Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
07/03/2025, 02:42
Behavioral task
behavioral1
Sample
unbannedgg val cl3aner.exe
Resource
win10v2004-20250217-en
Behavioral task
behavioral2
Sample
unbannedgg val cl3aner.exe
Resource
win11-20250217-en
General
-
Target
unbannedgg val cl3aner.exe
-
Size
42KB
-
MD5
ddaca7ade8d5d4f1f2c1b8effa9e2e08
-
SHA1
109429140514f86626d9307f2b3a988737030411
-
SHA256
fefbb7e062fec0292c8c99654aae9b865f6d53742e39e7db1279b637feb1619d
-
SHA512
14fd4aff9363afa5480095852304885ebfdfc60d6874cd647dd84846ce11c00868e94fad9b45fd8891619657b8a39a1c39f5bee6f73db19ccac58e011e430c29
-
SSDEEP
768:h4Mrj8n817YkWgHi6uZbLQSTj9KZKfgm3Eh0o:dVtHinLQSTJF7EKo
Malware Config
Extracted
mercurialgrabber
https://discord.com/api/webhooks/1347394180963635261/3yeSB0XzUxLp12KVb8L8cV-gibC8yJbxfQ_guUp41CqeAlFe5LHGeWui0W7HJVdU33Ot
Signatures
-
Mercurial Grabber Stealer
Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.
-
Mercurialgrabber family
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions unbannedgg val cl3aner.exe -
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools unbannedgg val cl3aner.exe -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion unbannedgg val cl3aner.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
flow ioc 109 discord.com 110 discord.com 111 discord.com 71 discord.com 72 discord.com 73 discord.com -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 68 ip-api.com 3 ip4.seeip.org -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 unbannedgg val cl3aner.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum unbannedgg val cl3aner.exe -
Checks SCSI registry key(s) 3 TTPs 1 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S unbannedgg val cl3aner.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 unbannedgg val cl3aner.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString unbannedgg val cl3aner.exe -
Enumerates system info in registry 2 TTPs 7 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer unbannedgg val cl3aner.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName unbannedgg val cl3aner.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Logical Unit Id 0 unbannedgg val cl3aner.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation unbannedgg val cl3aner.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133857889618359115" chrome.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4564 chrome.exe 4564 chrome.exe 5424 chrome.exe 5424 chrome.exe 5424 chrome.exe 5424 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4060 unbannedgg val cl3aner.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4564 wrote to memory of 264 4564 chrome.exe 102 PID 4564 wrote to memory of 264 4564 chrome.exe 102 PID 4564 wrote to memory of 3744 4564 chrome.exe 103 PID 4564 wrote to memory of 3744 4564 chrome.exe 103 PID 4564 wrote to memory of 3744 4564 chrome.exe 103 PID 4564 wrote to memory of 3744 4564 chrome.exe 103 PID 4564 wrote to memory of 3744 4564 chrome.exe 103 PID 4564 wrote to memory of 3744 4564 chrome.exe 103 PID 4564 wrote to memory of 3744 4564 chrome.exe 103 PID 4564 wrote to memory of 3744 4564 chrome.exe 103 PID 4564 wrote to memory of 3744 4564 chrome.exe 103 PID 4564 wrote to memory of 3744 4564 chrome.exe 103 PID 4564 wrote to memory of 3744 4564 chrome.exe 103 PID 4564 wrote to memory of 3744 4564 chrome.exe 103 PID 4564 wrote to memory of 3744 4564 chrome.exe 103 PID 4564 wrote to memory of 3744 4564 chrome.exe 103 PID 