Analysis
-
max time kernel
1199s -
max time network
1195s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
27-07-2021 20:11
Static task
static1
URLScan task
urlscan1
Sample
https://1drv.ms/u/s!As_EWtU5WPg9a54pDCGeSUbd5EU?e=9nNlkF
General
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rundll32.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1736 4976 rundll32.exe -
suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
-
suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
-
Blocklisted process makes network request 25 IoCs
Processes:
rundll32.exeflow pid process 217 1776 rundll32.exe 219 1776 rundll32.exe 221 1776 rundll32.exe 222 1776 rundll32.exe 225 1776 rundll32.exe 226 1776 rundll32.exe 227 1776 rundll32.exe 228 1776 rundll32.exe 231 1776 rundll32.exe 232 1776 rundll32.exe 233 1776 rundll32.exe 235 1776 rundll32.exe 236 1776 rundll32.exe 237 1776 rundll32.exe 240 1776 rundll32.exe 241 1776 rundll32.exe 242 1776 rundll32.exe 243 1776 rundll32.exe 245 1776 rundll32.exe 247 1776 rundll32.exe 248 1776 rundll32.exe 250 1776 rundll32.exe 251 1776 rundll32.exe 252 1776 rundll32.exe 254 1776 rundll32.exe -
Executes dropped EXE 4 IoCs
Processes:
software_reporter_tool.exesoftware_reporter_tool.exesoftware_reporter_tool.exesoftware_reporter_tool.exepid process 4860 software_reporter_tool.exe 1152 software_reporter_tool.exe 4376 software_reporter_tool.exe 1308 software_reporter_tool.exe -
Loads dropped DLL 8 IoCs
Processes:
software_reporter_tool.exerundll32.exepid process 4376 software_reporter_tool.exe 4376 software_reporter_tool.exe 4376 software_reporter_tool.exe 4376 software_reporter_tool.exe 4376 software_reporter_tool.exe 4376 software_reporter_tool.exe 4376 software_reporter_tool.exe 1776 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Processes:
IEXPLORE.EXEiexplore.exeiexplore.exeiexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000077947a715dce4f4c8dcdac04f3ee919d00000000020000000000106600000001000020000000b46de904d4ae7bdc2ac8f7ad4befb58a1b91fe3442fece433663f22d58721d4d000000000e80000000020000200000001037914f1e97c9d52004f539e4036475f0e2ba07d185ed6850d24fa6d80a410920000000a18eb824cbdd6bb747ffdd04e7852ec5943c205cfc86df6280c93139597d35bc4000000026c492cf1e5f24ebc5b016b901e829750b4ddb3b26a12664a2bf315b68946eff85b6ad8d2cedfe6451136e437972e1e3745d54ad590e0512656cf7c8863dcf7a iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5027b3772483d701 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 302cba772483d701 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30901028" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000077947a715dce4f4c8dcdac04f3ee919d00000000020000000000106600000001000020000000eb79f64b2d89df8740092c402e4581f81c78b6ea8e8238a6f232d9e8f6c512b3000000000e8000000002000020000000605e27d0915b9053924fd167e8a1df1bb0d4be1789f4a02b794807bd48e814a720000000f305f74c93375c181cbaa26959e1adbc91a20a5f9a4171ae2968850ff7e30789400000004940edbd82742b3bf3b9e3296158dfeec777408b74ea26fe089882a625cf09c5d16e4c57e6093fd76ae085809fcc7f58544e37d7c8ce5247aa64dd7a6e4375c5 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000077947a715dce4f4c8dcdac04f3ee919d0000000002000000000010660000000100002000000068d0439686a61754c3704a7bd02caaec79ee6a9564060c5edfbbe156309e491a000000000e80000000020000200000005d7bddd1892e74489e2a9dce4f756e10ac60d58552c16e7b732f318707839ed9200000007f0b9787defbcaedaa7af8c8d5aa93119bb069053970ee74b737c088b0cca4dd400000003f3e18afe24bc6c69252d4cb59fbc53bf152ac865c9cbb25def265ef84a1c3cf754832765122f2d59d11b511cd0c0cd4336678051c5e130f6c2489ae3563090a iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1966185950" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30901028" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000077947a715dce4f4c8dcdac04f3ee919d0000000002000000000010660000000100002000000002cbfe1b95f74363377d7ceda5baa374347d763003fd73682354de080df5d696000000000e8000000002000020000000ec8eebbf0954bbfadcabf7e5309b0f972f75833a032cd5bfa02cdbe05ca98bbd20000000f4ad54274c9419cf71f6f91a51ab1220064b33b755710e23efe7f3888f75e7044000000055303c358393b917fe9b1cbc96bd155090d2ddf83e32a565ba49774c98a11360e3b87533c62393fd3ab0bf08cbec3670cd0da2a96ca791fc85b49588f46c61e8 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CC46064C-EF17-11EB-A11C-D22FD1FF01E8} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40e221902483d701 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1966185950" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BBE49900-EF17-11EB-A11C-D22FD1FF01E8} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DA9DF091-EF17-11EB-A11C-D22FD1FF01E8} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A0476DB4-EF17-11EB-A11C-D22FD1FF01E8} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Modifies registry class 1 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings chrome.exe -
Opens file in notepad (likely ransom note) 2 IoCs
Processes:
Notepad.exeNotepad.exepid process 4584 Notepad.exe 4684 Notepad.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
chrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exesoftware_reporter_tool.exetaskmgr.exepid process 2768 chrome.exe 2768 chrome.exe 4016 chrome.exe 4016 chrome.exe 4540 chrome.exe 4540 chrome.exe 4280 chrome.exe 4280 chrome.exe 4432 chrome.exe 4432 chrome.exe 4976 chrome.exe 4976 chrome.exe 5036 chrome.exe 5036 chrome.exe 4204 chrome.exe 4204 chrome.exe 2084 chrome.exe 2084 chrome.exe 2084 chrome.exe 2084 chrome.exe 4860 software_reporter_tool.exe 4860 software_reporter_tool.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
taskmgr.exepid process 4992 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes:
