4528 /prefetch:12⤵PID:2012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4864,i,5480202517799719826,13474995736116360751,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4812 /prefetch:82⤵PID:3296
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4872,i,5480202517799719826,13474995736116360751,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4812 /prefetch:82⤵PID:3088
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5160,i,5480202517799719826,13474995736116360751,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4900 /prefetch:82⤵PID:3656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5300,i,5480202517799719826,13474995736116360751,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5156 /prefetch:82⤵PID:2372
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5304,i,5480202517799719826,13474995736116360751,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5196 /prefetch:82⤵PID:1484
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5320,i,5480202517799719826,13474995736116360751,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5172 /prefetch:82⤵PID:4916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5644,i,5480202517799719826,13474995736116360751,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4664 /prefetch:22⤵PID:5512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5084,i,5480202517799719826,13474995736116360751,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5124 /prefetch:12⤵PID:6036
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=3320,i,5480202517799719826,13474995736116360751,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5396 /prefetch:82⤵PID:5600
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3448,i,5480202517799719826,13474995736116360751,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5496 /prefetch:82⤵
- Modifies registry class
PID:5592
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5356,i,5480202517799719826,13474995736116360751,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4776 /prefetch:12⤵PID:1484
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=4364,i,5480202517799719826,13474995736116360751,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3168 /prefetch:12⤵PID:3960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=5636,i,5480202517799719826,13474995736116360751,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5400 /prefetch:12⤵PID:3048
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=5200,i,5480202517799719826,13474995736116360751,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4660 /prefetch:12⤵PID:5464
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=5768,i,5480202517799719826,13474995736116360751,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3360 /prefetch:12⤵PID:3904
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=5772,i,5480202517799719826,13474995736116360751,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5172 /prefetch:12⤵PID:2804
