asyncrat | 5bcc4adc07ee34b43752fb0fb97b1ab8291e0a840f77ff0895a49965cf3638c2

Processes:

b628fc267d7a45f2fc59e9f9ae9a7b26.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Roaming\\WindowsSettingsDrive\\rjfggfsedfew.exe\","	b628fc267d7a45f2fc59e9f9ae9a7b26.exe

Registers COM server for autorun 1 TTPs
persistence

Registry Run Keys / Startup Folder
T1060
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

avDump.exe

description pid process target process

PID 4732 created 4148 4732 avDump.exe aswidsagent.exe

description	pid	process	target process
PID 4732 created 4148	4732	avDump.exe	aswidsagent.exe

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1416-256-0x0000000000400000-0x0000000000416000-memory.dmp	asyncrat

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Blocklisted process makes network request 4 IoCs

Processes:

mshta.exe

flow pid process

516 5084 mshta.exe
517 5084 mshta.exe
519 5084 mshta.exe
521 5084 mshta.exe
Downloads MZ/PE file

flow	pid	process
516	5084	mshta.exe
517	5084	mshta.exe
519	5084	mshta.exe
521	5084	mshta.exe

Drops file in Drivers directory 64 IoCs

Processes:

instup.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\avgbidsha.sys	instup.exe
File opened for modification	C:\Windows\system32\drivers\avgArPot.sys	instup.exe
File opened for modification	C:\Windows\system32\drivers\avgVmm.sys	instup.exe
File opened for modification	C:\Windows\system32\drivers\asw3e506b70d22039c2.tmp	instup.exe
File created	C:\Windows\system32\drivers\asw6940411656dc975b.tmp	instup.exe
File opened for modification	C:\Windows\system32\drivers\asw8aabd99833123679.tmp	instup.exe
File opened for modification	C:\Windows\system32\drivers\asw20fcbd7ccda235b6.tmp	instup.exe
File opened for modification	C:\Windows\system32\drivers\avgMonFlt.sys	instup.exe
File opened for modification	C:\Windows\system32\drivers\aswb177b504330be913.tmp	instup.exe
File created	C:\Windows\system32\drivers\aswfcc644a018359748.tmp	instup.exe
File opened for modification	C:\Windows\system32\drivers\asw6809ecdd0eaadba0.tmp	instup.exe
File created	C:\Windows\system32\drivers\asweab5012fc3befa2f.tmp	instup.exe
File created	C:\Windows\system32\drivers\asw3e506b70d22039c2.tmp	instup.exe
File opened for modification	C:\Windows\system32\drivers\avgbidsdrivera.sys	instup.exe
File opened for modification	C:\Windows\system32\drivers\avgRvrt.sys	instup.exe
File created	C:\Windows\system32\drivers\asw6809ecdd0eaadba0.tmp	instup.exe
File opened for modification	C:\Windows\system32\drivers\asw19bba96bcd3cad7a.tmp	instup.exe
File opened for modification	C:\Windows\system32\drivers\avgFsBlk.sys	instup.exe
File opened for modification	C:\Windows\system32\drivers\avgKbd.sys	instup.exe
File created	C:\Windows\system32\drivers\aswba5a4dc6e96c4cb5.tmp	instup.exe
File opened for modification	C:\Windows\system32\drivers\aswba5a4dc6e96c4cb5.tmp	instup.exe
File created	C:\Windows\system32\drivers\asw638386751e1c97ad.tmp	instup.exe
File opened for modification	C:\Windows\system32\drivers\asw638386751e1c97ad.tmp	instup.exe
File created	C:\Windows\system32\drivers\avgElam.sys	instup.exe
File opened for modification	C:\Windows\system32\drivers\aswa5a085695d28401e.tmp	instup.exe
File opened for modification	C:\Windows\system32\drivers\avgbdiskx.sys	instup.exe
File opened for modification	C:\Windows\system32\drivers\avgSP.sys	instup.exe
File opened for modification	C:\Windows\system32\drivers\avgStm.sys	instup.exe
File created	C:\Windows\system32\drivers\avgRdr2.sys	instup.exe
File created	C:\Windows\system32\drivers\avgbidsh.sys	instup.exe
File created	C:\Windows\system32\drivers\asw19bba96bcd3cad7a.tmp	instup.exe
File opened for modification	C:\Windows\system32\drivers\avgSnx.sys	instup.exe
File created	C:\Windows\system32\drivers\avgbidsdriver.sys	instup.exe
File created	C:\Windows\system32\drivers\avgKbd.sys	instup.exe
File opened for modification	C:\Windows\system32\drivers\asw6940411656dc975b.tmp	instup.exe
File created	C:\Windows\system32\drivers\asw0ff4ab45ef29a8cd.tmp	instup.exe
File opened for modification	C:\Windows\system32\drivers\avgbidsdriverx.sys	instup.exe
File created	C:\Windows\system32\drivers\avgArDisk.sys	instup.exe
File created	C:\Windows\system32\drivers\asw8a433c6975eb400a.tmp	instup.exe
File opened for modification	C:\Windows\system32\drivers\avgblogx.sys	instup.exe
File opened for modification	C:\Windows\system32\drivers\avgbidsdriver.sys	instup.exe
File opened for modification	C:\Windows\system32\drivers\avgbidsh.sys	instup.exe
File opened for modification	C:\Windows\system32\drivers\asw0ff4ab45ef29a8cd.tmp	instup.exe
File opened for modification	C:\Windows\system32\drivers\avgbuniva.sys	instup.exe
File opened for modification	C:\Windows\system32\drivers\avgNet.sys	instup.exe
File created	C:\Windows\system32\drivers\aswa5a085695d28401e.tmp	instup.exe
File opened for modification	C:\Windows\system32\drivers\avgbidshx.sys	instup.exe
File created	C:\Windows\system32\drivers\avgNetHub.sys	instup.exe
File created	C:\Windows\system32\drivers\avgMonFlt.sys	instup.exe
File created	C:\Windows\system32\drivers\avgRvrt.sys	instup.exe
File opened for modification	C:\Windows\system32\drivers\aswfcc644a018359748.tmp	instup.exe
File opened for modification	C:\Windows\system32\drivers\asweab5012fc3befa2f.tmp	instup.exe
File opened for modification	C:\Windows\system32\drivers\avgbunivx.sys	instup.exe
File created	C:\Windows\system32\drivers\avgArPot.sys	instup.exe
File created	C:\Windows\system32\drivers\asw8aabd99833123679.tmp	instup.exe
File opened for modification	C:\Windows\system32\drivers\avgbloga.sys	instup.exe
File created	C:\Windows\system32\drivers\avgSP.sys	instup.exe
File created	C:\Windows\system32\drivers\avgbuniv.sys	instup.exe
File opened for modification	C:\Windows\system32\drivers\asw8a433c6975eb400a.tmp	instup.exe
File created	C:\Windows\system32\drivers\asweb5d19613c2ed92f.tmp	instup.exe
File opened for modification	C:\Windows\system32\drivers\avgNetHub.sys	instup.exe
File created	C:\Windows\system32\drivers\aswb177b504330be913.tmp	instup.exe
File created	C:\Windows\system32\drivers\asw20fcbd7ccda235b6.tmp	instup.exe
File opened for modification	C:\Windows\system32\drivers\avgRdr2.sys	instup.exe

Executes dropped EXE 52 IoCs

Processes:

RegAsm.exeBdvwcopjyancviqfmold-torrent - group - botnet.exeghdecjhActivate__Full__Setup.exeFile1.exeIntelRapid.exeavg_antivirus_free_setup.exeavg_antivirus_free_setup_x64.exeinstup.exeinstup.exeaswOfferTool.exeaswOfferTool.exeaswOfferTool.exeaswOfferTool.exeaswOfferTool.exeaswOfferTool.exeaswOfferTool.exeaswOfferTool.exesbr.exeSetupInf.exeSetupInf.exeSetupInf.exeSetupInf.exeSetupInf.exeAvEmUpdate.exeAvEmUpdate.exeavBugReport.exeavBugReport.exeRegSvr.exeRegSvr.exeRegSvr.exeRegSvr.exeoverseer.exeengsup.exewsc_proxy.exewsc_proxy.exeengsup.exeSupportTool.exesched.exeaswidsagent.exeavDump.exeAvDump.exeAvDump.exegaming_hook.exefirefox_pass.exeDriverPack-17-Online_981825240.1642596551__kk5viujub8fogy8.exeghdecjhamigo.setup.exesoftware_reporter_tool.exesoftware_reporter_tool.exesoftware_reporter_tool.exesoftware_reporter_tool.exe

pid	process
1416	RegAsm.exe
1200	Bdvwcopjyancviqfmold-torrent - group - botnet.exe
2340	ghdecjh
2824	Activate__Full__Setup.exe
848	File1.exe
1672	IntelRapid.exe
3276	avg_antivirus_free_setup.exe
1720	avg_antivirus_free_setup_x64.exe
1276	instup.exe
3952	instup.exe
1940	aswOfferTool.exe
3932	aswOfferTool.exe
916	aswOfferTool.exe
4092	aswOfferTool.exe
984	aswOfferTool.exe
1048	aswOfferTool.exe
2928	aswOfferTool.exe
3592	aswOfferTool.exe
980	sbr.exe
3148	SetupInf.exe
2036	SetupInf.exe
1220	SetupInf.exe
2516	SetupInf.exe
3728	SetupInf.exe
2328	AvEmUpdate.exe
2592	AvEmUpdate.exe
1044	avBugReport.exe
1784	avBugReport.exe
1320	RegSvr.exe
3756	RegSvr.exe
864	RegSvr.exe
3548	RegSvr.exe
2756	overseer.exe
3584	engsup.exe
348	wsc_proxy.exe
2020	wsc_proxy.exe
2756	engsup.exe
748	SupportTool.exe
684	sched.exe
4148	aswidsagent.exe
4732	avDump.exe
4284	AvDump.exe
1924	AvDump.exe
4244	gaming_hook.exe
2112	firefox_pass.exe
2360	DriverPack-17-Online_981825240.1642596551__kk5viujub8fogy8.exe
4184	ghdecjh
1496	amigo.setup.exe
4980	software_reporter_tool.exe
4688	software_reporter_tool.exe
4944	software_reporter_tool.exe
4196	software_reporter_tool.exe

