Analysis
-
max time kernel
1527357s -
max time network
1528336s -
platform
windows7_x64 -
resource
win7-20220310-en -
submitted
25-03-2022 21:28
Static task
static1
Behavioral task
behavioral1
Sample
2_AutoClicker.exe
Resource
win7-20220310-en
General
-
Target
2_AutoClicker.exe
-
Size
243KB
-
MD5
edbff0a5ec26bf14a10dc04670c2aa95
-
SHA1
3de37335be986d68ba4cdd0fc6ab1b78ca45e2b6
-
SHA256
43bab7ce6548eb084a181523a876f50dd378d3dcbb18327b75b5dd2c4fe8597b
-
SHA512
8f3982aede528ab99710efbbe0ccfe6406a8eb3d1cc12ae295755032a0db193a03ca73e4b72ad3b024ae0b85430483c62c7d6e9c4355978b2113c54243cf7bd3
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\1584_2040854243\english_wikipedia.txt
prometheus
https
http
Signatures
-
Prometheus Ransomware
Ransomware family mostly targeting manufacturing industry and claims to be affiliated with REvil.
-
Downloads MZ/PE file
-
Executes dropped EXE 20 IoCs
pid Process 2012 HotspotShield-11.0.1-plain-773-plain.exe 2700 HotspotShield-11.0.1-plain-773-plain.exe 2736 HSS-11.0.1-install-plain-773-plain.exe 2156 HotspotShield-11.0.1-plain-773-plain.exe 524 HotspotShield-11.0.1-plain-773-plain.exe 2452 HSS-11.0.1-install-plain-773-plain.exe 2324 software_reporter_tool.exe 2548 software_reporter_tool.exe 2320 software_reporter_tool.exe 1780 software_reporter_tool.exe 2840 ndp48-devpack-enu.exe 2136 ndp48-devpack-enu.exe 2748 NDP48-DevPack-ENU.exe 2864 ndp48-x86-x64-allos-enu.exe 2084 Setup.exe 2560 SetupUtility.exe 2812 HotspotShield-11.0.1-plain-773-plain.exe 2220 HotspotShield-11.0.1-plain-773-plain.exe 2888 HSS-11.0.1-install-plain-773-plain.exe 2896 ProtonVPN_win_v1.26.0.exe -
Loads dropped DLL 57 IoCs
pid Process 2500 SpeedifyInstaller.exe 2500 SpeedifyInstaller.exe 2500 SpeedifyInstaller.exe 2500 SpeedifyInstaller.exe 2608 SpeedifyInstaller.exe 2608 SpeedifyInstaller.exe 2160 SpeedifyInstaller.exe 2160 SpeedifyInstaller.exe 1508 SpeedifyInstaller.exe 1508 SpeedifyInstaller.exe 1508 SpeedifyInstaller.exe 1508 SpeedifyInstaller.exe 1508 SpeedifyInstaller.exe 1508 SpeedifyInstaller.exe 1508 SpeedifyInstaller.exe 1508 SpeedifyInstaller.exe 1508 SpeedifyInstaller.exe 1996 SpeedifyInstaller.exe 1996 SpeedifyInstaller.exe 2012 HotspotShield-11.0.1-plain-773-plain.exe 2700 HotspotShield-11.0.1-plain-773-plain.exe 2700 HotspotShield-11.0.1-plain-773-plain.exe 2700 HotspotShield-11.0.1-plain-773-plain.exe 2156 HotspotShield-11.0.1-plain-773-plain.exe 524 HotspotShield-11.0.1-plain-773-plain.exe 524 HotspotShield-11.0.1-plain-773-plain.exe 524 HotspotShield-11.0.1-plain-773-plain.exe 1584 chrome.exe 2320 software_reporter_tool.exe 2320 software_reporter_tool.exe 2320 software_reporter_tool.exe 2320 software_reporter_tool.exe 2320 software_reporter_tool.exe 2320 software_reporter_tool.exe 2320 software_reporter_tool.exe 2840 ndp48-devpack-enu.exe 2136 ndp48-devpack-enu.exe 2136 ndp48-devpack-enu.exe 2864 ndp48-x86-x64-allos-enu.exe 2084 Setup.exe 2084 Setup.exe 2084 Setup.exe 2084 Setup.exe 2084 Setup.exe 2812 HotspotShield-11.0.1-plain-773-plain.exe 2220 HotspotShield-11.0.1-plain-773-plain.exe 2220 HotspotShield-11.0.1-plain-773-plain.exe 2220 HotspotShield-11.0.1-plain-773-plain.exe 2576 SpeedifyInstaller.exe 2576 SpeedifyInstaller.exe 1628 SpeedifyInstaller.exe 1628 SpeedifyInstaller.exe 2896 ProtonVPN_win_v1.26.0.exe 2896 ProtonVPN_win_v1.26.0.exe 2308 MsiExec.exe 2308 MsiExec.exe 2188 MsiExec.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{f0b6a0a1-8842-49c4-9da0-269df240047a} = "\"C:\\ProgramData\\Package Cache\\{f0b6a0a1-8842-49c4-9da0-269df240047a}\\HSS-11.0.1-install-plain-773-plain.exe\" /burn.runonce" HSS-11.0.1-install-plain-773-plain.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce HSS-11.0.1-install-plain-773-plain.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{f0b6a0a1-8842-49c4-9da0-269df240047a} = "\"C:\\ProgramData\\Package Cache\\{f0b6a0a1-8842-49c4-9da0-269df240047a}\\HSS-11.0.1-install-plain-773-plain.exe\" /burn.runonce" HSS-11.0.1-install-plain-773-plain.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce HSS-11.0.1-install-plain-773-plain.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{f0b6a0a1-8842-49c4-9da0-269df240047a} = "\"C:\\ProgramData\\Package Cache\\{f0b6a0a1-8842-49c4-9da0-269df240047a}\\HSS-11.0.1-install-plain-773-plain.exe\" /burn.runonce" HSS-11.0.1-install-plain-773-plain.exe Key created \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Windows\CurrentVersion\Run SpeedifyInstaller.exe Set value (str) \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Windows\CurrentVersion\Run\Speedify-Installer = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Speedify\\SpeedifyInstaller.exe\" /SOURCE= /CAMPAIGN=" SpeedifyInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce HSS-11.0.1-install-plain-773-plain.