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=5164,i,5480202517799719826,13474995736116360751,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5056 /prefetch:12⤵PID:3440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=5376,i,5480202517799719826,13474995736116360751,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5572 /prefetch:12⤵PID:5284
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5968,i,5480202517799719826,13474995736116360751,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5560 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5808
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:4196
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:5056
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
MD504f0a036675a5c8728edaf05978d944f
SHA11a4484e0d71896e32566a68dc140b7eb9ebda72b
SHA256ec95ecb34f27d5c65b51029042f330781f64cf8c281cc06071af582623641cfb
SHA512b532604eabeac7928749ad3f190f9cafd81e03c9793aeb5a43e35fa06e16da0b70c7ce8b6fb086df789c10853207453716869868414ad62acfb7b007c5310aea
-
Filesize
10KB
MD51d51e18a7247f47245b0751f16119498
SHA178f5d95dd07c0fcee43c6d4feab12d802d194d95
SHA2561975aa34c1050b8364491394cebf6e668e2337c3107712e3eeca311262c7c46f
SHA5121eccbe4ddae3d941b36616a202e5bd1b21d8e181810430a1c390513060ae9e3f12cd23f5b66ae0630fd6496b3139e2cc313381b5506465040e5a7a3543444e76
-
Filesize
8KB
MD5d3bc164e23e694c644e0b1ce3e3f9910
SHA11849f8b1326111b5d4d93febc2bafb3856e601bb
SHA2561185aaa5af804c6bc6925f5202e68bb2254016509847cd382a015907440d86b4
SHA51291ebff613f4c35c625bb9b450726167fb77b035666ed635acf75ca992c4846d952655a2513b4ecb8ca6f19640d57555f2a4af3538b676c3bd2ea1094c4992854
-
Filesize
818B
MD52916d8b51a5cc0a350d64389bc07aef6
SHA1c9d5ac416c1dd7945651bee712dbed4d158d09e1
SHA256733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04
SHA512508c5d1842968c478e6b42b94e04e0b53a342dfaf52d55882fdcfe02c98186e9701983ab5e9726259fba8336282e20126c70d04fc57964027586a40e96c56b74
-
Filesize
1KB
MD55ad87d95c13094fa67f25442ff521efd
SHA101f1438a98e1b796e05a74131e6bb9d66c9e8542
SHA25667292c32894c8ac99db06ffa1cb8e9a5171ef988120723ebe673bf76712260ec
SHA5127187720ccd335a10c9698f8493d6caa2d404e7b21731009de5f0da51ad5b9604645fbf4bc640aa94513b9eb372aa6a31df2467198989234bc2afbce87f76fbc3
-
Filesize
754B
MD5d2cf52aa43e18fdc87562d4c1303f46a
SHA158fb4a65fffb438630351e7cafd322579817e5e1
SHA25645e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0
SHA51254e33d7998b5e9ba76b2c852b4d0493ebb1b1ee3db777c97e6606655325ff66124a0c0857ca4d62de96350dbaee8d20604ec22b0edc17b472086da4babbbcb16
-
Filesize
771B
MD5e9dc66f98e5f7ff720bf603fff36ebc5
SHA1f2b428eead844c4bf39ca0d0cf61f6b10aeeb93b
SHA256b49c8d25a8b57fa92b2902d09c4b8a809157ee32fc10d17b7dbb43c4a8038f79
SHA5128027d65e1556511c884cb80d3c1b846fc9d321f3f83002664ad3805c4dee8e6b0eaf1db81c459153977bdbde9e760b0184ba6572f68d78c37bff617646bcfc3b
-
Filesize
730B
MD5072ac9ab0c4667f8f876becedfe10ee0
SHA10227492dcdc7fb8de1d14f9d3421c333230cf8fe