Sets service image path in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Checks BIOS information in registry 2 TTPs 6 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

IntelRapid.exeActivate__Full__Setup.exeFile1.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	IntelRapid.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	IntelRapid.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Activate__Full__Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Activate__Full__Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	File1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	File1.exe

Deletes itself 1 IoCs

Processes:

powershell.exe

pid process

2760 powershell.exe
Drops startup file 1 IoCs

Processes:

File1.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IntelRapid.lnk File1.exe

pid	process
2760	powershell.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IntelRapid.lnk	File1.exe

Loads dropped DLL 23 IoCs

Processes:

Bdvwcopjyancviqfmold-torrent - group - botnet.exeghdecjhavg_antivirus_free_setup.exeinstup.exeinstup.exeaswOfferTool.exeaswOfferTool.exeaswOfferTool.exeaswOfferTool.exeDriverPack-17-Online_981825240.1642596551__kk5viujub8fogy8.exeghdecjhsoftware_reporter_tool.exe

pid	process
1200	Bdvwcopjyancviqfmold-torrent - group - botnet.exe
2340	ghdecjh
3276	avg_antivirus_free_setup.exe
1276	instup.exe
1276	instup.exe
1276	instup.exe
1276	instup.exe
3952	instup.exe
916	aswOfferTool.exe
984	aswOfferTool.exe
2928	aswOfferTool.exe
3592	aswOfferTool.exe
2360	DriverPack-17-Online_981825240.1642596551__kk5viujub8fogy8.exe
4184	ghdecjh
2360	DriverPack-17-Online_981825240.1642596551__kk5viujub8fogy8.exe
2360	DriverPack-17-Online_981825240.1642596551__kk5viujub8fogy8.exe
4944	software_reporter_tool.exe
4944	software_reporter_tool.exe
4944	software_reporter_tool.exe
4944	software_reporter_tool.exe
4944	software_reporter_tool.exe
4944	software_reporter_tool.exe
4944	software_reporter_tool.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 9 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\Desktop\Activate__Full__Setup\Activate__Full__Setup.exe	themida
behavioral1/memory/2824-858-0x00000000010C0000-0x0000000001771000-memory.dmp	themida
behavioral1/memory/2824-859-0x00000000010C0000-0x0000000001771000-memory.dmp	themida
behavioral1/memory/848-860-0x00007FF79E240000-0x00007FF79EBB1000-memory.dmp	themida
behavioral1/memory/848-861-0x00007FF79E240000-0x00007FF79EBB1000-memory.dmp	themida
behavioral1/memory/848-862-0x00007FF79E240000-0x00007FF79EBB1000-memory.dmp	themida
behavioral1/memory/1672-872-0x00007FF62FF20000-0x00007FF630891000-memory.dmp	themida
behavioral1/memory/1672-873-0x00007FF62FF20000-0x00007FF630891000-memory.dmp	themida
behavioral1/memory/1672-874-0x00007FF62FF20000-0x00007FF630891000-memory.dmp	themida

Windows security modification 2 TTPs 6 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

Processes:

instup.exewsc_proxy.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Provider\Av\{4FC75CA5-1654-5411-7CFB-1893D506BCF4}	instup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Provider	instup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Provider\Av	instup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SECURITY CENTER\PROVIDER\AV\{4FC75CA5-1654-5411-7CFB-1893D506BCF4}	instup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Provider\Av\{4FC75CA5-1654-5411-7CFB-1893D506BCF4}	wsc_proxy.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SECURITY CENTER\PROVIDER\AV\{4FC75CA5-1654-5411-7CFB-1893D506BCF4}	wsc_proxy.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

instup.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\AvRepair = "\"C:\\Program Files\\AVG\\Antivirus\\setup\\instup.exe\" /instop:repair /wait"	instup.exe

Checks for any installed AV software in registry 1 TTPs 23 IoCs

Security Software Discovery

T1063

Processes:

aswidsagent.exeavg_antivirus_free_setup_x64.exeinstup.exeinstup.exeSetupInf.exeAvEmUpdate.exeRegSvr.exewsc_proxy.exeSupportTool.exeSetupInf.exeSetupInf.exeAvEmUpdate.exeRegSvr.exeengsup.exeengsup.exesched.exeSetupInf.exeSetupInf.exeRegSvr.exeRegSvr.exewsc_proxy.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast	aswidsagent.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	avg_antivirus_free_setup_x64.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	instup.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	instup.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast	SetupInf.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast	AvEmUpdate.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast	RegSvr.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast	wsc_proxy.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast	instup.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	SupportTool.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast	SetupInf.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast	SetupInf.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast	AvEmUpdate.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast	RegSvr.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast	engsup.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast	engsup.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast	sched.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast	instup.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast	SetupInf.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast	SetupInf.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast	RegSvr.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast	RegSvr.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast	wsc_proxy.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

Processes:

Activate__Full__Setup.exeFile1.exeIntelRapid.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Activate__Full__Setup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	File1.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	IntelRapid.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Writes to the Master Boot Record (MBR) 1 TTPs 22 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

Processes:

instup.exeSetupInf.exeSupportTool.exeavg_antivirus_free_setup_x64.exeinstup.exeRegSvr.exeavBugReport.exewsc_proxy.exeaswidsagent.exeSetupInf.exeSetupInf.exeSetupInf.exeAvEmUpdate.exeRegSvr.exeRegSvr.exeavg_antivirus_free_setup.exeSetupInf.exeavBugReport.exeRegSvr.exeoverseer.exewsc_proxy.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	instup.exe
File opened for modification	\??\PhysicalDrive0	SetupInf.exe
File opened for modification	\??\PhysicalDrive0	SupportTool.exe
File opened for modification	\??\PhysicalDrive0	avg_antivirus_free_setup_x64.exe
File opened for modification	\??\PhysicalDrive0	instup.exe
File opened for modification	\??\PhysicalDrive0	RegSvr.exe
File opened for modification	\??\PhysicalDrive0	avBugReport.exe
File opened for modification	\??\PhysicalDrive0	wsc_proxy.exe
File opened for modification	\??\PhysicalDrive0	aswidsagent.exe
File opened for modification	\??\PhysicalDrive0	SetupInf.exe
File opened for modification	\??\PhysicalDrive0	SetupInf.exe
File opened for modification	\??\PhysicalDrive0	SetupInf.exe
File opened for modification	\??\PhysicalDrive0	AvEmUpdate.exe
File opened for modification	\??\PhysicalDrive0	RegSvr.exe
File opened for modification	\??\PhysicalDrive0	RegSvr.exe
File opened for modification	\??\PhysicalDrive0
File opened for modification	\??\PhysicalDrive0	avg_antivirus_free_setup.exe
File opened for modification	\??\PhysicalDrive0	SetupInf.exe
File opened for modification	\??\PhysicalDrive0	avBugReport.exe
File opened for modification	\??\PhysicalDrive0	RegSvr.exe
File opened for modification	\??\PhysicalDrive0	overseer.exe
File opened for modification	\??\PhysicalDrive0	wsc_proxy.exe

Drops file in System32 directory 2 IoCs

Processes:

instup.exe

description	ioc	process
File created	C:\Windows\system32\asw76e108cf4f985032.tmp	instup.exe
File opened for modification	C:\Windows\system32\asw76e108cf4f985032.tmp	instup.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Processes:

Activate__Full__Setup.exeFile1.exeIntelRapid.exe

pid process

2824 Activate__Full__Setup.exe
848 File1.exe
1672 IntelRapid.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

b628fc267d7a45f2fc59e9f9ae9a7b26.exe

description pid process target process

PID 2648 set thread context of 1416 2648 b628fc267d7a45f2fc59e9f9ae9a7b26.exe RegAsm.exe

pid	process
2824	Activate__Full__Setup.exe
848	File1.exe
1672	IntelRapid.exe

description	pid	process	target process
PID 2648 set thread context of 1416	2648	b628fc267d7a45f2fc59e9f9ae9a7b26.exe	RegAsm.exe