4564 wrote to memory of 3744 4564 chrome.exe 103 PID 4564 wrote to memory of 3744 4564 chrome.exe 103 PID 4564 wrote to memory of 3744 4564 chrome.exe 103 PID 4564 wrote to memory of 3744 4564 chrome.exe 103 PID 4564 wrote to memory of 3744 4564 chrome.exe 103 PID 4564 wrote to memory of 3744 4564 chrome.exe 103 PID 4564 wrote to memory of 3744 4564 chrome.exe 103 PID 4564 wrote to memory of 3744 4564 chrome.exe 103 PID 4564 wrote to memory of 3744 4564 chrome.exe 103 PID 4564 wrote to memory of 3744 4564 chrome.exe 103 PID 4564 wrote to memory of 3744 4564 chrome.exe 103 PID 4564 wrote to memory of 3744 4564 chrome.exe 103 PID 4564 wrote to memory of 3744 4564 chrome.exe 103 PID 4564 wrote to memory of 3744 4564 chrome.exe 103 PID 4564 wrote to memory of 3744 4564 chrome.exe 103 PID 4564 wrote to memory of 3744 4564 chrome.exe 103 PID 4564 wrote to memory of 2920 4564 chrome.exe 104 PID 4564 wrote to memory of 2920 4564 chrome.exe 104 PID 4564 wrote to memory of 3444 4564 chrome.exe 105 PID 4564 wrote to memory of 3444 4564 chrome.exe 105 PID 4564 wrote to memory of 3444 4564 chrome.exe 105 PID 4564 wrote to memory of 3444 4564 chrome.exe 105 PID 4564 wrote to memory of 3444 4564 chrome.exe 105 PID 4564 wrote to memory of 3444 4564 chrome.exe 105 PID 4564 wrote to memory of 3444 4564 chrome.exe 105 PID 4564 wrote to memory of 3444 4564 chrome.exe 105 PID 4564 wrote to memory of 3444 4564 chrome.exe 105 PID 4564 wrote to memory of 3444 4564 chrome.exe 105 PID 4564 wrote to memory of 3444 4564 chrome.exe 105 PID 4564 wrote to memory of 3444 4564 chrome.exe 105 PID 4564 wrote to memory of 3444 4564 chrome.exe 105 PID 4564 wrote to memory of 3444 4564 chrome.exe 105 PID 4564 wrote to memory of 3444 4564 chrome.exe 105 PID 4564 wrote to memory of 3444 4564 chrome.exe 105 PID 4564 wrote to memory of 3444 4564 chrome.exe 105 PID 4564 wrote to memory of 3444 4564 chrome.exe 105 PID 4564 wrote to memory of 3444 4564 chrome.exe 105 PID 4564 wrote to memory of 3444 4564 chrome.exe 105 PID 4564 wrote to memory of 3444 4564 chrome.exe 105 PID 4564 wrote to memory of 3444 4564 chrome.exe 105 PID 4564 wrote to memory of 3444 4564 chrome.exe 105 PID 4564 wrote to memory of 3444 4564 chrome.exe 105 PID 4564 wrote to memory of 3444 4564 chrome.exe 105 PID 4564 wrote to memory of 3444 4564 chrome.exe 105 PID 4564 wrote to memory of 3444 4564 chrome.exe 105 PID 4564 wrote to memory of 3444 4564 chrome.exe 105 PID 4564 wrote to memory of 3444 4564 chrome.exe 105 PID 4564 wrote to memory of 3444 4564 chrome.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\unbannedgg val cl3aner.exe"C:\Users\Admin\AppData\Local\Temp\unbannedgg val cl3aner.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:4060
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffbcda0cc40,0x7ffbcda0cc4c,0x7ffbcda0cc582⤵PID:264
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1916,i,3566842925779286367,6722802432922927758,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=1908 /prefetch:22⤵PID:3744
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2148,i,3566842925779286367,6722802432922927758,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2160 /prefetch:32⤵PID:2920
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2236,i,3566842925779286367,6722802432922927758,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2392 /prefetch:82⤵PID:3444
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3160,i,3566842925779286367,6722802432922927758,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3168 /prefetch:12⤵PID:4760