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ndp48-devpack-enu.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: ProtonVPN_win_v1.26.0.exe File opened (read-only) \??\S: ProtonVPN_win_v1.26.0.exe File opened (read-only) \??\W: ProtonVPN_win_v1.26.0.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\L: ProtonVPN_win_v1.26.0.exe File opened (read-only) \??\R: ProtonVPN_win_v1.26.0.exe File opened (read-only) \??\V: ProtonVPN_win_v1.26.0.exe File opened (read-only) \??\N: ProtonVPN_win_v1.26.0.exe File opened (read-only) \??\Q: ProtonVPN_win_v1.26.0.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\B: ProtonVPN_win_v1.26.0.exe File opened (read-only) \??\G: ProtonVPN_win_v1.26.0.exe File opened (read-only) \??\K: ProtonVPN_win_v1.26.0.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: ProtonVPN_win_v1.26.0.exe File opened (read-only) \??\J: ProtonVPN_win_v1.26.0.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: ProtonVPN_win_v1.26.0.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\P: ProtonVPN_win_v1.26.0.exe File opened (read-only) \??\U: ProtonVPN_win_v1.26.0.exe File opened (read-only) \??\X: ProtonVPN_win_v1.26.0.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: ProtonVPN_win_v1.26.0.exe File opened (read-only) \??\E: ProtonVPN_win_v1.26.0.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Z: ProtonVPN_win_v1.26.0.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\H: ProtonVPN_win_v1.26.0.exe File opened (read-only) \??\O: ProtonVPN_win_v1.26.0.exe File opened (read-only) \??\T: ProtonVPN_win_v1.26.0.exe File opened (read-only) \??\F: ProtonVPN_win_v1.26.0.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe -
Drops file in Windows directory 14 IoCs
description ioc Process File created C:\Windows\wusa.lock wusa.exe File opened for modification C:\Windows\Logs\DPX\setupact.log wusa.exe File opened for modification C:\Windows\WindowsUpdate.log NDP48-DevPack-ENU.exe File opened for modification C:\Windows\WindowsUpdate.log HSS-11.0.1-install-plain-773-plain.exe File opened for modification C:\Windows\WindowsUpdate.log ndp48-devpack-enu.exe File opened for modification C:\Windows\WindowsUpdate.log Setup.exe File opened for modification C:\Windows\Logs\DPX\setuperr.log wusa.exe File opened for modification C:\Windows\WindowsUpdate.log wusa.exe File opened for modification C:\Windows\WindowsUpdate.log HSS-11.0.1-install-plain-773-plain.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\WindowsUpdate.log HSS-11.0.1-install-plain-773-plain.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\WindowsUpdate.log SetupUtility.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Setup.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 43 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe -
Modifies registry class 27 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{f0b6a0a1-8842-49c4-9da0-269df240047a}\Dependents HSS-11.0.1-install-plain-773-plain.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{f0b6a0a1-8842-49c4-9da0-269df240047a} HSS-11.0.1-install-plain-773-plain.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{f0b6a0a1-8842-49c4-9da0-269df240047a}\ = "{f0b6a0a1-8842-49c4-9da0-269df240047a}" HSS-11.0.1-install-plain-773-plain.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{f0b6a0a1-8842-49c4-9da0-269df240047a} HSS-11.0.1-install-plain-773-plain.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{f0b6a0a1-8842-49c4-9da0-269df240047a}\Version = "11.0.1.12066" HSS-11.0.1-install-plain-773-plain.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{f0b6a0a1-8842-49c4-9da0-269df240047a}\Dependents HSS-11.0.1-install-plain-773-plain.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{f0b6a0a1-8842-49c4-9da0-269df240047a}\ = "{f0b6a0a1-8842-49c4-9da0-269df240047a}" HSS-11.0.1-install-plain-773-plain.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{f0b6a0a1-8842-49c4-9da0-269df240047a}\Version = "11.0.1.12066" HSS-11.0.1-install-plain-773-plain.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{f0b6a0a1-8842-49c4-9da0-269df240047a}\DisplayName = "Hotspot Shield 11.0.1" HSS-11.0.1-install-plain-773-plain.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{f0b6a0a1-8842-49c4-9da0-269df240047a}\Dependents\{f0b6a0a1-8842-49c4-9da0-269df240047a} HSS-11.0.1-install-plain-773-plain.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{f0b6a0a1-8842-49c4-9da0-269df240047a}\Dependents HSS-11.0.1-install-plain-773-plain.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{f0b6a0a1-8842-49c4-9da0-269df240047a}\Dependents\{f0b6a0a1-8842-49c4-9da0-269df240047a} HSS-11.0.1-install-plain-773-plain.