Drops file in Program Files directory 64 IoCs

Processes:

instup.exeDriverPack-17-Online_981825240.1642596551__kk5viujub8fogy8.exeAvEmUpdate.exe

description	ioc	process
File opened for modification	C:\Program Files\AVG\Antivirus\aswAv.dll.sum	instup.exe
File created	C:\Program Files (x86)\DriverPack\img\assistant-chat\sound.png	DriverPack-17-Online_981825240.1642596551__kk5viujub8fogy8.exe
File created	C:\Program Files (x86)\DriverPack\img\installation\controls\pause.png	DriverPack-17-Online_981825240.1642596551__kk5viujub8fogy8.exe
File created	C:\Program Files (x86)\DriverPack\img\screens\icon-driver-row-collapse.png	DriverPack-17-Online_981825240.1642596551__kk5viujub8fogy8.exe
File created	C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\asw953db016c9908a3e.tmp	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\defs\22011807\db_elfa.sig.sum	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\aswRemoteCache.dll	instup.exe
File created	C:\Program Files\AVG\Antivirus\Licenses\asw6c9f3bb542334a57.tmp	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\defs\22011807\db_conb.dat.sum	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\AvDump.exe	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\aswidpsdkx.dll	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\defs\22011807\aswb1ab63cb2a31b784.tmp	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\BrowserCleanup.ini	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\defs\22011807\db_mx95.sig	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-crt-heap-l1-1-0.dll	instup.exe
File created	C:\Program Files (x86)\DriverPack\css\fonts\Open-Sans\opensans-regular-webfont.ttf	DriverPack-17-Online_981825240.1642596551__kk5viujub8fogy8.exe
File opened for modification	C:\Program Files\AVG\Antivirus\Licenses\aswba3975f35143decf.tmp	instup.exe
File created	C:\Program Files\AVG\Antivirus\x86\asw8ddd3e1976545e22.tmp	instup.exe
File created	C:\Program Files\AVG\Antivirus\setup\Inf\x64\asw21b64affb1252600.tmp	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\Licenses\bzip2.txt.sum	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\AhResStd.dll	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\1033\avg.local_vc142.crt\asw135129d670ae41d9.tmp	instup.exe
File created	C:\Program Files (x86)\DriverPack\css\fonts\DRPicons\DRPicons-webfont.woff	DriverPack-17-Online_981825240.1642596551__kk5viujub8fogy8.exe
File created	C:\Program Files (x86)\DriverPack\img\start-loader.gif	DriverPack-17-Online_981825240.1642596551__kk5viujub8fogy8.exe
File opened for modification	C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\asw7640a2f9f332430d.tmp	instup.exe
File created	C:\Program Files\AVG\Antivirus\aswccc495b58793ec15.tmp	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\nos.dll	instup.exe
File created	C:\Program Files (x86)\DriverPack\img\installation\banner_auth-bg.jpg	DriverPack-17-Online_981825240.1642596551__kk5viujub8fogy8.exe
File created	C:\Program Files (x86)\DriverPack\languages\de.js	DriverPack-17-Online_981825240.1642596551__kk5viujub8fogy8.exe
File opened for modification	C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-processthreads-l1-1-1.dll	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-file-l1-1-0.dll.sum	instup.exe
File created	C:\Program Files (x86)\DriverPack\img\onboarding-new\reboot.png	DriverPack-17-Online_981825240.1642596551__kk5viujub8fogy8.exe
File opened for modification	C:\Program Files\AVG\Antivirus\vaarclient.dll	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\setup\vps_win64-*.vpx	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\defs\22011807\db_evope.dat	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\setup\settings-c8f.ori	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\1033\avg.local_vc142.crt\aswc1e54c3422babc14.tmp	instup.exe
File created	C:\Program Files (x86)\DriverPack\img\info.png	DriverPack-17-Online_981825240.1642596551__kk5viujub8fogy8.exe
File opened for modification	C:\Program Files\AVG\Antivirus\setup\vps_binaries_64-98.vpx	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\aswa45c330cb1d61a17.tmp	instup.exe
File created	C:\Program Files (x86)\DriverPack\img\onboarding-new\many-browsers.png	DriverPack-17-Online_981825240.1642596551__kk5viujub8fogy8.exe
File opened for modification	C:\Program Files\AVG\Antivirus\defs\22011807\db_swf.sig	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\libcrypto-1_1.dll	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\setup\redist	instup.exe
File created	C:\Program Files (x86)\DriverPack\img\screens\globe_hover.png	DriverPack-17-Online_981825240.1642596551__kk5viujub8fogy8.exe
File opened for modification	C:\Program Files\AVG\Antivirus\RescueDisk\background.png	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\event_manager.dll	instup.exe
File created	C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\aswde127a414da1792a.tmp	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\aswa94461b775d5aa99.tmp	instup.exe
File created	C:\Program Files\AVG\Antivirus\setup\Inf\x64\asw14f52da2e24d31c9.tmp	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\Licenses\c-ares.txt.sum	instup.exe
File created	C:\Program Files (x86)\DriverPack\img\screens\menu-protect.png	DriverPack-17-Online_981825240.1642596551__kk5viujub8fogy8.exe
File created	C:\Program Files (x86)\DriverPack\languages\ar.js	DriverPack-17-Online_981825240.1642596551__kk5viujub8fogy8.exe
File created	C:\Program Files\AVG\Antivirus\defs\22011807\asw7c1a05b69bb23faa.tmp	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\defs\22011807\aswbefd2cb52eaa4533.tmp	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\Setup\9f33ab9b-612f-41a3-8f2c-9a2c125d91d2\update.xml	AvEmUpdate.exe
File created	C:\Program Files\AVG\Antivirus\defs\22011807\asw0da971c7294cb22e.tmp	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\libssl-1_1.dll	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\aswSecDns.dll	instup.exe
File created	C:\Program Files (x86)\DriverPack\img\screens\configurator-btn-icon.png	DriverPack-17-Online_981825240.1642596551__kk5viujub8fogy8.exe
File opened for modification	C:\Program Files\AVG\Antivirus\aswec5f82f82f92f136.tmp	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\msvcp140_2.dll.sum	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\Licenses\cef.txt	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\setup\CRT	instup.exe

Drops file in Windows directory 9 IoCs

Processes:

taskmgr.exeinstup.exeWerFault.exetaskmgr.exetaskmgr.exe

description	ioc	process
File created	C:\Windows\rescache\_merged\4183903823\97717462.pri	taskmgr.exe
File opened for modification	C:\Windows\ELAMBKUP\aswfcee0d225d325bdb.tmp	instup.exe
File created	C:\Windows\ELAMBKUP\aswfcee0d225d325bdb.tmp	instup.exe
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	WerFault.exe
File created	C:\Windows\rescache\_merged\4183903823\97717462.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\1601268389\1361672858.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\1601268389\1361672858.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\4183903823\97717462.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\1601268389\1361672858.pri	taskmgr.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3548 5084 WerFault.exe mshta.exe

pid	pid_target	process	target process
3548	5084	WerFault.exe	mshta.exe

Checks SCSI registry key(s) 3 TTPs 24 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

Bdvwcopjyancviqfmold-torrent - group - botnet.exeghdecjhtaskmgr.exeinstup.exetaskmgr.exeghdecjhtaskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Bdvwcopjyancviqfmold-torrent - group - botnet.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ghdecjh
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	instup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	instup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	instup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ghdecjh
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ghdecjh
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ghdecjh
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Bdvwcopjyancviqfmold-torrent - group - botnet.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ghdecjh
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ghdecjh
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Bdvwcopjyancviqfmold-torrent - group - botnet.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	instup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Service	instup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service	instup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Checks processor information in registry 2 TTPs 64 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

RegSvr.exeRegSvr.exeaswidsagent.exeSetupInf.exeinstup.exeSetupInf.exeSetupInf.exeSetupInf.exeAvEmUpdate.exeRegSvr.exewsc_proxy.exeActivate__Full__Setup.exeAvEmUpdate.exeRegSvr.exeengsup.exeSetupInf.exeavBugReport.exewsc_proxy.exeavg_antivirus_free_setup_x64.exeavBugReport.exeinstup.exeengsup.exesched.exetaskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegSvr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	RegSvr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	aswidsagent.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SetupInf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	instup.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	SetupInf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SetupInf.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	SetupInf.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	AvEmUpdate.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	RegSvr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wsc_proxy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Activate__Full__Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	SetupInf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	SetupInf.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	AvEmUpdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegSvr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	engsup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	SetupInf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AvEmUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	RegSvr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	aswidsagent.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	SetupInf.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AvEmUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	avBugReport.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	RegSvr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	wsc_proxy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wsc_proxy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	AvEmUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	RegSvr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	RegSvr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	avg_antivirus_free_setup_x64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	AvEmUpdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	avBugReport.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	avBugReport.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	wsc_proxy.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	SetupInf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegSvr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	RegSvr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	aswidsagent.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	instup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SetupInf.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	AvEmUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AvEmUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	avBugReport.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegSvr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wsc_proxy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	instup.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	engsup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	engsup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	sched.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	wsc_proxy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	instup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	instup.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

1908 timeout.exe

pid	process
1908	timeout.exe

Enumerates system info in registry 2 TTPs 17 IoCs

Query Registry

System Information Discovery

Processes:

chrome.exechrome.exechrome.exechrome.exeinstup.exechrome.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\Bios	instup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BiosReleaseDate	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

Processes:

RegSvr.exeRegSvr.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Toolbar
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser
Set value (data)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extension Validation\{3C5422B3-D1E2-449E-A736-809C934C2F80}	RegSvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Validation\{3C5422B3-D1E2-449E-A736-809C934C2F80}	RegSvr.exe