SHA2562ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013
SHA512f38fd6506bd9795bb27d31f1ce38b08c9e6f1689c34fca90e9e1d5194fa064d1f34a9c51d15941506ebbbcd6d4193055e9664892521b7e39ebcd61c3b6f25013
-
C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-pipeline\node_modules\minipass\package.json
Filesize1KB
MD5d116a360376e31950428ed26eae9ffd4
SHA1192b8e06fb4e1f97e5c5c7bf62a9bff7704c198b
SHA256c3052bd85910be313e38ad355528d527b565e70ef15a784db3279649eee2ded5
SHA5125221c7648f4299234a4637c47d3f1eb5e147014704913bc6fdad91b9b6a6ccc109bced63376b82b046bb5cad708464c76fb452365b76dbf53161914acf8fb11a
-
Filesize
802B
MD5d7c8fab641cd22d2cd30d2999cc77040
SHA1d293601583b1454ad5415260e4378217d569538e
SHA25604400db77d925de5b0264f6db5b44fe6f8b94f9419ad3473caaa8065c525c0be
SHA512278ff929904be0c19ee5fb836f205e3e5b3e7cec3d26dd42bbf1e7e0ca891bf9c42d2b28fce3741ae92e4a924baf7490c7c6c59284127081015a82e2653e0764
-
Filesize
16KB
MD5bc0c0eeede037aa152345ab1f9774e92
SHA156e0f71900f0ef8294e46757ec14c0c11ed31d4e
SHA2567a395802fbe01bb3dc8d09586e0864f255874bf897378e546444fbaec29f54c5
SHA5125f31251825554bf9ed99eda282fa1973fcec4a078796a10757f4fb5592f2783c4ebdd00bdf0d7ed30f82f54a7668446a372039e9d4589db52a75060ca82186b3
-
Filesize
780B
MD5b020de8f88eacc104c21d6e6cacc636d
SHA120b35e641e3a5ea25f012e13d69fab37e3d68d6b
SHA2563f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706
SHA5124220617e29dd755ad592295bc074d6bc14d44a1feeed5101129669f3ecf0e34eaa4c7c96bbc83da7352631fa262baab45d4a370dad7dabec52b66f1720c28e38
-
Filesize
763B
MD57428aa9f83c500c4a434f8848ee23851
SHA1166b3e1c1b7d7cb7b070108876492529f546219f
SHA2561fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7
SHA512c7f01de85f0660560206784cdf159b2bdc5f1bc87131f5a8edf384eba47a113005491520b0a25d3cc425985b5def7b189e18ff76d7d562c434dc5d8c82e90cce
-
C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\index.d.ts
Filesize4KB
MD5f0bd53316e08991d94586331f9c11d97
SHA1f5a7a6dc0da46c3e077764cfb3e928c4a75d383e
SHA256dd3eda3596af30eda88b4c6c2156d3af6e7fa221f39c46e492c5e9fb697e2fef
SHA512fd6affbaed67d09cf45478f38e92b8ca6c27650a232cbbeaff36e4f7554fb731ae44cf732378641312e98221539e3d8fabe80a7814e4f425026202de44eb5839
-
Filesize
771B
MD51d7c74bcd1904d125f6aff37749dc069
SHA121e6dfe0fffc2f3ec97594aa261929a3ea9cf2ab
SHA25624b8d53712087b867030d18f2bd6d1a72c78f9fb4dee0ce025374da25e4443b9
SHA512b5ac03addd29ba82fc05eea8d8d09e0f2fa9814d0dd619c2f7b209a67d95b538c3c2ff70408641ef3704f6a14e710e56f4bf57c2bb3f8957ba164f28ee591778
-
Filesize
168B
MD5db7dbbc86e432573e54dedbcc02cb4a1
SHA1cff9cfb98cff2d86b35dc680b405e8036bbbda47
SHA2567cf8a9c96f9016132be81fd89f9573566b7dc70244a28eb59d573c2fdba1def9
SHA5128f35f2e7dac250c66b209acecab836d3ecf244857b81bacebc214f0956ec108585990f23ff3f741678e371b0bee78dd50029d0af257a3bb6ab3b43df1e39f2ec
-
Filesize
695KB
MD5195ffb7167db3219b217c4fd439eedd6
SHA11e76e6099570ede620b76ed47cf8d03a936d49f8
SHA256e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
SHA51256eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