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{f0b6a0a1-8842-49c4-9da0-269df240047a}\Dependents\{f0b6a0a1-8842-49c4-9da0-269df240047a} HSS-11.0.1-install-plain-773-plain.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{f0b6a0a1-8842-49c4-9da0-269df240047a}\Version = "11.0.1.12066" HSS-11.0.1-install-plain-773-plain.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{f0b6a0a1-8842-49c4-9da0-269df240047a}\Dependents\{f0b6a0a1-8842-49c4-9da0-269df240047a} HSS-11.0.1-install-plain-773-plain.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{f0b6a0a1-8842-49c4-9da0-269df240047a} HSS-11.0.1-install-plain-773-plain.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{f0b6a0a1-8842-49c4-9da0-269df240047a}\Dependents HSS-11.0.1-install-plain-773-plain.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{f0b6a0a1-8842-49c4-9da0-269df240047a}\Dependents HSS-11.0.1-install-plain-773-plain.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{f0b6a0a1-8842-49c4-9da0-269df240047a}\ = "{f0b6a0a1-8842-49c4-9da0-269df240047a}" HSS-11.0.1-install-plain-773-plain.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{f0b6a0a1-8842-49c4-9da0-269df240047a}\DisplayName = "Hotspot Shield 11.0.1" HSS-11.0.1-install-plain-773-plain.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{f0b6a0a1-8842-49c4-9da0-269df240047a} HSS-11.0.1-install-plain-773-plain.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{f0b6a0a1-8842-49c4-9da0-269df240047a}\Dependents\{f0b6a0a1-8842-49c4-9da0-269df240047a} HSS-11.0.1-install-plain-773-plain.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{f0b6a0a1-8842-49c4-9da0-269df240047a} HSS-11.0.1-install-plain-773-plain.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{f0b6a0a1-8842-49c4-9da0-269df240047a}\DisplayName = "Hotspot Shield 11.0.1" HSS-11.0.1-install-plain-773-plain.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{f0b6a0a1-8842-49c4-9da0-269df240047a} HSS-11.0.1-install-plain-773-plain.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{f0b6a0a1-8842-49c4-9da0-269df240047a}\Dependents\{f0b6a0a1-8842-49c4-9da0-269df240047a} HSS-11.0.1-install-plain-773-plain.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{f0b6a0a1-8842-49c4-9da0-269df240047a}\Dependents HSS-11.0.1-install-plain-773-plain.exe -
Opens file in notepad (likely ransom note) 2 IoCs
pid Process 2892 notepad.exe 2376 notepad.exe -
Suspicious behavior: EnumeratesProcesses 27 IoCs
pid Process 1784 chrome.exe 1584 chrome.exe 1584 chrome.exe 2292 chrome.exe 2972 chrome.exe 2428 chrome.exe 1968 chrome.exe 1584 chrome.exe 1584 chrome.exe 1100 chrome.exe 2432 chrome.exe 1192 chrome.exe 2324 software_reporter_tool.exe 2324 software_reporter_tool.exe 2972 chrome.exe 2856 chrome.exe 3060 chrome.exe 2084 Setup.exe 2084 Setup.exe 2084 Setup.exe 2084 Setup.exe 2084 Setup.exe 2084 Setup.exe 2084 Setup.exe 2084 Setup.exe 2200 chrome.exe 2308 MsiExec.exe -
Suspicious behavior: GetForegroundWindowSpam 4 IoCs
pid Process 2608 SpeedifyInstaller.exe 2084 Setup.exe 1584 chrome.exe 2896 ProtonVPN_win_v1.26.0.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: 33 2336 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2336 AUDIODG.EXE Token: 33 2336 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2336 AUDIODG.EXE Token: 33 2548 software_reporter_tool.exe Token: SeIncBasePriorityPrivilege 2548 software_reporter_tool.exe Token: 33 2324 software_reporter_tool.exe Token: SeIncBasePriorityPrivilege 2324 software_reporter_tool.exe Token: 33 2320 software_reporter_tool.exe Token: SeIncBasePriorityPrivilege 2320 software_reporter_tool.exe Token: 33 1780 software_reporter_tool.exe Token: SeIncBasePriorityPrivilege 1780 software_reporter_tool.exe Token: SeBackupPrivilege 1448 vssvc.exe Token: SeRestorePrivilege 1448 vssvc.exe Token: SeAuditPrivilege 1448 vssvc.exe Token: SeRestorePrivilege 2640 DrvInst.exe Token: SeRestorePrivilege 2640 DrvInst.exe Token: SeRestorePrivilege 2640 DrvInst.exe Token: SeRestorePrivilege 2640 DrvInst.exe Token: SeRestorePrivilege 2640 DrvInst.exe Token: SeRestorePrivilege 2640 DrvInst.exe Token: SeRestorePrivilege 2640 DrvInst.exe Token: SeLoadDriverPrivilege 2640 DrvInst.exe Token: SeLoadDriverPrivilege 2640 DrvInst.exe Token: SeLoadDriverPrivilege 2640 DrvInst.exe Token: SeDebugPrivilege 2084 Setup.exe Token: SeRestorePrivilege 896 msiexec.exe Token: SeTakeOwnershipPrivilege 896 msiexec.exe Token: SeSecurityPrivilege 896 msiexec.exe Token: SeCreateTokenPrivilege 2896 ProtonVPN_win_v1.26.0.exe Token: SeAssignPrimaryTokenPrivilege 2896 ProtonVPN_win_v1.26.0.exe Token: SeLockMemoryPrivilege 2896 ProtonVPN_win_v1.26.0.exe Token: SeIncreaseQuotaPrivilege 2896 ProtonVPN_win_v1.26.0.exe Token: SeMachineAccountPrivilege 2896 ProtonVPN_win_v1.26.0.exe Token: SeTcbPrivilege 2896 