Modifies registry class 64 IoCs

Processes:

instup.exeinstup.exeRegSvr.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "85"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\avgthemefile\EditFlags = "65536"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FB904E4E-D2C7-4C8D-8492-B620BB9896B1}\ = "AVG IAntimalwareProvider implementation"	RegSvr.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1280x720x96(1).top = "54"
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Main = "75"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Uninstalling kernel driver: avguniv"	instup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\1\0\0\0\0\0 = 74003100000000003354e76510004156474c4f437e312e4352540000580009000400efbe3354e1653354e7652e00000084af01000000050000000000000000000000000000007ae5d8006100760067002e006c006f00630061006c005f00760063003100340032002e0063007200740000001c000000
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "30"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "80"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "File extracted: prod-vps.vpx"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Windows\\system32\\drivers\\avgbidshx.sys"	instup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\AVG	instup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}"
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "32"	instup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Installation_Syncer = "38"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "File downloaded: ais_dll_eng_x64-85b.vpx"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Extracting file: db_o7.nmp"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Extracting file: aswavdetection.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Extracting file: instup.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\AVG\\Antivirus\\Aavm4h.dll"	instup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\avglicfile\shell\open\command	instup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FB904E4E-D2C7-4C8D-8492-B620BB9896B1}	RegSvr.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0"
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\MaxPos1280x720x96(1).y = "4294967295"
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\4
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Extracting file: db_el.dat"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Extracting file: api-ms-win-core-datetime-l1-1-0.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Extracting file: api-ms-win-core-file-l1-2-0.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Extracting file: aswChLic.exe"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\AVG\\Antivirus\\RescueDisk\\Base.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\AVG\\Antivirus\\ring_client.dll"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Installation_Syncer = "52"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\AVG\\Antivirus\\gaming_probe.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\AVG\\Antivirus\\Morphisec\\MorphiDriver.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\AVG\\Antivirus\\setup\\FwReboot.txt"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\AVG\\Antivirus\\setup\\vps_win32-*.vpx"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\AVG\\Antivirus\\setup\\ais_gen_openssl-*.vpx"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\avglicfile\shell\open\command\ = "\"C:\\Program Files\\AVG\\Antivirus\\aswChLic.exe\" \"%1\""	instup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}"
Set value (str)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}"
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Extracting file: ais_cmp_swhealth_x64"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Extracting file: vcruntime140.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Extracting file: ntp_time.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Extracting file: sched.exe"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\AVG\\Antivirus\\aswWebRepIE.dll"	instup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "File downloaded: ais_gen_tools-8a3.vpx"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Extracting file: db_sl.nmp"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Extracting file: AVGSvc.exe"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\AVG\\Antivirus\\setup\\part-iex-*.vpx"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Uninstalling kernel driver: avgHwid"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Registering avgKbd as a filter driver"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Extracting file: part-prg_ais-150b0c8f.vpx"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "File extracted: prod-pgm.vpx"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Extracting file: db_w6.sig"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Extracting file: hns_tools.dll"	instup.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\1
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Extracting file: api-ms-win-crt-environment-l1-1-0.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\avgsoundsfile\ = "AVG soundpack file"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "25"	instup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\1\0\0\MRUListEx = 00000000ffffffff

Suspicious behavior: AddClipboardFormatListener 7 IoCs

Processes:

IntelRapid.exe

pid process

3040
3040
1672 IntelRapid.exe
3040
3040
3040
3040

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exetaskmgr.exeb628fc267d7a45f2fc59e9f9ae9a7b26.exepowershell.exeBdvwcopjyancviqfmold-torrent - group - botnet.exepowershell.exe

pid	process
2588	powershell.exe
2588	powershell.exe
2220	taskmgr.exe
2220	taskmgr.exe
2588	powershell.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2648	b628fc267d7a45f2fc59e9f9ae9a7b26.exe
2648	b628fc267d7a45f2fc59e9f9ae9a7b26.exe
2760	powershell.exe
2220	taskmgr.exe
2220	taskmgr.exe
1200	Bdvwcopjyancviqfmold-torrent - group - botnet.exe
1200	Bdvwcopjyancviqfmold-torrent - group - botnet.exe
1420	powershell.exe
2760	powershell.exe
1420	powershell.exe
2220	taskmgr.exe
2220	taskmgr.exe
2760	powershell.exe
2220	taskmgr.exe
1420	powershell.exe
2220	taskmgr.exe
2220	taskmgr.exe
3040
3040
3040
3040
3040
3040
3040
3040
2220	taskmgr.exe
3040
3040
3040

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

Processes:

taskmgr.exe7zG.exetaskmgr.exe

pid process

3040
2220 taskmgr.exe
708 7zG.exe
4476 taskmgr.exe
Suspicious behavior: LoadsDriver 14 IoCs

Processes:

pid process

608
608
608
608
608
608
608
608
608
608
608
608
608
608
Suspicious behavior: MapViewOfSection 3 IoCs

Processes:

Bdvwcopjyancviqfmold-torrent - group - botnet.exeghdecjhghdecjh

pid process

1200 Bdvwcopjyancviqfmold-torrent - group - botnet.exe
2340 ghdecjh
4184 ghdecjh

pid	process
608
608
608
608
608
608
608
608
608
608
608
608
608
608

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 43 IoCs

Processes:

chrome.exechrome.exechrome.exechrome.exechrome.exe

pid	process
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
1800	chrome.exe
1800	chrome.exe
1800	chrome.exe
1800	chrome.exe
1800	chrome.exe
1800	chrome.exe
1800	chrome.exe
1800	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exetaskmgr.exeb628fc267d7a45f2fc59e9f9ae9a7b26.exepowershell.exepowershell.exeRegAsm.exe

description	pid	process
Token: SeDebugPrivilege	2588	powershell.exe
Token: SeDebugPrivilege	2220	taskmgr.exe
Token: SeSystemProfilePrivilege	2220	taskmgr.exe
Token: SeCreateGlobalPrivilege	2220	taskmgr.exe
Token: SeDebugPrivilege	2648	b628fc267d7a45f2fc59e9f9ae9a7b26.exe
Token: SeDebugPrivilege	2760	powershell.exe
Token: SeDebugPrivilege	1420	powershell.exe
Token: SeShutdownPrivilege	3040
Token: SeCreatePagefilePrivilege	3040
Token: SeDebugPrivilege	1416	RegAsm.exe
Token: SeShutdownPrivilege	3040
Token: SeCreatePagefilePrivilege	3040
Token: SeShutdownPrivilege	3040
Token: SeCreatePagefilePrivilege	3040
Token: SeShutdownPrivilege	3040
Token: SeCreatePagefilePrivilege	3040
Token: SeShutdownPrivilege	3040
Token: SeCreatePagefilePrivilege	3040
Token: SeShutdownPrivilege	3040
Token: SeCreatePagefilePrivilege	3040
Token: SeShutdownPrivilege	3040
Token: SeCreatePagefilePrivilege	3040
Token: SeShutdownPrivilege	3040
Token: SeCreatePagefilePrivilege	3040
Token: SeShutdownPrivilege	3040
Token: SeCreatePagefilePrivilege	3040
Token: SeShutdownPrivilege	3040
Token: SeCreatePagefilePrivilege	3040
Token: SeShutdownPrivilege	3040
Token: SeCreatePagefilePrivilege	3040
Token: SeShutdownPrivilege	3040
Token: SeCreatePagefilePrivilege	3040
Token: SeShutdownPrivilege	3040
Token: SeCreatePagefilePrivilege	3040
Token: SeShutdownPrivilege	3040
Token: SeCreatePagefilePrivilege	3040
Token: SeShutdownPrivilege	3040
Token: SeCreatePagefilePrivilege	3040
Token: SeShutdownPrivilege	3040
Token: SeCreatePagefilePrivilege	3040
Token: SeShutdownPrivilege	3040
Token: SeCreatePagefilePrivilege	3040
Token: SeShutdownPrivilege	3040
Token: SeCreatePagefilePrivilege	3040
Token: SeShutdownPrivilege	3040
Token: SeCreatePagefilePrivilege	3040
Token: SeShutdownPrivilege	3040
Token: SeCreatePagefilePrivilege	3040
Token: SeShutdownPrivilege	3040
Token: SeCreatePagefilePrivilege	3040
Token: SeShutdownPrivilege	3040
Token: SeCreatePagefilePrivilege	3040
Token: SeShutdownPrivilege	3040
Token: SeCreatePagefilePrivilege	3040
Token: SeShutdownPrivilege	3040
Token: SeCreatePagefilePrivilege	3040
Token: SeShutdownPrivilege	3040
Token: SeCreatePagefilePrivilege	3040
Token: SeShutdownPrivilege	3040
Token: SeCreatePagefilePrivilege	3040
Token: SeShutdownPrivilege	3040
Token: SeCreatePagefilePrivilege	3040
Token: SeShutdownPrivilege	3040
Token: SeCreatePagefilePrivilege	3040

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

taskmgr.exe

pid	process
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

taskmgr.exe

pid	process
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe

Suspicious use of SetWindowsHookEx 46 IoCs

Processes:

instup.exeinstup.exeSupportTool.exeOpenWith.exe

pid	process
3040
3040
3040
3040
3040
3040
3040
3040
1276	instup.exe
3952	instup.exe
3952	instup.exe
3040
3040
748	SupportTool.exe
748	SupportTool.exe
748	SupportTool.exe
3040
3040
4104	OpenWith.exe
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