-
Filesize
133KB
MD5c6f770cbb24248537558c1f06f7ff855
SHA1fdc2aaae292c32a58ea4d9974a31ece26628fdd7
SHA256d1e4a542fa75f6a6fb636b5de6f7616e2827a79556d3d9a4afc3ecb47f0beb2b
SHA512cac56c58bd01341ec3ff102fe04fdb66625baad1d3dd7127907cd8453d2c6e2226ad41033e16ba20413a509fc7c826e4fdc0c0d553175eb6f164c2fc0906614a
-
Filesize
5.2MB
MD5aead90ab96e2853f59be27c4ec1e4853
SHA143cdedde26488d3209e17efff9a51e1f944eb35f
SHA25646cfbe804b29c500ebc0b39372e64c4c8b4f7a8e9b220b5f26a9adf42fcb2aed
SHA512f5044f2ee63906287460b9adabfcf3c93c60b51c86549e33474c4d7f81c4f86cd03cd611df94de31804c53006977874b8deb67c4bf9ea1c2b70c459b3a44b38d
-
Filesize
649B
MD53b89d49df4798e63d490aeedac25ce08
SHA1de96904f074bb14d07466278960a6aba6dc8426d
SHA256a242c14eebcbf5a4c5dd1f06f505d171bed27b6a7a963249040935ed2f569f51
SHA5129c92a3238f87e26c1820317b1c70a7ec1d84c42d71a2d7f982a35b645d1a994a3ee64083f968a4b28d75a1764a0b6a0808934e4a96aefd23c3b9560086550d12
-
Filesize
4KB
MD5c217e348b1b4a937129a9c5f458689c6
SHA124f22b7bd34d6ddd10258861f5a6784a7cff21bb
SHA25662eaf0054a036d37a9ef93ff7e94ae4b6da858ce2d0d6c956b86865248411933
SHA5120b1a8dbbd501609aeff79c2e659f90b63ccaec7d73d452fb3040a3c9b5793be3ba870be822afaa43dee911fe0a46ad20445d0785da57d8f004b9931acff2352c
-
Filesize
4KB
MD570c991af640900699697ee7404e0b8a1
SHA14f3d0f4e83fd02945b752e56a8ba48ea332d4481
SHA2569843cf1d243a78f3fc180192576e84c5cb75ca3ee528bbf4edeb3e1117f06397
SHA512fbeaca6846ff015de6ab520b145ade52bd0e9c84c6b140afd42b87afa127db9d20576bd364c69143a35be8c3da30492d6743080bef45439a8b89eb6c9efe4994
-
Filesize
1KB
MD56e9cd3d718053db8ad2d29335fb5245f
SHA19f753bc757a508c2f1377c566d9862fb7f612989
SHA2561d60f0b6ae507e48cbac2d9f268bfeccaf1a23fe0c03c245db44dd8a545bbce7
SHA51297befb2cbac5b0b6094b2852b6e80a2e42791203dfcaa6d561a357e335ec0af31a54e349c848aeede03883d5a84cdd4baa7747cd5cf9f8ef73823c50c1dc4e87
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.85.1_0\_locales\en\messages.json
Filesize851B
MD507ffbe5f24ca348723ff8c6c488abfb8
SHA16dc2851e39b2ee38f88cf5c35a90171dbea5b690
SHA2566895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c
SHA5127ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.85.1_0\dasherSettingSchema.json
Filesize854B
MD54ec1df2da46182103d2ffc3b92d20ca5
SHA1fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA2566c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
SHA512939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\CURRENT
Filesize16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\MANIFEST-000001
Filesize23B
MD53fd11ff447c1ee23538dc4d9724427a3
SHA11335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA256720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
SHA51210a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
-
Filesize
14KB
MD5d72d61b92fcaa682c6ba3eafeeb9765c
SHA1da182a91d23843794ccb7335e421ba963118513b
SHA25609594b14deadaa2173b9a4b55530d92e37d3a73e8c14ac96c4a7618b05221f4f