ProtonVPN_win_v1.26.0.exe Token: SeSecurityPrivilege 2896 ProtonVPN_win_v1.26.0.exe Token: SeTakeOwnershipPrivilege 2896 ProtonVPN_win_v1.26.0.exe Token: SeLoadDriverPrivilege 2896 ProtonVPN_win_v1.26.0.exe Token: SeSystemProfilePrivilege 2896 ProtonVPN_win_v1.26.0.exe Token: SeSystemtimePrivilege 2896 ProtonVPN_win_v1.26.0.exe Token: SeProfSingleProcessPrivilege 2896 ProtonVPN_win_v1.26.0.exe Token: SeIncBasePriorityPrivilege 2896 ProtonVPN_win_v1.26.0.exe Token: SeCreatePagefilePrivilege 2896 ProtonVPN_win_v1.26.0.exe Token: SeCreatePermanentPrivilege 2896 ProtonVPN_win_v1.26.0.exe Token: SeBackupPrivilege 2896 ProtonVPN_win_v1.26.0.exe Token: SeRestorePrivilege 2896 ProtonVPN_win_v1.26.0.exe Token: SeShutdownPrivilege 2896 ProtonVPN_win_v1.26.0.exe Token: SeDebugPrivilege 2896 ProtonVPN_win_v1.26.0.exe Token: SeAuditPrivilege 2896 ProtonVPN_win_v1.26.0.exe Token: SeSystemEnvironmentPrivilege 2896 ProtonVPN_win_v1.26.0.exe Token: SeChangeNotifyPrivilege 2896 ProtonVPN_win_v1.26.0.exe Token: SeRemoteShutdownPrivilege 2896 ProtonVPN_win_v1.26.0.exe Token: SeUndockPrivilege 2896 ProtonVPN_win_v1.26.0.exe Token: SeSyncAgentPrivilege 2896 ProtonVPN_win_v1.26.0.exe Token: SeEnableDelegationPrivilege 2896 ProtonVPN_win_v1.26.0.exe Token: SeManageVolumePrivilege 2896 ProtonVPN_win_v1.26.0.exe Token: SeImpersonatePrivilege 2896 ProtonVPN_win_v1.26.0.exe Token: SeCreateGlobalPrivilege 2896 ProtonVPN_win_v1.26.0.exe Token: SeCreateTokenPrivilege 2896 ProtonVPN_win_v1.26.0.exe Token: SeAssignPrimaryTokenPrivilege 2896 ProtonVPN_win_v1.26.0.exe Token: SeLockMemoryPrivilege 2896 ProtonVPN_win_v1.26.0.exe Token: SeIncreaseQuotaPrivilege 2896 ProtonVPN_win_v1.26.0.exe Token: SeMachineAccountPrivilege 2896 ProtonVPN_win_v1.26.0.exe Token: SeTcbPrivilege 2896 ProtonVPN_win_v1.26.0.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1688 2_AutoClicker.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1688 2_AutoClicker.exe 1688 2_AutoClicker.exe 1688 2_AutoClicker.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1584 wrote to memory of 1644 1584 chrome.exe 30 PID 1584 wrote to memory of 1644 1584 chrome.exe 30 PID 1584 wrote to memory of 1644 1584 chrome.exe 30 PID 1584 wrote to memory of 112 1584 chrome.exe 31 PID 1584 wrote to memory of 112 1584 chrome.exe 31 PID 1584 wrote to memory of 112 1584 chrome.exe 31 PID 1584 wrote to memory of 112 1584 chrome.exe 31 PID 1584 wrote to memory of 112 1584 chrome.exe 31 PID 1584 wrote to memory of 112 1584 chrome.exe 31 PID 1584 wrote to memory of 112 1584 chrome.exe 31 PID 1584 wrote to memory of 112 1584 chrome.exe 31 PID 1584 wrote to memory of 112 1584 chrome.exe 31 PID 1584 wrote to memory of 112 1584 chrome.exe 31 PID 1584 wrote to memory of 112 1584 chrome.exe 31 PID 1584 wrote to memory of 112 1584 chrome.exe 31 PID 1584 wrote to memory of 112 1584 chrome.exe 31 PID 1584 wrote to memory of 112 1584 chrome.exe 31 PID 1584 wrote to memory of 112 1584 chrome.exe 31 PID 1584 wrote to memory of 112 1584 chrome.exe 31 PID 1584 wrote to memory of 112 1584 chrome.exe 31 PID 1584 wrote to memory of 112 1584 chrome.exe 31 PID 1584 wrote to memory of 112 1584 chrome.exe 31 PID 1584 wrote to memory of 112 1584 chrome.exe 31 PID 1584 wrote to memory of 112 1584 chrome.exe 31 PID 1584 wrote to memory of 112 1584 chrome.exe 31 PID 1584 wrote to memory of 112 1584 chrome.exe 31 PID 1584 wrote to memory of 112 1584 chrome.exe 31 PID 1584 wrote to memory of 112 1584 chrome.exe 31 PID 1584 wrote to memory of 112 1584 chrome.exe 31 PID 1584 wrote to memory of 112 1584 chrome.exe 31 PID 1584 wrote to memory of 112 1584 chrome.exe 31 PID 1584 wrote to memory of 112 1584 chrome.exe 31 PID 1584 wrote to memory of 112 1584 chrome.exe 31 PID 1584 wrote to memory of 112 1584 chrome.exe 31 PID 1584 wrote to memory of 112 1584 chrome.exe 31 PID 1584 wrote to memory of 112 1584 chrome.exe 31 PID 1584 wrote to memory of 112 1584 chrome.exe 31 PID 1584 wrote to memory of 112 1584 chrome.exe 31 PID 1584 wrote to memory of 112 1584 chrome.exe 31 PID 1584 wrote to memory of 112 1584 chrome.exe 31 PID 1584 wrote to memory of 112 1584 chrome.exe 31 PID 1584 wrote to memory of 112 1584 chrome.exe 31 PID 1584 wrote to memory of 112 1584 chrome.exe 31 PID 1584 wrote to memory of 112 1584 chrome.exe 31 PID 1584 wrote to memory of 1784 1584 chrome.exe 32 PID 1584 wrote to memory of 1784 1584 chrome.exe 32 PID 1584 wrote to memory of 1784 1584 chrome.exe 32 PID 1584 wrote to memory of 1464 1584 chrome.exe 33 PID 1584 wrote to memory of 1464 1584 chrome.exe 33 PID 1584 wrote to memory of 1464 1584 chrome.exe 33 PID 1584 wrote to memory of 1464 1584 chrome.exe 33 PID 1584 wrote to memory of 1464 1584 chrome.exe 33 PID 1584 wrote to memory of 1464 1584 chrome.exe 33 PID 1584 wrote to memory of 1464 1584 chrome.exe 33 PID 1584 wrote to memory of 1464 1584 chrome.exe 33 PID 1584 wrote to memory of 1464 1584 chrome.exe 33 PID 1584 wrote to memory of 1464 1584 chrome.exe 33 PID 1584 wrote to memory of 1464 1584 chrome.exe 33 PID 1584 wrote to memory of 1464 1584 chrome.exe 33 PID 1584 wrote to memory of 1464 1584 chrome.exe 33 PID 1584 wrote to memory of 1464 1584 chrome.exe 33 PID 1584 wrote to memory of 1464 1584 chrome.exe 33 PID 1584 wrote to memory of 1464 1584 chrome.exe 33 PID 1584 wrote to memory of 1464 1584 chrome.exe 33 -