b628fc267d7a45f2fc59e9f9ae9a7b26.exeWScript.exeWScript.exechrome.exe

description	pid	process	target process
PID 2648 wrote to memory of 2588	2648	b628fc267d7a45f2fc59e9f9ae9a7b26.exe	powershell.exe
PID 2648 wrote to memory of 2588	2648	b628fc267d7a45f2fc59e9f9ae9a7b26.exe	powershell.exe
PID 2648 wrote to memory of 2588	2648	b628fc267d7a45f2fc59e9f9ae9a7b26.exe	powershell.exe
PID 2648 wrote to memory of 3872	2648	b628fc267d7a45f2fc59e9f9ae9a7b26.exe	WScript.exe
PID 2648 wrote to memory of 3872	2648	b628fc267d7a45f2fc59e9f9ae9a7b26.exe	WScript.exe
PID 2648 wrote to memory of 3872	2648	b628fc267d7a45f2fc59e9f9ae9a7b26.exe	WScript.exe
PID 2648 wrote to memory of 2700	2648	b628fc267d7a45f2fc59e9f9ae9a7b26.exe	WScript.exe
PID 2648 wrote to memory of 2700	2648	b628fc267d7a45f2fc59e9f9ae9a7b26.exe	WScript.exe
PID 2648 wrote to memory of 2700	2648	b628fc267d7a45f2fc59e9f9ae9a7b26.exe	WScript.exe
PID 2648 wrote to memory of 2760	2648	b628fc267d7a45f2fc59e9f9ae9a7b26.exe	powershell.exe
PID 2648 wrote to memory of 2760	2648	b628fc267d7a45f2fc59e9f9ae9a7b26.exe	powershell.exe
PID 2648 wrote to memory of 2760	2648	b628fc267d7a45f2fc59e9f9ae9a7b26.exe	powershell.exe
PID 2648 wrote to memory of 1416	2648	b628fc267d7a45f2fc59e9f9ae9a7b26.exe	RegAsm.exe
PID 2648 wrote to memory of 1416	2648	b628fc267d7a45f2fc59e9f9ae9a7b26.exe	RegAsm.exe
PID 2648 wrote to memory of 1416	2648	b628fc267d7a45f2fc59e9f9ae9a7b26.exe	RegAsm.exe
PID 3872 wrote to memory of 1420	3872	WScript.exe	powershell.exe
PID 3872 wrote to memory of 1420	3872	WScript.exe	powershell.exe
PID 3872 wrote to memory of 1420	3872	WScript.exe	powershell.exe
PID 2648 wrote to memory of 1416	2648	b628fc267d7a45f2fc59e9f9ae9a7b26.exe	RegAsm.exe
PID 2648 wrote to memory of 1416	2648	b628fc267d7a45f2fc59e9f9ae9a7b26.exe	RegAsm.exe
PID 2648 wrote to memory of 1416	2648	b628fc267d7a45f2fc59e9f9ae9a7b26.exe	RegAsm.exe
PID 2648 wrote to memory of 1416	2648	b628fc267d7a45f2fc59e9f9ae9a7b26.exe	RegAsm.exe
PID 2648 wrote to memory of 1416	2648	b628fc267d7a45f2fc59e9f9ae9a7b26.exe	RegAsm.exe
PID 2700 wrote to memory of 1200	2700	WScript.exe	Bdvwcopjyancviqfmold-torrent - group - botnet.exe
PID 2700 wrote to memory of 1200	2700	WScript.exe	Bdvwcopjyancviqfmold-torrent - group - botnet.exe
PID 2700 wrote to memory of 1200	2700	WScript.exe	Bdvwcopjyancviqfmold-torrent - group - botnet.exe
PID 3040 wrote to memory of 3252	3040		chrome.exe
PID 3040 wrote to memory of 3252	3040		chrome.exe
PID 3252 wrote to memory of 2244	3252	chrome.exe	chrome.exe
PID 3252 wrote to memory of 2244	3252	chrome.exe	chrome.exe
PID 3252 wrote to memory of 1852	3252	chrome.exe	chrome.exe
PID 3252 wrote to memory of 1852	3252	chrome.exe	chrome.exe
PID 3252 wrote to memory of 1852	3252	chrome.exe	chrome.exe
PID 3252 wrote to memory of 1852	3252	chrome.exe	chrome.exe
PID 3252 wrote to memory of 1852	3252	chrome.exe	chrome.exe
PID 3252 wrote to memory of 1852	3252	chrome.exe	chrome.exe
PID 3252 wrote to memory of 1852	3252	chrome.exe	chrome.exe
PID 3252 wrote to memory of 1852	3252	chrome.exe	chrome.exe
PID 3252 wrote to memory of 1852	3252	chrome.exe	chrome.exe
PID 3252 wrote to memory of 1852	3252	chrome.exe	chrome.exe
PID 3252 wrote to memory of 1852	3252	chrome.exe	chrome.exe
PID 3252 wrote to memory of 1852	3252	chrome.exe	chrome.exe
PID 3252 wrote to memory of 1852	3252	chrome.exe	chrome.exe
PID 3252 wrote to memory of 1852	3252	chrome.exe	chrome.exe
PID 3252 wrote to memory of 1852	3252	chrome.exe	chrome.exe
PID 3252 wrote to memory of 1852	3252	chrome.exe	chrome.exe
PID 3252 wrote to memory of 1852	3252	chrome.exe	chrome.exe
PID 3252 wrote to memory of 1852	3252	chrome.exe	chrome.exe
PID 3252 wrote to memory of 1852	3252	chrome.exe	chrome.exe
PID 3252 wrote to memory of 1852	3252	chrome.exe	chrome.exe
PID 3252 wrote to memory of 1852	3252	chrome.exe	chrome.exe
PID 3252 wrote to memory of 1852	3252	chrome.exe	chrome.exe
PID 3252 wrote to memory of 1852	3252	chrome.exe	chrome.exe
PID 3252 wrote to memory of 1852	3252	chrome.exe	chrome.exe
PID 3252 wrote to memory of 1852	3252	chrome.exe	chrome.exe
PID 3252 wrote to memory of 1852	3252	chrome.exe	chrome.exe
PID 3252 wrote to memory of 1852	3252	chrome.exe	chrome.exe
PID 3252 wrote to memory of 1852	3252	chrome.exe	chrome.exe
PID 3252 wrote to memory of 1852	3252	chrome.exe	chrome.exe
PID 3252 wrote to memory of 1852	3252	chrome.exe	chrome.exe
PID 3252 wrote to memory of 1852	3252	chrome.exe	chrome.exe
PID 3252 wrote to memory of 1852	3252	chrome.exe	chrome.exe
PID 3252 wrote to memory of 1852	3252	chrome.exe	chrome.exe
PID 3252 wrote to memory of 1852	3252	chrome.exe	chrome.exe

C:\Users\Admin\AppData\Local\Temp\b628fc267d7a45f2fc59e9f9ae9a7b26.exe
"C:\Users\Admin\AppData\Local\Temp\b628fc267d7a45f2fc59e9f9ae9a7b26.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2648

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAwADsAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAwADsA
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2588

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Xsvtgsafoxuevumbywzd.vbs"
2⤵
- Suspicious use of WriteProcessMemory
PID:3872

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath 'C:\','C:\Users\Admin\AppData\Roaming\WindowsSettingsDrive\rjfggfsedfew.exe'
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1420

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Nwinnbsokj.vbs"
2⤵
- Suspicious use of WriteProcessMemory
PID:2700

C:\Users\Admin\AppData\Local\Temp\Bdvwcopjyancviqfmold-torrent - group - botnet.exe
"C:\Users\Admin\AppData\Local\Temp\Bdvwcopjyancviqfmold-torrent - group - botnet.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1200

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -s 5; Remove-Item -Path "C:\Users\Admin\AppData\Local\Temp\b628fc267d7a45f2fc59e9f9ae9a7b26.exe" -Force
2⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2760

C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1416

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2220

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {3eef301f-b596-4c0b-bd92-013beafce793} -Embedding
1⤵
PID:2204

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2164

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:3252

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffb379f4f50,0x7ffb379f4f60,0x7ffb379f4f70
2⤵
PID:2244

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1484,17635872891575794380,8994597690649718773,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1496 /prefetch:2
2⤵
PID:1852

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1484,17635872891575794380,8994597690649718773,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1824 /prefetch:8
2⤵
PID:3712

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1484,17635872891575794380,8994597690649718773,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2108 /prefetch:8
2⤵
PID:748

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1484,17635872891575794380,8994597690649718773,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2660 /prefetch:1
2⤵
PID:1336

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1484,17635872891575794380,8994597690649718773,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2608 /prefetch:1
2⤵
PID:2828

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1484,17635872891575794380,8994597690649718773,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3520 /prefetch:1
2⤵
PID:2824

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1484,17635872891575794380,8994597690649718773,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4500 /prefetch:8
2⤵
PID:3140

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1484,17635872891575794380,8994597690649718773,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4624 /prefetch:8
2⤵
PID:1784

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1484,17635872891575794380,8994597690649718773,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4768 /prefetch:8
2⤵
PID:1436

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1484,17635872891575794380,8994597690649718773,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4824 /prefetch:8
2⤵
PID:3132

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1484,17635872891575794380,8994597690649718773,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4408 /prefetch:8
2⤵
PID:3488

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1484,17635872891575794380,8994597690649718773,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4852 /prefetch:8
2⤵
PID:3624

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1484,17635872891575794380,8994597690649718773,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4532 /prefetch:8
2⤵
PID:712

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1484,17635872891575794380,8994597690649718773,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4796 /prefetch:8
2⤵
PID:872

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1484,17635872891575794380,8994597690649718773,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5140 /prefetch:8
2⤵
PID:3664

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1484,17635872891575794380,8994597690649718773,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4532 /prefetch:8
2⤵
PID:788

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1484,17635872891575794380,8994597690649718773,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5244 /prefetch:8
2⤵
PID:1540

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1484,17635872891575794380,8994597690649718773,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3800 /prefetch:8
2⤵
PID:328

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1484,17635872891575794380,8994597690649718773,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5108 /prefetch:8
2⤵
PID:3068

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1484,17635872891575794380,8994597690649718773,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5304 /prefetch:8
2⤵
PID:1812

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1484,17635872891575794380,8994597690649718773,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4792 /prefetch:8
2⤵
PID:1344

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1484,17635872891575794380,8994597690649718773,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4828 /prefetch:8
2⤵
PID:3916

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1484,17635872891575794380,8994597690649718773,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5020 /prefetch:8
2⤵
PID:1048

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1484,17635872891575794380,8994597690649718773,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5320 /prefetch:8
2⤵
PID:1472