SHA512bf4f488aa3dcbc245f5d08baae67d61830bdf0eaeb7e66af3a56f4233e5a2407d2bae16ee01b53aec368870930d95e20145e14acff80f9d790d4a60fb134e502
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
1KB
MD569186f2479d6e39888cf241cb438cc49
SHA151414629eb65b1af78bde652d178df9ce6092ce1
SHA256d0c3edd8d94589fdeb382261c2be76f29775295b692ea273672c399ee49dd4ee
SHA512b4d4660ce6ec32c9a2099e40adcde0d550f083c48dca5511a0c612a701c3033344c2893f17eebf05ca10f5d7a01e5054d5c9a8a9835f73909540bdddb5d97eca
-
Filesize
5KB
MD527728b70a4dd1fce00e9a831f0156b55
SHA1ffeb450ee25d75a31d4633abeb0ab01dc0685423
SHA2561b1df0e974ef1f641c05b5115eec82ae0a7f16e574fc8a816b49b505f70187e7
SHA512c1e03bb4bc0c9e145782f4f94bb13db6d5532db157a188426a7563ab791b59177bb3a1ec9f11a2f626c47ffbd711ab8b58d12523b76fd1cc4f8eea8293d69b5b
-
Filesize
4KB
MD538fc0536a762f31bded6336fa661a942
SHA12753ea538d92dc3a731da3b523bc927314175a42
SHA256b6ebd857b4ffb4c5d53af7f43c7264116e837b5b95df669fc790c56914a3b2ca
SHA5125395b08573a095f4cc05023b677fa2dd889117139e34d2fd426d1d5236cce923bc642e667ef30bbe07ce2ebfc4f3e1256f6c0d8d9ba7c31ecbb4129fbc80d942
-
Filesize
1KB
MD5c373951c43b489b9bf60bed146625e72
SHA1b1d54e1faef6f9ade11a3bfb069a103dc45ffe9d
SHA2569de234d6fb101b7885acb2c58ab5c8d1f320e2092cd235e52c38d9a3995e2ed8
SHA51211911498621473acf4bbdd7211983269c14a9486fa1f491999e177c4ceed050b589c6c670b942a5085ec1134c35b501ccabd6238bc1fd46bf2b9db44ce991cf4
-
Filesize
1KB
MD5becd087e363ee565e77deb6affaa0ad0
SHA12916d6492b46dd7f002ada70d56fa3e854bc6352
SHA25645dab9631c2bc9c52a576bb6721f2d3339f45cabfd3146c8b44a4e30469b7fa3
SHA512443cdd3d84b52ed6a4a3b52c7c2190c87af359b3fc806ce5b4425a51bec7ddaf29d2413fa9b4862a4d71be1d95d9a0bc88ea5ccfed915adfa762a1f22d97eb72
-
Filesize
3KB
MD5b74f6b6ad7b1267e250bb15cb9b64d14
SHA118ff7310b84abb0103139a6997779d5efe09b184
SHA2562b8903151f8557abbbd95e1e5180fb9641490ce83992db1452c24f89443ed703
SHA512b6aaa03e85c4528fca23d554336caa7e44c6387b150a5cb0ec84df8f43e71333e23ebcdc4c0db770426792f8197dac42cd33a44804611fec7ac835393f74dd41
-
Filesize
5KB
MD5c07ba50bab93a753696ae624071e5f4d
SHA15a65a41e14c85b481d617b5fa8a47e9962f9cbe2
SHA2560b7c3de19a9bdb57893735ed0dd54ecc0428fd626fa031b9f96b5bc55fa82d19
SHA512715753f01138820eb6e512c6f8fb67da78fd1ca74f11163a9d3d671756e40b06c0121d02369019eab624d20c4567b127dfe4900b52ed5d22f2ec64f4e437727e
-
Filesize
5KB
MD565db9a20caa4ca1520dd6cd091f516c0
SHA1ecba617a1ad7e19722af690ea220fd22bf1fe239
SHA25688f5e3a5cebfec1c2b5e326331da81f99d238a5c1920774f54cc1ea18854bcf0
SHA512e302c8250a16a811c7c2fe0bbe03869577cf5acf43c0f716cea9079a773e2d6b7bcd558a1149d0bb078f6cfc30b4cbd52680d0e19acc075c1af8a3868ffde738
-
Filesize
9KB
MD54db489801166a24145b989786159a63b
SHA1f90b60ebd6ad3cc09bf7a73a2d675b074fc36a82
SHA256895b0d42b935007d271fe080d289c8ef7ac0493d8aa2b3aaf98e7b40ec8eb16c
SHA512caad38283d83d904fef62b1c20aac305132cbd497607ebc5d58e53fb3af9a94c326bb62d6e72e7d9e2c2b1f2ebb2563d1a4ee699bb1d9cdb127d08681310ba1d
-
Filesize
9KB
MD5af482f0b200283e0e7870e52cf781a9b
SHA11a011566136c7ffeb5a9bf7a8675d4954d998e6e