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 2936 attrib.exe 2580 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2_AutoClicker.exe"C:\Users\Admin\AppData\Local\Temp\2_AutoClicker.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1688
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Loads dropped DLL
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6d34f50,0x7fef6d34f60,0x7fef6d34f702⤵PID:1644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1132 /prefetch:22⤵PID:112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1256 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1784
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1684 /prefetch:82⤵PID:1464
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2076 /prefetch:12⤵PID:1996
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2100 /prefetch:12⤵PID:1116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3148 /prefetch:82⤵PID:1596
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3052 /prefetch:22⤵PID:1456
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2540 /prefetch:12⤵PID:1552
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3532 /prefetch:82⤵PID:2088
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3640 /prefetch:82⤵PID:2096
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3992 /prefetch:82⤵PID:2176
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4124 /prefetch:82⤵PID:2216
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3076 /prefetch:82⤵PID:2256
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3604 /prefetch:82⤵PID:2308
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3672 /prefetch:82⤵PID:2300
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3584 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2292
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3124 /prefetch:82⤵PID:2344
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3660 /prefetch:82⤵PID:2412
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3720 /prefetch:82⤵PID:2476
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2556 /prefetch:82⤵PID:2484
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3608 /prefetch:12⤵PID:2556
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:12⤵PID:2628
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2412 /prefetch:12⤵PID:2704
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4228 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3668 /prefetch:12⤵PID:2980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4224 /prefetch:82⤵PID:2136
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3592 /prefetch:82⤵PID:2316
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:896
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4220 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2428
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4144 /prefetch:82⤵PID:2056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4164 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1968
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1476 /prefetch:82⤵PID:2548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1572 /prefetch:82⤵PID:2300
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1476 /prefetch:82⤵PID:2416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4736 /prefetch:82⤵PID:2464
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4668 /prefetch:82⤵PID:2232
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3960 /prefetch:82⤵PID:2012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4596 /prefetch:82⤵PID:888
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1576 /prefetch:82⤵PID:3048
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4212 /prefetch:82⤵PID:2468
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2444 /prefetch:82⤵PID:2404
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4028 /prefetch:82⤵PID:760
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4024 /prefetch:12⤵PID:1028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4624 /prefetch:12⤵PID:2880
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1740 /prefetch:12⤵PID:2996
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:12⤵PID:2092