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1484,17635872891575794380,8994597690649718773,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5416 /prefetch:8
2⤵
PID:1784

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1484,17635872891575794380,8994597690649718773,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
2⤵
PID:3624

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1484,17635872891575794380,8994597690649718773,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4544 /prefetch:1
2⤵
PID:2248

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1484,17635872891575794380,8994597690649718773,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
2⤵
PID:1632

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1484,17635872891575794380,8994597690649718773,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2732 /prefetch:1
2⤵
PID:3916

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1484,17635872891575794380,8994597690649718773,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
2⤵
PID:1044

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1484,17635872891575794380,8994597690649718773,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1996 /prefetch:1
2⤵
PID:1048

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1484,17635872891575794380,8994597690649718773,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 /prefetch:8
2⤵
PID:2224

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1484,17635872891575794380,8994597690649718773,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4728 /prefetch:8
2⤵
PID:2820

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1484,17635872891575794380,8994597690649718773,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1992 /prefetch:1
2⤵
PID:980

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1484,17635872891575794380,8994597690649718773,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2660 /prefetch:1
2⤵
PID:3512

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1484,17635872891575794380,8994597690649718773,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5540 /prefetch:8
2⤵
PID:1356

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1484,17635872891575794380,8994597690649718773,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4948 /prefetch:8
2⤵
PID:3756

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1484,17635872891575794380,8994597690649718773,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3588 /prefetch:8
2⤵
PID:1088

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1484,17635872891575794380,8994597690649718773,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5732 /prefetch:8
2⤵
PID:3692

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1484,17635872891575794380,8994597690649718773,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
2⤵
PID:640

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1484,17635872891575794380,8994597690649718773,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3520 /prefetch:8
2⤵
PID:4092

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1484,17635872891575794380,8994597690649718773,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5852 /prefetch:8
2⤵
PID:1892

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1484,17635872891575794380,8994597690649718773,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2632 /prefetch:8
2⤵
PID:584

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1484,17635872891575794380,8994597690649718773,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2464 /prefetch:8
2⤵
PID:3444

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1484,17635872891575794380,8994597690649718773,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4724 /prefetch:8
2⤵
PID:1608

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1484,17635872891575794380,8994597690649718773,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2456 /prefetch:8
2⤵
PID:872

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1484,17635872891575794380,8994597690649718773,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
2⤵
PID:2224

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1484,17635872891575794380,8994597690649718773,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1412 /prefetch:8
2⤵
PID:2220

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1484,17635872891575794380,8994597690649718773,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2184 /prefetch:8
2⤵
PID:1212

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1484,17635872891575794380,8994597690649718773,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1424 /prefetch:2
2⤵
PID:2224

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1484,17635872891575794380,8994597690649718773,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5268 /prefetch:8
2⤵
PID:3684

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1484,17635872891575794380,8994597690649718773,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=164 /prefetch:8
2⤵
PID:2212

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1484,17635872891575794380,8994597690649718773,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1432 /prefetch:8
2⤵
PID:588

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1484,17635872891575794380,8994597690649718773,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5644 /prefetch:8
2⤵
PID:1608

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Activate__Full__Setup\" -ad -an -ai#7zMap17988:104:7zEvent2980
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:708

C:\Users\Admin\AppData\Roaming\ghdecjh
C:\Users\Admin\AppData\Roaming\ghdecjh
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:2340

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:1228

C:\Users\Admin\Desktop\Activate__Full__Setup\Activate__Full__Setup.exe
"C:\Users\Admin\Desktop\Activate__Full__Setup\Activate__Full__Setup.exe"
1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
PID:2824

C:\Users\Admin\AppData\Local\Temp\File1.exe
"C:\Users\Admin\AppData\Local\Temp\File1.exe"
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Drops startup file
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:848

C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe
"C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe"
3⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: AddClipboardFormatListener
PID:1672

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c timeout /t 3 & del /f /q "C:\Users\Admin\Desktop\Activate__Full__Setup\Activate__Full__Setup.exe"
2⤵
PID:348

C:\Windows\SysWOW64\timeout.exe
timeout /t 3
3⤵
- Delays execution with timeout.exe
PID:1908

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
PID:3960

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:2340

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffb379f4f50,0x7ffb379f4f60,0x7ffb379f4f70
2⤵
PID:1908

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1496,8364311934849627725,10792747070000969139,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1512 /prefetch:2
2⤵
PID:4000

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1496,8364311934849627725,10792747070000969139,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1896 /prefetch:8
2⤵
PID:664

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1496,8364311934849627725,10792747070000969139,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2352 /prefetch:8
2⤵
PID:3296

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1496,8364311934849627725,10792747070000969139,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2668 /prefetch:1
2⤵
PID:1320

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1496,8364311934849627725,10792747070000969139,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2648 /prefetch:1
2⤵
PID:2684

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1496,8364311934849627725,10792747070000969139,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
2⤵
PID:1244

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1496,8364311934849627725,10792747070000969139,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3688 /prefetch:1
2⤵
PID:3120

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1496,8364311934849627725,10792747070000969139,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4008 /prefetch:8
2⤵
PID:1824

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1496,8364311934849627725,10792747070000969139,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4168 /prefetch:8
2⤵
PID:1852

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1496,8364311934849627725,10792747070000969139,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4484 /prefetch:8
2⤵
PID:3584

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1496,8364311934849627725,10792747070000969139,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4632 /prefetch:8
2⤵
PID:2220

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1496,8364311934849627725,10792747070000969139,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 /prefetch:8
2⤵
PID:2640

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1496,8364311934849627725,10792747070000969139,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5012 /prefetch:8
2⤵
PID:1524

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1496,8364311934849627725,10792747070000969139,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4836 /prefetch:8
2⤵
PID:3572

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1496,8364311934849627725,10792747070000969139,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3240 /prefetch:8
2⤵
PID:2880

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1496,8364311934849627725,10792747070000969139,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2544 /prefetch:8
2⤵
PID:1912

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1496,8364311934849627725,10792747070000969139,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4836 /prefetch:8
2⤵
PID:1424

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1496,8364311934849627725,10792747070000969139,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2008 /prefetch:8
2⤵
PID:2640

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:3444

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffb379f4f50,0x7ffb379f4f60,0x7ffb379f4f70
2⤵
PID:3540

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=2016,283153520152649051,9536899365055845100,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2032 /prefetch:2
2⤵
PID:3772

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2016,283153520152649051,9536899365055845100,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2096 /prefetch:8
2⤵
PID:3756

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=2016,283153520152649051,9536899365055845100,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2652 /prefetch:1
2⤵
PID:3140

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2016,283153520152649051,9536899365055845100,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2084 /prefetch:8
2⤵
PID:2076

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=2016,283153520152649051,9536899365055845100,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2660 /prefetch:1
2⤵
PID:3132

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=2016,283153520152649051,9536899365055845100,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
2⤵
PID:3196

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=2016,283153520152649051,9536899365055845100,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3772 /prefetch:1
2⤵
PID:2020

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2016,283153520152649051,9536899365055845100,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4972 /prefetch:8
2⤵
PID:1804

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2016,283153520152649051,9536899365055845100,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5208 /prefetch:8
2⤵
PID:2568

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2016,283153520152649051,9536899365055845100,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4912 /prefetch:8
2⤵
PID:3864

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2016,283153520152649051,9536899365055845100,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5084 /prefetch:8
2⤵
PID:3028

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=2016,283153520152649051,9536899365055845100,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
2⤵
PID:588

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=2016,283153520152649051,9536899365055845100,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2932 /prefetch:1
2⤵
PID:3560

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=2016,283153520152649051,9536899365055845100,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
2⤵
PID:2932

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=2016,283153520152649051,9536899365055845100,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3572 /prefetch:1
2⤵
PID:3904

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=2016,283153520152649051,9536899365055845100,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
2⤵
PID:1156

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=2016,283153520152649051,9536899365055845100,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3824 /prefetch:1
2⤵
PID:984

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=2016,283153520152649051,9536899365055845100,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3816 /prefetch:1
2⤵
PID:492

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2016,283153520152649051,9536899365055845100,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2964 /prefetch:8
2⤵
PID:1344

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2016,283153520152649051,9536899365055845100,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2996 /prefetch:8
2⤵
PID:3276

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2016,283153520152649051,9536899365055845100,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2988 /prefetch:8
2⤵
PID:2212

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2016,283153520152649051,9536899365055845100,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5988 /prefetch:8
2⤵
PID:3624

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2016,283153520152649051,9536899365055845100,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2952 /prefetch:8
2⤵
PID:4036

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2016,283153520152649051,9536899365055845100,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5944 /prefetch:8
2⤵
PID:2492

C:\Users\Admin\Downloads\avg_antivirus_free_setup.exe
"C:\Users\Admin\Downloads\avg_antivirus_free_setup.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
PID:3276

C:\Windows\Temp\asw.701a63e024ee7288\avg_antivirus_free_setup_x64.exe
"C:\Windows\Temp\asw.701a63e024ee7288\avg_antivirus_free_setup_x64.exe" /cookie:mmm_bav_012_999_a6a_m /ga_clientid:0a4741e1-1bd3-4097-8c96-bb0f0127dd80 /edat_dir:C:\Windows\Temp\asw.701a63e024ee7288
3⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
PID:1720