7zG.exe7zG.exesoftware_reporter_tool.exesoftware_reporter_tool.exesoftware_reporter_tool.exesoftware_reporter_tool.exetaskmgr.exe7zG.exedescription pid process Token: SeRestorePrivilege 2400 7zG.exe Token: 35 2400 7zG.exe Token: SeSecurityPrivilege 2400 7zG.exe Token: SeSecurityPrivilege 2400 7zG.exe Token: SeRestorePrivilege 5008 7zG.exe Token: 35 5008 7zG.exe Token: SeSecurityPrivilege 5008 7zG.exe Token: SeSecurityPrivilege 5008 7zG.exe Token: 33 1152 software_reporter_tool.exe Token: SeIncBasePriorityPrivilege 1152 software_reporter_tool.exe Token: 33 4860 software_reporter_tool.exe Token: SeIncBasePriorityPrivilege 4860 software_reporter_tool.exe Token: 33 4376 software_reporter_tool.exe Token: SeIncBasePriorityPrivilege 4376 software_reporter_tool.exe Token: 33 1308 software_reporter_tool.exe Token: SeIncBasePriorityPrivilege 1308 software_reporter_tool.exe Token: SeDebugPrivilege 4992 taskmgr.exe Token: SeSystemProfilePrivilege 4992 taskmgr.exe Token: SeCreateGlobalPrivilege 4992 taskmgr.exe Token: SeRestorePrivilege 5044 7zG.exe Token: 35 5044 7zG.exe Token: SeSecurityPrivilege 5044 7zG.exe Token: SeSecurityPrivilege 5044 7zG.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
chrome.exe7zG.exe7zG.exetaskmgr.exepid process 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 2400 7zG.exe 5008 7zG.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
taskmgr.exepid process 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe 4992 taskmgr.exe -
Suspicious use of SetWindowsHookEx 16 IoCs
Processes:
iexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEpid process 5016 iexplore.exe 5016 iexplore.exe 4972 IEXPLORE.EXE 4972 IEXPLORE.EXE 2744 iexplore.exe 2744 iexplore.exe 5084 IEXPLORE.EXE 5084 IEXPLORE.EXE 1096 iexplore.exe 1096 iexplore.exe 4136 IEXPLORE.EXE 4136 IEXPLORE.EXE 2464 iexplore.exe 2464 iexplore.exe 4336 IEXPLORE.EXE 4336 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 4016 wrote to memory of 2188 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 2188 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 2312 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 2312 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 2312 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 2312 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 2312 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 2312 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 2312 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 2312 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 2312 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 2312 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 2312 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 2312 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 2312 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 2312 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 2312 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 2312 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 2312 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 2312 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 2312 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 2312 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 2312 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 2312 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 2312 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 2312 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 2312 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 2312 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 2312 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 2312 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 2312 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 2312 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 2312 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 2312 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 2312 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 2312 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 2312 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 2312 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 2312 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 2312 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 2312 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 2312 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 2768 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 2768 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 2984 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 2984 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 2984 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 2984 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 2984 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 2984 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 2984 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 2984 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 2984 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 2984 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 2984 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 2984 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 2984 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 2984 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 2984 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 2984 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 2984 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 2984 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 2984 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 2984 4016 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://1drv.ms/u/s!As_EWtU5WPg9a54pDCGeSUbd5EU?e=9nNlkF1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc8,0xcc,0xd0,0xa4,0xd4,0x7ff964494f50,0x7ff964494f60,0x7ff964494f702⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1568 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1656 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2176 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2824 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2832 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1652 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5004 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5504 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5644 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6500 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5500 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5776 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6708 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6588 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6912 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6896 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --channel --force-configure-user-settings2⤵