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4652 /prefetch:82⤵PID:2480
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3288 /prefetch:82⤵PID:1056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3676 /prefetch:12⤵PID:2988
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:12⤵PID:3028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4212 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1100
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:12⤵PID:288
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1704 /prefetch:82⤵PID:1612
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3952 /prefetch:12⤵PID:2544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4332 /prefetch:82⤵PID:760
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:12⤵PID:2756
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2400 /prefetch:12⤵PID:1748
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4240 /prefetch:12⤵PID:3000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2268 /prefetch:12⤵PID:1516
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4304 /prefetch:82⤵PID:1696
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3300 /prefetch:82⤵PID:2984
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3148 /prefetch:12⤵PID:2820
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4104 /prefetch:82⤵PID:1356
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3620 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2432
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3116 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1192
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2276 /prefetch:82⤵PID:2464
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2676 /prefetch:82⤵PID:1612
-
-
C:\Users\Admin\Downloads\HotspotShield-11.0.1-plain-773-plain.exe"C:\Users\Admin\Downloads\HotspotShield-11.0.1-plain-773-plain.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2012 -
C:\Windows\Temp\{0966D87D-21FC-4D3F-9024-4288C0943BD7}\.cr\HotspotShield-11.0.1-plain-773-plain.exe"C:\Windows\Temp\{0966D87D-21FC-4D3F-9024-4288C0943BD7}\.cr\HotspotShield-11.0.1-plain-773-plain.exe" -burn.clean.room="C:\Users\Admin\Downloads\HotspotShield-11.0.1-plain-773-plain.exe" -burn.filehandle.attached=180 -burn.filehandle.self=1883⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2700 -
C:\Windows\Temp\{4F4D3080-1BCF-4D40-B09E-170B65B18193}\.be\HSS-11.0.1-install-plain-773-plain.exe"C:\Windows\Temp\{4F4D3080-1BCF-4D40-B09E-170B65B18193}\.be\HSS-11.0.1-install-plain-773-plain.exe" -q -burn.elevated BurnPipe.{F7AA2157-D8BB-44F6-AB94-AC90D407FD05} {9ACCCADD-02DB-4BD3-BC07-71AB16EF852D} 27004⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
PID:2736
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:936
-
-
C:\Users\Admin\Downloads\HotspotShield-11.0.1-plain-773-plain.exe"C:\Users\Admin\Downloads\HotspotShield-11.0.1-plain-773-plain.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2156 -
C:\Windows\Temp\{E615D487-E3AD-4D5B-8F27-0E25E289F02D}\.cr\HotspotShield-11.0.1-plain-773-plain.exe"C:\Windows\Temp\{E615D487-E3AD-4D5B-8F27-0E25E289F02D}\.cr\HotspotShield-11.0.1-plain-773-plain.exe" -burn.clean.room="C:\Users\Admin\Downloads\HotspotShield-11.0.1-plain-773-plain.exe" -burn.filehandle.attached=180 -burn.filehandle.self=1883⤵
- Executes dropped EXE
- Loads dropped DLL
PID:524 -
C:\Windows\Temp\{F4258B87-A210-42C0-AF30-50DCC547D796}\.be\HSS-11.0.1-install-plain-773-plain.exe"C:\Windows\Temp\{F4258B87-A210-42C0-AF30-50DCC547D796}\.be\HSS-11.0.1-install-plain-773-plain.exe" -q -burn.elevated BurnPipe.{3589FC8B-FB8D-4197-A4C3-821D6C3AA37D} {B1BB3325-1CA7-461D-8413-564724187B47} 5244⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
PID:2452
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=540 /prefetch:82⤵PID:540
-
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\99.279.200\software_reporter_tool.exe"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\99.279.200\software_reporter_tool.exe" --engine=2 --scan-locations=1,2,3,4,5,6,7,8,10 --disabled-locations=9,11 --session-id=LU6a5zZu+noO58yHFYicnnntBEVyS0TtcVMBxzHS --registry-suffix=ESET --enable-crash-reporting --srt-field-trial-group-name=NewCleanerUIExperiment2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2324 -
\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\99.279.200\software_reporter_tool.exe"c:\users\admin\appdata\local\google\chrome\user data\swreporter\99.279.200\software_reporter_tool.exe" --crash-handler "--database=c:\users\admin\appdata\local\Google\Software Reporter Tool" --url=https://clients2.google.com/cr/report --annotation=plat=Win32 --annotation=prod=ChromeFoil --annotation=ver=99.279.200 --initial-client-data=0x160,0x164,0x168,0x134,0x16c,0x13f3025a0,0x13f3025b0,0x13f3025c03⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2548