C:\Windows\Temp\asw.f81ea8f0a210e6ca\instup.exe
"C:\Windows\Temp\asw.f81ea8f0a210e6ca\instup.exe" /sfx:lite /sfxstorage:C:\Windows\Temp\asw.f81ea8f0a210e6ca /edition:15 /prod:ais /guid:79f6ee60-f1af-492b-a098-96a087698707 /ga_clientid:0a4741e1-1bd3-4097-8c96-bb0f0127dd80 /cookie:mmm_bav_012_999_a6a_m /ga_clientid:0a4741e1-1bd3-4097-8c96-bb0f0127dd80 /edat_dir:C:\Windows\Temp\asw.701a63e024ee7288
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1276

C:\Windows\Temp\asw.f81ea8f0a210e6ca\New_150b0c8f\instup.exe
"C:\Windows\Temp\asw.f81ea8f0a210e6ca\New_150b0c8f\instup.exe" /sfx /sfxstorage:C:\Windows\Temp\asw.f81ea8f0a210e6ca /edition:15 /prod:ais /guid:79f6ee60-f1af-492b-a098-96a087698707 /ga_clientid:0a4741e1-1bd3-4097-8c96-bb0f0127dd80 /cookie:mmm_bav_012_999_a6a_m /edat_dir:C:\Windows\Temp\asw.701a63e024ee7288 /online_installer
5⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3952

C:\Windows\Temp\asw.f81ea8f0a210e6ca\New_150b0c8f\aswOfferTool.exe
"C:\Windows\Temp\asw.f81ea8f0a210e6ca\New_150b0c8f\aswOfferTool.exe" -checkGToolbar -elevated
6⤵
- Executes dropped EXE
PID:1940

C:\Windows\Temp\asw.f81ea8f0a210e6ca\New_150b0c8f\aswOfferTool.exe
"C:\Windows\Temp\asw.f81ea8f0a210e6ca\New_150b0c8f\aswOfferTool.exe" /check_secure_browser
6⤵
- Executes dropped EXE
PID:3932

C:\Windows\Temp\asw.f81ea8f0a210e6ca\New_150b0c8f\aswOfferTool.exe
"C:\Windows\Temp\asw.f81ea8f0a210e6ca\New_150b0c8f\aswOfferTool.exe" -checkChrome -elevated
6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:916

C:\Windows\Temp\asw.f81ea8f0a210e6ca\New_150b0c8f\aswOfferTool.exe
"C:\Windows\Temp\asw.f81ea8f0a210e6ca\New_150b0c8f\aswOfferTool.exe" -checkChromeReactivation -elevated -bc=AWFC
6⤵
- Executes dropped EXE
PID:4092

C:\Users\Public\Documents\aswOfferTool.exe
"C:\Users\Public\Documents\aswOfferTool.exe" -checkChromeReactivation -bc=AWFC
7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:984

C:\Windows\Temp\asw.f81ea8f0a210e6ca\New_150b0c8f\aswOfferTool.exe
"C:\Windows\Temp\asw.f81ea8f0a210e6ca\New_150b0c8f\aswOfferTool.exe" -checkChromeReactivation -elevated -bc=AWFC
6⤵
- Executes dropped EXE
PID:1048

C:\Users\Public\Documents\aswOfferTool.exe
"C:\Users\Public\Documents\aswOfferTool.exe" -checkChromeReactivation -bc=AWFC
7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2928

C:\Windows\Temp\asw.f81ea8f0a210e6ca\New_150b0c8f\aswOfferTool.exe
"C:\Windows\Temp\asw.f81ea8f0a210e6ca\New_150b0c8f\aswOfferTool.exe" -checkChrome -elevated
6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3592

C:\Windows\Temp\asw.f81ea8f0a210e6ca\New_150b0c8f\sbr.exe
"C:\Windows\Temp\asw.f81ea8f0a210e6ca\New_150b0c8f\sbr.exe" 3952 "AVG Antivirus setup" "AVG Antivirus is being installed. Do not shut down your computer!"
6⤵
- Executes dropped EXE
PID:980

C:\Program Files\AVG\Antivirus\SetupInf.exe
"C:\Program Files\AVG\Antivirus\SetupInf.exe" /uninstall /catalog:avgRdr2.cat
6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
PID:3148

C:\Program Files\AVG\Antivirus\SetupInf.exe
"C:\Program Files\AVG\Antivirus\SetupInf.exe" /uninstall /catalog:avgHwid.cat
6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
PID:2036

C:\Program Files\AVG\Antivirus\SetupInf.exe
"C:\Program Files\AVG\Antivirus\SetupInf.exe" /uninstall /catalog:avgVmm.cat
6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
PID:1220

C:\Program Files\AVG\Antivirus\SetupInf.exe
"C:\Program Files\AVG\Antivirus\SetupInf.exe" /uninstall /catalog:avgRvrt.cat
6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
PID:2516

C:\Program Files\AVG\Antivirus\SetupInf.exe
"C:\Program Files\AVG\Antivirus\SetupInf.exe" /elaminst C:\Windows\system32\drivers\avgElam.sys
6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
PID:3728

C:\Program Files\AVG\Antivirus\AvEmUpdate.exe
"C:\Program Files\AVG\Antivirus\AvEmUpdate.exe" /installer /reg
6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Checks processor information in registry
PID:2328

C:\Program Files\AVG\Antivirus\AvEmUpdate.exe
"C:\Program Files\AVG\Antivirus\AvEmUpdate.exe" /installer1
6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Checks processor information in registry
PID:2592

C:\Program Files\AVG\Antivirus\avBugReport.exe
"C:\Program Files\AVG\Antivirus\avBugReport.exe" --send "dumps|report" --silent --path "C:\ProgramData\AVG\Antivirus" --guid 79f6ee60-f1af-492b-a098-96a087698707
7⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
PID:1044

C:\Program Files\AVG\Antivirus\avBugReport.exe
"C:\Program Files\AVG\Antivirus\avBugReport.exe" --send dumps|report --silent --keep --contentfilter "chrome-extension://gomekmidlodglbbmalcneegieacbdmki" --product 129 --programpath "C:\Program Files\AVG\Antivirus" --logpath "C:\ProgramData\AVG\Antivirus\log" --path "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\reports" --guid 79f6ee60-f1af-492b-a098-96a087698707
7⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
PID:1784

C:\Program Files\AVG\Antivirus\x86\RegSvr.exe
"C:\Program Files\AVG\Antivirus\x86\RegSvr.exe" "C:\Program Files\AVG\Antivirus\x86\aswAMSI.dll"
6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Modifies Internet Explorer settings
PID:1320

C:\Program Files\AVG\Antivirus\RegSvr.exe
"C:\Program Files\AVG\Antivirus\RegSvr.exe" "C:\Program Files\AVG\Antivirus\aswAMSI.dll"
6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies registry class
PID:3756

C:\Program Files\AVG\Antivirus\x86\RegSvr.exe
"C:\Program Files\AVG\Antivirus\x86\RegSvr.exe" "C:\Program Files\AVG\Antivirus\x86\asOutExt.dll"
6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
PID:864

C:\Program Files\AVG\Antivirus\RegSvr.exe
"C:\Program Files\AVG\Antivirus\RegSvr.exe" "C:\Program Files\AVG\Antivirus\asOutExt.dll"
6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
PID:3548

C:\Program Files\Common Files\AVG\Overseer\overseer.exe
"C:\Program Files\Common Files\AVG\Overseer\overseer.exe" /skip_uptime /skip_remediations
6⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:2756

C:\Program Files\AVG\Antivirus\defs\22011807\engsup.exe
"C:\Program Files\AVG\Antivirus\defs\22011807\engsup.exe" /prepare_definitions_folder
6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Checks processor information in registry
PID:3584

C:\Program Files\AVG\Antivirus\wsc_proxy.exe
"C:\Program Files\AVG\Antivirus\wsc_proxy.exe" /svc /register /ppl_svc
6⤵
- Executes dropped EXE
- Windows security modification
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
PID:348

C:\Program Files\AVG\Antivirus\defs\22011807\engsup.exe
"C:\Program Files\AVG\Antivirus\defs\22011807\engsup.exe" /avg /get_latest_ga_client_id /get_latest_landingpageid_cookie /get_latest_pagedownloadid_cookie
6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Checks processor information in registry
PID:2756

C:\Program Files\AVG\Antivirus\wsc_proxy.exe
"C:\Program Files\AVG\Antivirus\wsc_proxy.exe" /runassvc /rpcserver
1⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
PID:2020

C:\Windows\system32\compattelrunner.exe
C:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW
1⤵
PID:2248

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: GetForegroundWindowSpam
PID:4476

C:\Program Files\AVG\Antivirus\SupportTool.exe
"C:\Program Files\AVG\Antivirus\SupportTool.exe"
1⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
PID:748

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4104

C:\Program Files\AVG\Antivirus\sched.exe
"C:\Program Files\AVG\Antivirus\sched.exe"
1⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Checks processor information in registry
PID:684

C:\Program Files\AVG\Antivirus\aswidsagent.exe
"C:\Program Files\AVG\Antivirus\aswidsagent.exe"
1⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
PID:4148

C:\Program Files\AVG\Antivirus\avDump.exe
"C:\Program Files\AVG\Antivirus\avDump.exe" --pid 4148 --exception_ptr 000000A4D6AFE540 --thread_id 4748 --dump_level 0 --handle_data 1 --dump_file "C:\ProgramData\AVG\Antivirus\log\unp309363703812248651x-manual.mdmp" --comment "Cause: VectoredExceptionHandler - Cause: A few RegisterWaitForSingleObject handles unregistered" --min_interval 60
2⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Executes dropped EXE
PID:4732

C:\Program Files\AVG\Antivirus\x86\AvDump.exe
"C:\Program Files\AVG\Antivirus\x86\AvDump.exe"
1⤵
- Executes dropped EXE
PID:4284