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3352,i,3566842925779286367,6722802432922927758,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3364 /prefetch:12⤵PID:3360
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4552,i,3566842925779286367,6722802432922927758,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4568 /prefetch:12⤵PID:1772
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3152,i,3566842925779286367,6722802432922927758,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4600 /prefetch:82⤵PID:4476
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3704,i,3566842925779286367,6722802432922927758,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4832 /prefetch:82⤵PID:5040
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5056,i,3566842925779286367,6722802432922927758,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4880 /prefetch:82⤵PID:1164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4560,i,3566842925779286367,6722802432922927758,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3732 /prefetch:82⤵PID:3984
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4880,i,3566842925779286367,6722802432922927758,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5184 /prefetch:82⤵PID:5200
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5088,i,3566842925779286367,6722802432922927758,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4608 /prefetch:82⤵PID:5248
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5052,i,3566842925779286367,6722802432922927758,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5472 /prefetch:82⤵PID:5288
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5064,i,3566842925779286367,6722802432922927758,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4524 /prefetch:82⤵PID:5660
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5668,i,3566842925779286367,6722802432922927758,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5680 /prefetch:22⤵PID:5492
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=3684,i,3566842925779286367,6722802432922927758,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4924 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5424
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:3168
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:1800
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
649B
MD504dd4d8f84b1f21f5925963ce3c9a2e3
SHA1427c3a6b5f7bcf4e35c0aba981f452e89bdc31d6
SHA2560115d2b938ef8a23f24ba20c3728739b6fb4bc5b845018732902aef3ee2faaf9
SHA5128fb0c308952f602a5f23958a1b9909e9084ecfc3c9276b43e26ac6374c1ee436eb60790b218dc7a55409737e39a63101199c595c5a4652dbf0bc85a5381abee6
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_0\_locales\en_CA\messages.json
Filesize851B
MD507ffbe5f24ca348723ff8c6c488abfb8
SHA16dc2851e39b2ee38f88cf5c35a90171dbea5b690
SHA2566895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c
SHA5127ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_0\dasherSettingSchema.json
Filesize854B
MD54ec1df2da46182103d2ffc3b92d20ca5
SHA1fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA2566c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
SHA512939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
-
Filesize
2KB
MD50e5d811bf861d6596e231640f3109c68
SHA1d2debfcfb30af6380d93ddfce22cfbd2a8b006cd
SHA25609d07bb80b47b8fe16e108a76fd8bafb1731650f410134c2146a26ca7bc59676