SHA25637035fedca8ec8b431edf41b9cc76fd9a148749d58a83d53f1dc06cad3a9bfe6
SHA512c4f2d951e1ea9df6ed9ccf26933724190c73467745923801bb7930095a49c4d0a77a3fbcba26ffe78e789aa1e6fb8f8ace46ab4fc246f76d321acde01accfe6d
-
Filesize
11KB
MD5070115a75b06e21013fb83df35d658f2
SHA1194d43698fc4a90d2aff3636e799faa9264fbbcf
SHA25616bc660480f753fd5189aa070d9580fed3a8096c9112fb12eeaf002b6919293b
SHA512ab6bfa3a31c95956f8b452d1c451f9394c9f137f8512f72a8a01799a6b9805cc897f136ed48a57480a39065343c870a2558bad6434e0c9fdd804d3c643767979
-
Filesize
10KB
MD5c2d834c836c3e787573966972750ed1d
SHA117536d15bc8b8bd21fd46e155e6b66db5e0fb1b6
SHA25649577657b16d971d44a602e4ce8ca456c6d868a5722c13b3f7f3aac540fe157a
SHA512d645ab88fe1b209d6fb4dbf0161e30ee8b25d28d45107ca2d95edc701685e2bcc4e3658d963ad6c8f3ba32459d36968ff06751046b8a750b96b55ee1213fdd08
-
Filesize
9KB
MD5a34c2467f53efa1ab03b85b03d150d37
SHA143eb4c55704f32bbcee618c5ee3cc1d881365508
SHA25667801cd08ae46d10de95daae32ca8aa8f5d61db054e3f9a265e3a4a3aebe7f7a
SHA51297005a846eb553d9cf6f95571141c52fa2a6cc46926ca7b89aa9155a865d510f2746061044fdf02172df9d6306ba67498c7c727d8c767626d73c52e1be29b540
-
Filesize
10KB
MD512ed82a7b324a3e74d1cae3098874c9f
SHA17b84821a95440db0c57b09e5366e07c75ccf2a71
SHA256757d31317c2d5ec0a93665e8a1c64ef2bcffc89b3ecbd99062eef824d4f7488d
SHA5122e9e2fcffd1b2cb3317db4a3e9493757995a0315bf6aa843ab47cd91a1dddc08ee3ed83d7a12498c666c9e6be2eaab9ebf32bb7d273499135c19438229c76f5e
-
Filesize
10KB
MD5f243a951085791b74595d9eae2bc30ce
SHA165ac93ef9c855f7fbc6d31388ff046f6bedcca2d
SHA2569209a1212fa037ab5a9dac3906ca6e058fdc4e20dbb1948bf19386eb56b54c47
SHA512108a33691522fbface2478473e053b9f357fbf54fbc5f5e0ae3a2a6bd25ce688f95633c1ff7f2f167370ee8a2dedb27afdce75e312b1f1d6693ac0ddef2fab14
-
Filesize
9KB
MD5198df638c52a74135545cc6e935e2e78
SHA186d1d20ab7f54643f284e11f7a10aa846fe81dcd
SHA2563c98c28299289cb949c91f6f3baccf87df16153c348ff126a0b8c3e8159081b7
SHA5129a9af79a0efefde23ba1e7f75f481a27bebeff416a2484674cc38c1c573e54a3c84451b6044edf18ef90ca9d89e16e16add2f58859cb533b9a3c795caf18246f
-
Filesize
15KB
MD5c0244fafb5f89c4797d5d3901203a48b
SHA187176ff954fd6eee09bf4258b0d268d4ce88a3a3
SHA25696b27d8a15a08410e42a759430f3fa0ba87cbfbc3afdb342a06378acdf2dd7f1
SHA512276a8b12ef98a8badab51bb888e0db63b8309a3d7064b2a38397901aa2d1109813af490e6e4773c8363ad3a4577f17c60b2ac52b44a148e8e9fc66f63cd2ed36
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize72B
MD5d449186bcc5d2eab4625a96e8574dec0
SHA1516655d6bbdb7172af14c5e5478b321cc8c1c620
SHA25646e86994a29bf2a974ff2cee0ab146884913707c9ae90b795a1cbd9de362ddff
SHA5120faf0d6405b8684382f9212de3437834eaa0906297d955e8d9f7afb2de56f4afafa0905c9f69e20e6db428681d9c8675b25ae03b803e0214d299ae0c61e8b0d1
-
Filesize
231KB
MD56cd3ea27e03379835d80e82b3307fbe3
SHA1f6cdd3e110cd1b87da5acf028f40352fe7c9d723
SHA256b362d427644735bb747a8a5fd4455292315245110eff72cf49786b8a0d061470
SHA512ed529aa268875e8cd9e7e02f6cbedd5b784717ee766610dc3aed56ffcbf169b2761b7c1261a6a8da774fd5332d05d03ee682095d5836afeca1a1fd7bfdabe64c