C:\Program Files\AVG\Antivirus\x86\AvDump.exe
"C:\Program Files\AVG\Antivirus\x86\AvDump.exe"
1⤵
- Executes dropped EXE
PID:1924

C:\Program Files\AVG\Antivirus\x86\gaming_hook.exe
"C:\Program Files\AVG\Antivirus\x86\gaming_hook.exe"
1⤵
- Executes dropped EXE
PID:4244

C:\Program Files\AVG\Antivirus\x86\firefox_pass.exe
"C:\Program Files\AVG\Antivirus\x86\firefox_pass.exe"
1⤵
- Executes dropped EXE
PID:2112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:3540

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffb379f4f50,0x7ffb379f4f60,0x7ffb379f4f70
2⤵
PID:3592

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1536,5317034710982238265,14056700350383616513,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1668 /prefetch:8
2⤵
PID:4500

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1536,5317034710982238265,14056700350383616513,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
2⤵
PID:5108

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,5317034710982238265,14056700350383616513,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2344 /prefetch:1
2⤵
PID:4336

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,5317034710982238265,14056700350383616513,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2332 /prefetch:1
2⤵
PID:1632

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1536,5317034710982238265,14056700350383616513,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1552 /prefetch:2
2⤵
PID:1800

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,5317034710982238265,14056700350383616513,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
2⤵
PID:2356

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,5317034710982238265,14056700350383616513,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
2⤵
PID:5056

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1536,5317034710982238265,14056700350383616513,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4480 /prefetch:8
2⤵
PID:4632

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1536,5317034710982238265,14056700350383616513,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4660 /prefetch:8
2⤵
PID:4596

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1536,5317034710982238265,14056700350383616513,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4796 /prefetch:8
2⤵
PID:5060

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,5317034710982238265,14056700350383616513,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3748 /prefetch:1
2⤵
PID:5080

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1536,5317034710982238265,14056700350383616513,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4932 /prefetch:8
2⤵
PID:2236

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,5317034710982238265,14056700350383616513,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2372 /prefetch:1
2⤵
PID:2376

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,5317034710982238265,14056700350383616513,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
2⤵
PID:1048

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1536,5317034710982238265,14056700350383616513,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4916 /prefetch:8
2⤵
PID:1784

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,5317034710982238265,14056700350383616513,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3852 /prefetch:1
2⤵
PID:2036

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1536,5317034710982238265,14056700350383616513,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3496 /prefetch:8
2⤵
PID:4896

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1536,5317034710982238265,14056700350383616513,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3492 /prefetch:8
2⤵
PID:4776

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1536,5317034710982238265,14056700350383616513,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5988 /prefetch:8
2⤵
PID:4740

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1536,5317034710982238265,14056700350383616513,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3484 /prefetch:8
2⤵
PID:4808

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1536,5317034710982238265,14056700350383616513,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6016 /prefetch:8
2⤵
PID:640

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1536,5317034710982238265,14056700350383616513,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6092 /prefetch:8
2⤵
PID:2568

C:\Users\Admin\Downloads\DriverPack-17-Online_981825240.1642596551__kk5viujub8fogy8.exe
"C:\Users\Admin\Downloads\DriverPack-17-Online_981825240.1642596551__kk5viujub8fogy8.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:2360

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\DriverPack\start.bat" "DriverPack-17-Online_981825240.1642596551__kk5viujub8fogy8.exe""
3⤵
PID:2112

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Program Files (x86)\DriverPack\run.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5} --sfx "DriverPack-17-Online_981825240.1642596551__kk5viujub8fogy8.exe"
4⤵
- Blocklisted process makes network request
PID:5084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 2252
5⤵
- Drops file in Windows directory
- Program crash
PID:3548

C:\Users\Admin\AppData\Roaming\ghdecjh
C:\Users\Admin\AppData\Roaming\ghdecjh
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4184

C:\Windows\system32\compattelrunner.exe
C:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW
1⤵
PID:4792

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:1800

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffb379f4f50,0x7ffb379f4f60,0x7ffb379f4f70
2⤵
PID:4684

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1556,7079655917189523341,4361118042584491296,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1580 /prefetch:2
2⤵
PID:3592

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1556,7079655917189523341,4361118042584491296,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1928 /prefetch:8
2⤵
PID:4300

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1556,7079655917189523341,4361118042584491296,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
2⤵
PID:5116

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1556,7079655917189523341,4361118042584491296,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2444 /prefetch:1
2⤵
PID:1348

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1556,7079655917189523341,4361118042584491296,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2412 /prefetch:1
2⤵
PID:2228

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1556,7079655917189523341,4361118042584491296,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3584 /prefetch:1
2⤵
PID:4940

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1556,7079655917189523341,4361118042584491296,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
2⤵
PID:4892

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1556,7079655917189523341,4361118042584491296,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4536 /prefetch:8
2⤵
PID:360

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1556,7079655917189523341,4361118042584491296,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4672 /prefetch:8
2⤵
PID:5080

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1556,7079655917189523341,4361118042584491296,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4528 /prefetch:8
2⤵
PID:5044

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1556,7079655917189523341,4361118042584491296,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4756 /prefetch:8
2⤵
PID:4736

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1556,7079655917189523341,4361118042584491296,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
2⤵
PID:4288

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1556,7079655917189523341,4361118042584491296,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
2⤵
PID:160

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1556,7079655917189523341,4361118042584491296,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:1
2⤵
PID:4676

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1556,7079655917189523341,4361118042584491296,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4540 /prefetch:8
2⤵
PID:4360

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1556,7079655917189523341,4361118042584491296,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4856 /prefetch:8
2⤵
PID:404

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1556,7079655917189523341,4361118042584491296,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3804 /prefetch:8
2⤵
PID:3780

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1556,7079655917189523341,4361118042584491296,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5612 /prefetch:8
2⤵
PID:748

C:\Users\Admin\Downloads\amigo.setup.exe
"C:\Users\Admin\Downloads\amigo.setup.exe"
2⤵
- Executes dropped EXE
PID:1496

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1556,7079655917189523341,4361118042584491296,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5648 /prefetch:8
2⤵
PID:4104

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1556,7079655917189523341,4361118042584491296,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5052 /prefetch:8
2⤵
PID:2880

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1556,7079655917189523341,4361118042584491296,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4844 /prefetch:8
2⤵
PID:4180

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1556,7079655917189523341,4361118042584491296,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3132 /prefetch:8
2⤵
PID:1384

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1556,7079655917189523341,4361118042584491296,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3152 /prefetch:8
2⤵
PID:3692

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1556,7079655917189523341,4361118042584491296,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3272 /prefetch:8
2⤵
PID:3904

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\96.276.200\software_reporter_tool.exe
"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\96.276.200\software_reporter_tool.exe" --engine=2 --scan-locations=1,2,3,4,5,6,7,8,10 --disabled-locations=9,11 --session-id=wacj/SyziiwR6Vc+dtMzngVAwcmxbTQOgAy2Fo+1 --registry-suffix=ESET --enable-crash-reporting --srt-field-trial-group-name=Off
2⤵
- Executes dropped EXE
PID:4980

\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\96.276.200\software_reporter_tool.exe
"c:\users\admin\appdata\local\google\chrome\user data\swreporter\96.276.200\software_reporter_tool.exe" --crash-handler "--database=c:\users\admin\appdata\local\Google\Software Reporter Tool" --url=https://clients2.google.com/cr/report --annotation=plat=Win32 --annotation=prod=ChromeFoil --annotation=ver=96.276.200 --initial-client-data=0x25c,0x260,0x264,0x238,0x268,0x7ff7ba4ff510,0x7ff7ba4ff520,0x7ff7ba4ff530
3⤵
- Executes dropped EXE
PID:4688

\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\96.276.200\software_reporter_tool.exe
"c:\users\admin\appdata\local\google\chrome\user data\swreporter\96.276.200\software_reporter_tool.exe" --enable-crash-reporting --use-crash-handler-with-id="\\.\pipe\crashpad_4980_AIHWDAVLSQMAIRWN" --sandboxed-process-id=2 --init-done-notifier=728 --sandbox-mojo-pipe-token=3578449925237654263 --mojo-platform-channel-handle=704 --engine=2
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4944

\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\96.276.200\software_reporter_tool.exe
"c:\users\admin\appdata\local\google\chrome\user data\swreporter\96.276.200\software_reporter_tool.exe" --enable-crash-reporting --use-crash-handler-with-id="\\.\pipe\crashpad_4980_AIHWDAVLSQMAIRWN" --sandboxed-process-id=3 --init-done-notifier=912 --sandbox-mojo-pipe-token=17052972377939257035 --mojo-platform-channel-handle=916
3⤵
- Executes dropped EXE
PID:4196

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1556,7079655917189523341,4361118042584491296,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1396 /prefetch:8
2⤵
PID:352

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1556,7079655917189523341,4361118042584491296,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2196 /prefetch:8
2⤵
PID:4092

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1556,7079655917189523341,4361118042584491296,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2200 /prefetch:8
2⤵
PID:4596

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1556,7079655917189523341,4361118042584491296,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5724 /prefetch:8
2⤵
PID:2492

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1556,7079655917189523341,4361118042584491296,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2196 /prefetch:2
2⤵
PID:328

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1556,7079655917189523341,4361118042584491296,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3092 /prefetch:1
2⤵
PID:4988

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Registry Run Keys / Startup Folder

T1060

Bootkit

T1067

Privilege Escalation

Defense Evasion

Modify Registry

Virtualization/Sandbox Evasion

T1497

Disabling Security Tools

T1089

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

Virtualization/Sandbox Evasion

T1497

System Information Discovery