Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
830s -
max time network
1776s -
platform
windows10_x64 -
resource
win10-20220223-en -
submitted
12/03/2022, 05:48
Static task
static1
URLScan task
urlscan1
General
Malware Config
Signatures
-
PlugX Rat Payload 4 IoCs
resource yara_rule behavioral1/files/0x000600000001a16a-506.dat PlugX behavioral1/files/0x000600000001a16a-509.dat PlugX behavioral1/files/0x000600000001a16a-520.dat PlugX behavioral1/files/0x000600000001a177-690.dat PlugX -
Executes dropped EXE 4 IoCs
pid Process 1168 software_reporter_tool.exe 1868 software_reporter_tool.exe 2536 software_reporter_tool.exe 1900 software_reporter_tool.exe -
Loads dropped DLL 7 IoCs
pid Process 2536 software_reporter_tool.exe 2536 software_reporter_tool.exe 2536 software_reporter_tool.exe 2536 software_reporter_tool.exe 2536 software_reporter_tool.exe 2536 software_reporter_tool.exe 2536 software_reporter_tool.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
pid pid_target Process procid_target 1828 2536 WerFault.exe 94 -
Checks processor information in registry 2 TTPs 27 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE -
Enumerates system info in registry 2 TTPs 30 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings chrome.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 3976 EXCEL.EXE 3412 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 40 IoCs
pid Process 3996 chrome.exe 3996 chrome.exe 1576 chrome.exe 1576 chrome.exe 780 chrome.exe 780 chrome.exe 2284 chrome.exe 2284 chrome.exe 224 chrome.exe 224 chrome.exe 2192 chrome.exe 2192 chrome.exe 3912 chrome.exe 3912 chrome.exe 2760 chrome.exe 2760 chrome.exe 1680 chrome.exe 1680 chrome.exe 604 chrome.exe 604 chrome.exe 604 chrome.exe 604 chrome.exe 1956 chrome.exe 1956 chrome.exe 612 EXCEL.EXE 612 EXCEL.EXE 1168 software_reporter_tool.exe 1168 software_reporter_tool.exe 4036 EXCEL.EXE 4036 EXCEL.EXE 3748 EXCEL.EXE 3748 EXCEL.EXE 1096 EXCEL.EXE 1096 EXCEL.EXE 3336 EXCEL.EXE 3336 EXCEL.EXE 1156 EXCEL.EXE 1156 EXCEL.EXE 3632 EXCEL.EXE 3632 EXCEL.EXE -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs
pid Process 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: 33 1868 software_reporter_tool.exe Token: SeIncBasePriorityPrivilege 1868 software_reporter_tool.exe Token: 33 1168 software_reporter_tool.exe Token: SeIncBasePriorityPrivilege 1168 software_reporter_tool.exe Token: 33 2536 software_reporter_tool.exe Token: SeIncBasePriorityPrivilege 2536 software_reporter_tool.exe Token: 33 1900 software_reporter_tool.exe Token: SeIncBasePriorityPrivilege 1900 software_reporter_tool.exe -
Suspicious use of FindShellTrayWindow 36 IoCs
pid Process 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 3412 EXCEL.EXE 3412 EXCEL.EXE -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe 1576 chrome.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3976 EXCEL.EXE 3976 EXCEL.EXE 3976 EXCEL.EXE 3976 EXCEL.EXE 3976 EXCEL.EXE 3976 EXCEL.EXE 3976 EXCEL.EXE 3976 EXCEL.EXE 3976 EXCEL.EXE 3976 EXCEL.EXE 3976 EXCEL.EXE 3976 EXCEL.EXE 3976 EXCEL.EXE 3976 EXCEL.EXE 3976 EXCEL.EXE 3976 EXCEL.EXE 3412 EXCEL.EXE 3412 EXCEL.EXE 3412 EXCEL.EXE 3412 EXCEL.EXE 3412 EXCEL.EXE 3412 EXCEL.EXE 3412 EXCEL.EXE 3412 EXCEL.EXE 3412 EXCEL.EXE 3412 EXCEL.EXE 3412 EXCEL.EXE 3412 EXCEL.EXE 3412 EXCEL.EXE 3412 EXCEL.EXE 3412 EXCEL.EXE 3412 EXCEL.EXE 3412 EXCEL.EXE 3412 EXCEL.EXE 3412 EXCEL.EXE 3412 EXCEL.EXE 3412 EXCEL.EXE 3412 EXCEL.EXE 3412 EXCEL.EXE 3412 EXCEL.EXE 3412 EXCEL.EXE 612 EXCEL.EXE 3412 EXCEL.EXE 3412 EXCEL.EXE 3412 EXCEL.EXE 3412 EXCEL.EXE 3412 EXCEL.EXE 3412 EXCEL.EXE 3412 EXCEL.EXE 3412 EXCEL.EXE 3412 EXCEL.EXE 3412 EXCEL.EXE 3412 EXCEL.EXE 3412 EXCEL.EXE 3412 EXCEL.EXE 3412 EXCEL.EXE 3412 EXCEL.EXE 3412 EXCEL.EXE 3412 EXCEL.EXE 3412 EXCEL.EXE 3412 EXCEL.EXE 3412 EXCEL.EXE 3412 EXCEL.EXE 3412 EXCEL.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1576 wrote to memory of 2512 1576 chrome.exe 42 PID 1576 wrote to memory of 2512 1576 chrome.exe 42 PID 1576 wrote to memory of 1564 1576 chrome.exe 43 PID 1576 wrote to memory of 1564 1576 chrome.exe 43 PID 1576 wrote to memory of 1564 1576 chrome.exe 43 PID 1576 wrote to memory of 1564 1576 chrome.exe 43 PID 1576 wrote to memory of 1564 1576 chrome.exe 43 PID 1576 wrote to memory of 1564 1576 chrome.exe 43 PID 1576 wrote to memory of 1564 1576 chrome.exe 43 PID 1576 wrote to memory of 1564 1576 chrome.exe 43 PID 1576 wrote to memory of 1564 1576 chrome.exe 43 PID 1576 wrote to memory of 1564 1576 chrome.exe 43 PID 1576 wrote to memory of 1564 1576 chrome.exe 43 PID 1576 wrote to memory of 1564 1576 chrome.exe 43 PID 1576 wrote to memory of 1564 1576 chrome.exe 43 PID 1576 wrote to memory of 1564 1576 chrome.exe 43 PID 1576 wrote to memory of 1564 1576 chrome.exe 43 PID 1576 wrote to memory of 1564 1576 chrome.exe 43 PID 1576 wrote to memory of 1564 1576 chrome.exe 43 PID 1576 wrote to memory of 1564 1576 chrome.exe 43 PID 1576 wrote to memory of 1564 1576 chrome.exe 43 PID 1576 wrote to memory of 1564 1576 chrome.exe 43 PID 1576 wrote to memory of 1564 1576 chrome.exe 43 PID 1576 wrote to memory of 1564 1576 chrome.exe 43 PID 1576 wrote to memory