-
-
\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\99.279.200\software_reporter_tool.exe"c:\users\admin\appdata\local\google\chrome\user data\swreporter\99.279.200\software_reporter_tool.exe" --enable-crash-reporting --use-crash-handler-with-id="\\.\pipe\crashpad_2324_UQKHJFOAAJREORFM" --sandboxed-process-id=2 --init-done-notifier=492 --sandbox-mojo-pipe-token=3506992109939782783 --mojo-platform-channel-handle=460 --engine=23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2320
-
-
\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\99.279.200\software_reporter_tool.exe"c:\users\admin\appdata\local\google\chrome\user data\swreporter\99.279.200\software_reporter_tool.exe" --enable-crash-reporting --use-crash-handler-with-id="\\.\pipe\crashpad_2324_UQKHJFOAAJREORFM" --sandboxed-process-id=3 --init-done-notifier=644 --sandbox-mojo-pipe-token=7385417880199177433 --mojo-platform-channel-handle=6403⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1780
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=71 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2168 /prefetch:12⤵PID:2052
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=72 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3960 /prefetch:12⤵PID:1752
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4940 /prefetch:82⤵PID:2780
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5040 /prefetch:82⤵PID:2284
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=75 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:12⤵PID:2300
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=76 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2608 /prefetch:12⤵PID:1608
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5044 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=77 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:12⤵PID:2372
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=79 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3520 /prefetch:12⤵PID:2544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=620 /prefetch:82⤵PID:112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5092 /prefetch:82⤵PID:2868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4968 /prefetch:82⤵PID:2892
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2856
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1012 /prefetch:82⤵PID:3060
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3116 /prefetch:82⤵PID:2816
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2040 /prefetch:82⤵PID:1056
-
-
C:\Users\Admin\Downloads\ndp48-devpack-enu.exe"C:\Users\Admin\Downloads\ndp48-devpack-enu.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2840 -
C:\Windows\Temp\{3CEC6CF0-FBE0-4905-A485-D85D141946A3}\.cr\ndp48-devpack-enu.exe"C:\Windows\Temp\{3CEC6CF0-FBE0-4905-A485-D85D141946A3}\.cr\ndp48-devpack-enu.exe" -burn.clean.room="C:\Users\Admin\Downloads\ndp48-devpack-enu.exe" -burn.filehandle.attached=180 -burn.filehandle.self=1883⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in Windows directory
PID:2136 -
C:\Windows\Temp\{97C86A3D-D2CB-488C-BFC9-93CE86EC7690}\.be\NDP48-DevPack-ENU.exe"C:\Windows\Temp\{97C86A3D-D2CB-488C-BFC9-93CE86EC7690}\.be\NDP48-DevPack-ENU.exe" -q -burn.elevated BurnPipe.{9D38FA3D-AC49-4B2A-A7B9-7C035FC80753} {8721D82B-0F9C-4212-8D98-6CF12454729B} 21364⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2748
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=87 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4100 /prefetch:12⤵PID:2752
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=88 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=992 /prefetch:12⤵PID:2368
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1856 /prefetch:82⤵PID:2856
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2540 /prefetch:82⤵PID:2816
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=91 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4476 /prefetch:12⤵PID:1056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=92 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1632 /prefetch:12⤵PID:2536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=93 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2272 /prefetch:12⤵PID:2344
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=94 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1800 /prefetch:12⤵PID:2908
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=95 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1808 /prefetch:12⤵PID:1260
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4264 /prefetch:82⤵PID:2684
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5168 /prefetch:82⤵PID:2940