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x244,0x248,0x24c,0x220,0x1f4,0x7ff6c444a890,0x7ff6c444a8a0,0x7ff6c444a8b03⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6924 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5632 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6008 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6472 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6948 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6960 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6944 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7096 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7256 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7272 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7808 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7928 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7968 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7228 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8296 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8308 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8316 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8348 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8360 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8900 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5716 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6564 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6612 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6832 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=9168 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=9308 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=9324 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=9588 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8948 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4220 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9604 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=9592 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3424 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1528 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9288 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3636 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6768 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=768 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5056 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5736 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=9544 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7920 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5128 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=9544 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2404 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5140 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6264 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6252 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2408 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8660 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8652 /prefetch:82⤵
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\91.266.200\software_reporter_tool.exe"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\91.266.200\software_reporter_tool.exe" --engine=2 --scan-locations=1,2,3,4,5,6,7,8,10 --disabled-locations=9,11 --session-id=fjEKj28CGOVkqiVw4IcawyvLr7kXK3DFC/4r58JI --registry-suffix=ESET --srt-field-trial-group-name=Off2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\91.266.200\software_reporter_tool.exe"c:\users\admin\appdata\local\google\chrome\user data\swreporter\91.266.200\software_reporter_tool.exe" --crash-handler "--database=c:\users\admin\appdata\local\Google\Software Reporter Tool" --url=https://clients2.google.com/cr/report --annotation=plat=Win32 --annotation=prod=ChromeFoil --annotation=ver=91.266.200 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff7914d3270,0x7ff7914d3280,0x7ff7914d32903⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\91.266.200\software_reporter_tool.exe"c:\users\admin\appdata\local\google\chrome\user data\swreporter\91.266.200\software_reporter_tool.exe" --use-crash-handler-with-id="\\.\pipe\crashpad_4860_RSLHSKWBXOOEUWKJ" --sandboxed-process-id=2 --init-done-notifier=716 --sandbox-mojo-pipe-token=16411196452218829265 --mojo-platform-channel-handle=692 --engine=23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\91.266.200\software_reporter_tool.exe"c:\users\admin\appdata\local\google\chrome\user data\swreporter\91.266.200\software_reporter_tool.exe" --use-crash-handler-with-id="\\.