of 1564 1576 chrome.exe 43 PID 1576 wrote to memory of 1564 1576 chrome.exe 43 PID 1576 wrote to memory of 1564 1576 chrome.exe 43 PID 1576 wrote to memory of 1564 1576 chrome.exe 43 PID 1576 wrote to memory of 1564 1576 chrome.exe 43 PID 1576 wrote to memory of 1564 1576 chrome.exe 43 PID 1576 wrote to memory of 1564 1576 chrome.exe 43 PID 1576 wrote to memory of 1564 1576 chrome.exe 43 PID 1576 wrote to memory of 1564 1576 chrome.exe 43 PID 1576 wrote to memory of 1564 1576 chrome.exe 43 PID 1576 wrote to memory of 1564 1576 chrome.exe 43 PID 1576 wrote to memory of 1564 1576 chrome.exe 43 PID 1576 wrote to memory of 1564 1576 chrome.exe 43 PID 1576 wrote to memory of 1564 1576 chrome.exe 43 PID 1576 wrote to memory of 1564 1576 chrome.exe 43 PID 1576 wrote to memory of 1564 1576 chrome.exe 43 PID 1576 wrote to memory of 1564 1576 chrome.exe 43 PID 1576 wrote to memory of 1564 1576 chrome.exe 43 PID 1576 wrote to memory of 3996 1576 chrome.exe 44 PID 1576 wrote to memory of 3996 1576 chrome.exe 44 PID 1576 wrote to memory of 3804 1576 chrome.exe 45 PID 1576 wrote to memory of 3804 1576 chrome.exe 45 PID 1576 wrote to memory of 3804 1576 chrome.exe 45 PID 1576 wrote to memory of 3804 1576 chrome.exe 45 PID 1576 wrote to memory of 3804 1576 chrome.exe 45 PID 1576 wrote to memory of 3804 1576 chrome.exe 45 PID 1576 wrote to memory of 3804 1576 chrome.exe 45 PID 1576 wrote to memory of 3804 1576 chrome.exe 45 PID 1576 wrote to memory of 3804 1576 chrome.exe 45 PID 1576 wrote to memory of 3804 1576 chrome.exe 45 PID 1576 wrote to memory of 3804 1576 chrome.exe 45 PID 1576 wrote to memory of 3804 1576 chrome.exe 45 PID 1576 wrote to memory of 3804 1576 chrome.exe 45 PID 1576 wrote to memory of 3804 1576 chrome.exe 45 PID 1576 wrote to memory of 3804 1576 chrome.exe 45 PID 1576 wrote to memory of 3804 1576 chrome.exe 45 PID 1576 wrote to memory of 3804 1576 chrome.exe 45 PID 1576 wrote to memory of 3804 1576 chrome.exe 45 PID 1576 wrote to memory of 3804 1576 chrome.exe 45 PID 1576 wrote to memory of 3804 1576 chrome.exe 45
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://share.riseup.net/#eRUpzFmrLsUdVwjwnPu4QQ1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffe6aef4f50,0x7ffe6aef4f60,0x7ffe6aef4f702⤵PID:2512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1664 /prefetch:22⤵PID:1564
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1720 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3996
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2184 /prefetch:82⤵PID:3804
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2936 /prefetch:12⤵PID:4064
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2956 /prefetch:12⤵PID:4028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4716 /prefetch:82⤵PID:528
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4716 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:780
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4268 /prefetch:82⤵PID:1680
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4264 /prefetch:82⤵PID:1976
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4236 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2284
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4104 /prefetch:82⤵PID:2808
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4156 /prefetch:82⤵PID:2292
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4232 /prefetch:82⤵PID:3672
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4360 /prefetch:82⤵PID:3764
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5140 /prefetch:82⤵PID:932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5380 /prefetch:82⤵PID:2688
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:12⤵PID:3456
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:12⤵PID:3496
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4328 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:224
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5368 /prefetch:82⤵PID:1456
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1988 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2192
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5520 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3912
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4248 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2760
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3404 /prefetch:82⤵PID:2528
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4428 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1680
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2016 /prefetch:82⤵PID:3120
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4328 /prefetch:82⤵PID:3980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5264 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:604
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3356 /prefetch:82⤵PID:3740
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4236 /prefetch:82⤵PID:3472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4236 /prefetch:12⤵PID:524
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:12⤵PID:416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5772 /prefetch:82⤵PID:2572