-
Filesize
231KB
MD5d5c46f3d80dcd6495eb78e4260926b4c
SHA1543cdadeacd618433a9afd23f18970637f483056
SHA2566089e3fa7798eb8588e4930dcabd519486ed31d612dbfc53533d93c425fe28c7
SHA512da207336d9a6878b0e7f2cbe515ca112a02315d5227e061a7295b1d7058ea1b99460837a59614e72d3b203ee7a1e31b10306099d826e43c7524bb512c6d0b673
-
Filesize
231KB
MD507467e782805a138062f89fd77e256fd
SHA187fa58d80339075344fd9a7c14f08f0996dd2f0f
SHA2569ff53fa171ae1501f260299ee7614efa7ab435b1f1d88b323ca46386848a281d
SHA512d06a433c0ed0db42acacb5dd4d8ad3008e288fde3a1ed92010eee827e12e265461897304ad0eeb2691b702db157a97670fd533f9368c6ddb9490d3a139594011
-
Filesize
231KB
MD5256e6813fc1c61b4f886ea0f90016463
SHA143ac914587aa7327515abb4a83d7c97961f54dcc
SHA25672d7711ea905ce6c05f75ed622ac61868926e572e288cd8d9a09352047dba7f1
SHA5120c49973af6adea15f0ba9a8a338ed1d511d0ef474f1c206066bce4b25e5b2e4e9094a2851c9ab6743a8a34c2078a85c8c00eaf8d6e6f4c2d279609ee00aebfcc
-
Filesize
30.1MB
MD50e4e9aa41d24221b29b19ba96c1a64d0
SHA1231ade3d5a586c0eb4441c8dbfe9007dc26b2872
SHA2565bfb6f3ab89e198539408f7e0e8ec0b0bd5efe8898573ec05b381228efb45a5d
SHA512e6f27aecead72dffecbeaad46ebdf4b1fd3dbcddd1f6076ba183b654e4e32d30f7af1236bf2e04459186e993356fe2041840671be73612c8afed985c2c608913
-
Filesize
711B
MD5558659936250e03cc14b60ebf648aa09
SHA132f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA2562445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
SHA5121632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir4676_1437567960\b6ecea52-edae-437d-b29c-e626c2167ed5.tmp
Filesize150KB
MD514937b985303ecce4196154a24fc369a
SHA1ecfe89e11a8d08ce0c8745ff5735d5edad683730
SHA25671006a5311819fef45c659428944897184880bcdb571bf68c52b3d6ee97682ff
SHA5121d03c75e4d2cd57eee7b0e93e2de293b41f280c415fb2446ac234fc5afd11fe2f2fcc8ab9843db0847c2ce6bd7df7213fcf249ea71896fbf6c0696e3f5aee46c
-
Filesize
16KB
MD5d82aad21ed071cd7a12d046634e842e7
SHA187d5764c6644f985c5d339d744c598d76b4f02be
SHA256f207a845a56d2ba7dfd05dbd4248f276462150063ec801c4b9bd8d124ada76e4
SHA5124b57f8d77925690b317b9f6d05757b3166542063bec59931036ed47227eb614bbca29c16bc3b3d3ebd7fe43efeae46fbd41b4f3de380ebe01121baaa23540084
-
Filesize
122KB
MD59fe9b0ecaea0324ad99036a91db03ebb
SHA1144068c64ec06fc08eadfcca0a014a44b95bb908
SHA256e2cce64916e405976a1d0c522b44527d12b1cba19de25da62121cf5f41d184c9
SHA512906641a73d69a841218ae90b83714a05af3537eec8ad1d761f58ac365cf005bdd74ad88f71c4437aaa126ac74fa46bcad424d17c746ab197eec2caa1bd838176
-
Filesize
211KB
MD5a3ae5d86ecf38db9427359ea37a5f646
SHA1eb4cb5ff520717038adadcc5e1ef8f7c24b27a90
SHA256c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
SHA51296ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0
-
Filesize
297KB
MD57a86ce1a899262dd3c1df656bff3fb2c
SHA133dcbe66c0dc0a16bab852ed0a6ef71c2d9e0541
SHA256b8f2d0909d7c2934285a8be010d37c0609c7854a36562cbfcbce547f4f4c7b0c
SHA512421e8195c47381de4b3125ab6719eec9be7acd2c97ce9247f4b70a309d32377917c9686b245864e914448fe53df2694d5ee5f327838d029989ba7acafda302ec