\pipe\crashpad_4860_RSLHSKWBXOOEUWKJ" --sandboxed-process-id=3 --init-done-notifier=916 --sandbox-mojo-pipe-token=10176399076752296097 --mojo-platform-channel-handle=9123⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6640 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4148 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7268 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=79 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6636 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3816 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=81 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6340 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=82 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7924 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8500 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8076 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5088 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=87 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7360 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=88 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9252 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1488,13947546961055578387,10163272619855327548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=9472 /prefetch:82⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\9qeJY2qk5stQ\" -spe -an -ai#7zMap14637:86:7zEvent63781⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\9qeJY2qk5stQ\" -spe -an -ai#7zMap19843:86:7zEvent77441⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\System32\Notepad.exe"C:\Windows\System32\Notepad.exe" C:\Users\Admin\Downloads\9qeJY2qk5stQ\9qeJY2qk5stQ.vbs1⤵
- Opens file in notepad (likely ransom note)
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\9qeJY2qk5stQ\9qeJY2qk5stQ.vbs"1⤵
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\9qeJY2qk5stQ\9qeJY2qk5stQ.vbs"1⤵
-
C:\Windows\System32\Notepad.exe"C:\Windows\System32\Notepad.exe" C:\Users\Admin\Downloads\9qeJY2qk5stQ\9qeJY2qk5stQ.vbs1⤵
- Opens file in notepad (likely ransom note)
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\9qeJY2qk5stQ\9qeJY2qk5stQ.vbs"1⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\9qeJY2qk5stQ\9qeJY2qk5stQ.vbs"1⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap23651:86:7zEvent17941⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\rundll32.exerundll32 C:\Users\Admin\AppData\Local\Temp\mental.xls,DllRegisterServer1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32 C:\Users\Admin\AppData\Local\Temp\mental.xls,DllRegisterServer2⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5016 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2744 CREDAT:82945 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1096 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2464 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.datMD5
cda7a62f8700dcc1f1bbcf2968697b56
SHA171dc80e908bc0437eb423b55193e5773a526ba8a
SHA2569c9fdaa173b04f513a494046343024aca80cdc5533690bda2bd78aff24f9996d
SHA512f72682df2b9c6c9afb344dcc9cb29d3ee27d728dcc8493c1575580789f88536e32202e916520474dd2a497210300edbd55e6b1be47ac033dbc575ff3257df438
-
\??\pipe\crashpad_4016_QQRFAAGHIGOAYDHZMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/1148-323-0x0000000000000000-mapping.dmp
-
memory/1280-144-0x0000000000000000-mapping.dmp
-
memory/1344-162-0x0000000000000000-mapping.dmp
-
memory/1776-530-0x0000000000960000-0x0000000000961000-memory.dmpFilesize
4KB
-
memory/2088-284-0x0000000000000000-mapping.dmp
-
memory/2144-155-0x0000000000000000-mapping.dmp
-
memory/2188-116-0x0000000000000000-mapping.dmp
-
memory/2312-121-0x0000000000000000-mapping.dmp
-
memory/2312-123-0x00007FF96C620000-0x00007FF96C621000-memory.dmpFilesize
4KB
-
memory/2344-406-0x0000000000000000-mapping.dmp
-
memory/2544-381-0x0000000000000000-mapping.dmp
-
memory/2548-344-0x0000000000000000-mapping.dmp
-
memory/2620-149-0x0000000000000000-mapping.dmp
-
memory/2768-122-0x0000000000000000-mapping.dmp
-
memory/2984-126-0x0000000000000000-mapping.dmp
-
memory/3128-229-0x0000000000000000-mapping.dmp
-
memory/3564-445-0x0000000000000000-mapping.dmp
-
memory/3868-132-0x0000000000000000-mapping.dmp
-
memory/3972-311-0x0000000000000000-mapping.dmp
-
memory/4020-140-0x0000000000000000-mapping.dmp
-
memory/4116-327-0x0000000000000000-mapping.dmp
-
memory/4164-433-0x0000000000000000-mapping.dmp
-
memory/4172-279-0x0000000000000000-mapping.dmp
-
memory/4204-442-0x0000000000000000-mapping.dmp
-
memory/4248-245-0x0000000000000000-mapping.dmp
-
memory/4280-335-0x0000000000000000-mapping.dmp
-
memory/4340-234-0x0000000000000000-mapping.dmp
-
memory/4412-179-0x0000000000000000-mapping.dmp
-
memory/4412-314-0x0000000000000000-mapping.dmp
-
memory/4416-374-0x0000000000000000-mapping.dmp
-
memory/4432-419-0x0000000000000000-mapping.dmp
-
memory/4436-289-0x0000000000000000-mapping.dmp
-
memory/4444-238-0x0000000000000000-mapping.dmp
-
memory/4500-366-0x0000000000000000-mapping.dmp
-
memory/4512-184-0x0000000000000000-mapping.dmp
-
memory/4512-426-0x0000000000000000-mapping.dmp
-
memory/4524-354-0x0000000000000000-mapping.dmp
-
memory/4528-241-0x0000000000000000-mapping.dmp
-
memory/4528-334-0x0000000000000000-mapping.dmp
-
memory/4540-188-0x0000000000000000-mapping.dmp
-
memory/4576-296-0x0000000000000000-mapping.dmp
-
memory/4580-394-0x0000000000000000-mapping.dmp
-
memory/4688-386-0x0000000000000000-mapping.dmp
-
memory/4700-399-0x0000000000000000-mapping.dmp
-
memory/4796-194-0x0000000000000000-mapping.dmp
-
memory/4820-247-0x0000000000000000-mapping.dmp
-
memory/4824-199-0x0000000000000000-mapping.dmp
-
memory/4860-371-0x0000000000000000-mapping.dmp
-
memory/4876-204-0x0000000000000000-mapping.dmp
-
memory/4908-301-0x0000000000000000-mapping.dmp
-
memory/4912-257-0x0000000000000000-mapping.dmp
-
memory/4928-252-0x0000000000000000-mapping.dmp
-
memory/4940-260-0x0000000000000000-mapping.dmp
-
memory/4944-304-0x0000000000000000-mapping.dmp
-
memory/4952-209-0x0000000000000000-mapping.dmp
-
memory/4960-265-0x0000000000000000-mapping.dmp
-
memory/4976-422-0x0000000000000000-mapping.dmp
-
memory/5000-318-0x0000000000000000-mapping.dmp
-
memory/5012-214-0x0000000000000000-mapping.dmp
-
memory/5036-439-0x0000000000000000-mapping.dmp
-
memory/5036-359-0x0000000000000000-mapping.dmp
-
memory/5048-347-0x0000000000000000-mapping.dmp
-
memory/5064-219-0x0000000000000000-mapping.dmp
-
memory/5080-222-0x0000000000000000-mapping.dmp
-
memory/5116-276-0x0000000000000000-mapping.dmp
-
memory/5116-413-0x0000000000000000-mapping.dmp