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2532 /prefetch:82⤵PID:3844
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5616 /prefetch:82⤵PID:2364
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3620 /prefetch:12⤵PID:228
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:12⤵PID:3788
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5084 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1956
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1616 /prefetch:12⤵PID:340
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4700 /prefetch:82⤵PID:4056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5264 /prefetch:82⤵PID:1924
-
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\97.278.200\software_reporter_tool.exe"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\97.278.200\software_reporter_tool.exe" --engine=2 --scan-locations=1,2,3,4,5,6,7,8,10 --disabled-locations=9,11 --session-id=eCTcqcdel+voulqrUXzYUeXIg1ivF6J0KgbGVLgQ --registry-suffix=ESET --enable-crash-reporting --srt-field-trial-group-name=NewCleanerUIExperiment2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1168 -
\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\97.278.200\software_reporter_tool.exe"c:\users\admin\appdata\local\google\chrome\user data\swreporter\97.278.200\software_reporter_tool.exe" --crash-handler "--database=c:\users\admin\appdata\local\Google\Software Reporter Tool" --url=https://clients2.google.com/cr/report --annotation=plat=Win32 --annotation=prod=ChromeFoil --annotation=ver=97.278.200 --initial-client-data=0x250,0x254,0x258,0x238,0x25c,0x7ff6e0ff69d8,0x7ff6e0ff69e8,0x7ff6e0ff69f83⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1868
-
-
\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\97.278.200\software_reporter_tool.exe"c:\users\admin\appdata\local\google\chrome\user data\swreporter\97.278.200\software_reporter_tool.exe" --enable-crash-reporting --use-crash-handler-with-id="\\.\pipe\crashpad_1168_YRLLIYQMXGTPMZAC" --sandboxed-process-id=2 --init-done-notifier=720 --sandbox-mojo-pipe-token=8264403413588796795 --mojo-platform-channel-handle=696 --engine=23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2536 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2536 -s 6924⤵
- Program crash
PID:1828
-
-
-
\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\97.278.200\software_reporter_tool.exe"c:\users\admin\appdata\local\google\chrome\user data\swreporter\97.278.200\software_reporter_tool.exe" --enable-crash-reporting --use-crash-handler-with-id="\\.\pipe\crashpad_1168_YRLLIYQMXGTPMZAC" --sandboxed-process-id=3 --init-done-notifier=924 --sandbox-mojo-pipe-token=268720662790365392 --mojo-platform-channel-handle=9203⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1900
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5764 /prefetch:82⤵PID:1652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:12⤵PID:896
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4236 /prefetch:82⤵PID:3308
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5380 /prefetch:82⤵PID:1168
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3000 /prefetch:82⤵PID:1032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:2856
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4640 /prefetch:12⤵PID:3988
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1648,5232258240727614317,10726333811904142402,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3620 /prefetch:12⤵PID:2156
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:684
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Downloads\FederationScienceDump\dump\joom_new\josn_content.csv"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3976
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Downloads\FederationScienceDump\dump\joom_new\josn_users.csv"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3412
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Downloads\FederationScienceDump\dump\Ufih060515\if9pk_ucm_history.csv"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:612
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Downloads\FederationScienceDump\dump\Ufih060515\if9pk_messages.csv"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:4036
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Downloads\FederationScienceDump\dump\Ufih060515\if9pk_users.csv"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:3748
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Downloads\FederationScienceDump\dump\Ufih060515\if9pk_user_usergroup_map.csv"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:1096
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Downloads\FederationScienceDump\dump\mirari\first_forums.csv"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:3336
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Downloads\FederationScienceDump\dump\mirari\first_search_words.csv"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:1156
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Downloads\FederationScienceDump\dump\mirari\first_users.csv"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:3632