SHA512cf7711de91559542d039232e9169a6c8051a138bcd10b6142af4501296bc8a487aac2b9e756c5faf17b499d6789df3aed1b89b89928a836d7c23dbafff762252
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
354B
MD5b23670a1275b59ae2ef6552df674f7e5
SHA17f9956adc83a8b0643ede5a111f1f38c5a31e921
SHA25662c696d6af8b9267d95efe8b9b617a13ae9b11d149ef439205a29f2a523d7c6e
SHA5121a4d6001c84baac53ca8dce355cb7232f555cec8681fea2ff6f186f5be62f944f0bea7c8f5aee722410de34d7de522935f8686255e2ddfe302cf01145e22f748
-
Filesize
9KB
MD57fa7eabce23ecbee43d2521058f15979
SHA1bf0dc22a8b14ebf94af246fc054bc3106231ee95
SHA2562901f8e1de8b2073715740d7b6fea0bb98a8247cf65d96978f41189b24653945
SHA5122aab3c5151c5a0cf780fcb127d55d33b1ef51757e5d5107dc85d2b1688bca221a87faad46bbd43896d405b19288a99391f0395bca78e38d4c45fe8de074e9a1a
-
Filesize
8KB
MD5a62a480ffe8371c157d69aad6179ce91
SHA1cab92bb7d5df66b6c16987e3ae98c6cf760e2c3d
SHA2564a5eaf0544d9281b06fbdfff40dd5dff397c91a05885716bbe9523400e6ef34a
SHA512ee35688b488ba752b036621312a74679f11c17c5c220cd2fb4e4212cb08f3510b1de4296d4d3bb24efd920129fb9861c1946aeddd7edb79315bc974315e6162d
-
Filesize
9KB
MD5537775bdf7f2cfb4a62e2b0afea2293b
SHA166cc0ebc309da8cd30252157718caf682f551b46
SHA2568bc2fc09bcd4f8b03024e35dff0de6f874bb818b81cd7ee1c41a7ad08109de5b
SHA512a0d80ee8f3aa52834d5af4063306f124dde844aa47b42cfb6bb5120f769524da29cb3d1b1a153ce60ec316b606103de0cef8428ea91a032456c8e8b2f48984bb
-
Filesize
8KB
MD5f44d12bf0e891d6c27857bb28b6df266
SHA1f11030da007fe4e01a605e4fe70948982d52fb3d
SHA2569c0405f76e1dd6b95a085a0797f1e72d029539bcd1fb90013aa0a38b79a99019
SHA5126219e90e1e7a61b06a7a7a55e2cb49b4746001820a73494f82a5e2a362ba00a6f08bfab46ef2ab8820d0ae191d72305e6c568f4c3d2cb44d626c86d0d490050c
-
Filesize
15KB
MD5d72678c2f84e113d2924a37f41c54bc5
SHA132eb9b977f642751b6a40d07ee87d6abd80e5de2
SHA256b8b24182d1b16aafce6a80ef3dab41421a4fc5c03a45215028cbf1f24b9556aa
SHA5122e721f8156b68d731ae8dd893f813ea5494029f7ecf0bca76b7021f683f53664a05b270fd22c0f6dce8bb5916cc6f002d90d0dc687150da0afe2ae12f1901d53
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize72B
MD51185ed8604aa12d86238ac5753f3150d
SHA15322d6888e1145c65c979459b05661b77d85d35c
SHA2564fc05cbf8adb6328a2a59d8f447a9d3f9e0f8088324340197ba4e810cdb47bb1
SHA5124b647b75c38f66bc3dfddd8362397599f354c205c64256f553a60c17ac90cfac1cf29dd225eb278710d23974ccc2ece18a31817f5b8f6c1488e001b89cce8232
-
Filesize
245KB
MD5715951d5c168f661626e6ca3cbe22b5c
SHA17a302026aa48ed9307393a70a55174bc8724cfa1
SHA256e921d748b7ff659b45c114ea23fd35dac8d1f4698e5567f2292b0ffe8047f9d0
SHA5129c6b4eb71b518f984e60dcffa49f10ef79449ee2aaad67e7f485e6c1054767dc74d0147d2f31015d0567518ee6c96566f24f0945a23f871c3d6563ff704bf15a
-
Filesize
245KB
MD577ea5c3e656bdaeb8854c8b60169ad26
SHA1e05ae622ba70746fd8fbbc67e7b46aa6241083e4
SHA256becb82c225ecc09d5a4a7762f8a062e32dd4ec0da41171824a621158ec34d3d1
SHA51281a4f94744dcf4427abe3b8cbb1ff4d430244e940146d38874f9ce3017ec5166b1e05a502b4c6481e05f39817390f613bb863e44c5dd61e86ed3077458f11539
-
Filesize
711B
MD5558659936250e03cc14b60ebf648aa09
SHA132f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA2562445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
SHA5121632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
-
Filesize
150KB
MD5eae462c55eba847a1a8b58e58976b253
SHA14d7c9d59d6ae64eb852bd60b48c161125c820673
SHA256ebcda644bcfbd0c9300227bafde696e8923ddb004b4ee619d7873e8a12eae2ad
SHA512494481a98ab6c83b16b4e8d287d85ba66499501545da45458acc395da89955971cf2a14e83c2da041c79c580714b92b9409aa14017a16d0b80a7ff3d91bad2a3