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4864 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3060
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3412 /prefetch:82⤵PID:2588
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3448 /prefetch:82⤵PID:2228
-
-
C:\Users\Admin\Downloads\ndp48-x86-x64-allos-enu.exe"C:\Users\Admin\Downloads\ndp48-x86-x64-allos-enu.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2864 -
C:\0677a4ed283bba2ebbc57b43b6ab71\Setup.exeC:\0677a4ed283bba2ebbc57b43b6ab71\\Setup.exe /x86 /x64 /redist3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2084 -
C:\0677a4ed283bba2ebbc57b43b6ab71\SetupUtility.exeSetupUtility.exe /aupause4⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2560
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2416 /prefetch:82⤵PID:2648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=102 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:12⤵PID:2780
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=103 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4284 /prefetch:12⤵PID:2456
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4160 /prefetch:82⤵PID:2804
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=105 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:12⤵PID:2992
-
-
C:\Users\Admin\Downloads\HotspotShield-11.0.1-plain-773-plain.exe"C:\Users\Admin\Downloads\HotspotShield-11.0.1-plain-773-plain.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2812 -
C:\Windows\Temp\{14145962-AE3D-4E07-9BFB-08EC7B32023C}\.cr\HotspotShield-11.0.1-plain-773-plain.exe"C:\Windows\Temp\{14145962-AE3D-4E07-9BFB-08EC7B32023C}\.cr\HotspotShield-11.0.1-plain-773-plain.exe" -burn.clean.room="C:\Users\Admin\Downloads\HotspotShield-11.0.1-plain-773-plain.exe" -burn.filehandle.attached=180 -burn.filehandle.self=1883⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2220 -
C:\Windows\Temp\{6264AEB9-7CC7-4289-A3DA-2D19725FC438}\.be\HSS-11.0.1-install-plain-773-plain.exe"C:\Windows\Temp\{6264AEB9-7CC7-4289-A3DA-2D19725FC438}\.be\HSS-11.0.1-install-plain-773-plain.exe" -q -burn.elevated BurnPipe.{E7EE4ED9-8EB0-41D1-9AE4-99CD07873F80} {1C0B83EC-274E-4696-B0FB-56C6C33F4137} 22204⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
PID:2888
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=106 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:12⤵PID:2612
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=107 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2204 /prefetch:12⤵PID:2256
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4020 /prefetch:82⤵PID:3040
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1704 /prefetch:82⤵PID:3004
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1848 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2200
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3452 /prefetch:82⤵PID:2552
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4204 /prefetch:82⤵PID:2580
-
-
C:\Users\Admin\Downloads\ProtonVPN_win_v1.26.0.exe"C:\Users\Admin\Downloads\ProtonVPN_win_v1.26.0.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2896 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\{D84BF03F-46AB-491B-9185-56732D3C3C2D}\check-KB2992611.bat" "3⤵PID:2176
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic qfe get hotfixid4⤵PID:1988
-
-
C:\Windows\SysWOW64\findstr.exeFindStr "KB2992611"4⤵PID:2992
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\{D84BF03F-46AB-491B-9185-56732D3C3C2D}\check-KB3033929.bat" "3⤵PID:2668
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic qfe get hotfixid4⤵PID:2064
-
-
C:\Windows\SysWOW64\findstr.exeFindStr "KB3033929 KB4019264 KB4022719 KB4025341 KB4034664 KB4038777 KB4041681 KB4343900 KB4457144 KB4462923 KB4467107 KB4471318 KB4480970 KB4486563 KB4489878 KB4474419 KB4493472 KB4499164 KB4499175 KB4503292 KB4503269 KB4507449 KB4507456 KB4512506 KB4516065 KB4519976 KB4524157 KB4015549 KB3197868 KB3185330"4⤵PID:2140
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\{D84BF03F-46AB-491B-9185-56732D3C3C2D}\check-KB3063858.bat" "3⤵PID:2856
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic qfe get hotfixid4⤵PID:656
-
-
C:\Windows\SysWOW64\findstr.exeFindStr "KB3063858 KB2533623 KB4457144 KB3126587 KB3126593 KB3146706 KB4014793"4⤵PID:2128
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\{D84BF03F-46AB-491B-9185-56732D3C3C2D}\check-KB2921916.bat" "3⤵PID:1976
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic qfe get hotfixid4⤵PID:1728
-
-
C:\Windows\SysWOW64\findstr.exeFindStr "KB2921916"4⤵PID:2300
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\EXE4056.bat" "3⤵PID:2980
-
C:\Windows\SysWOW64\attrib.exeC:\Windows\System32\attrib.exe -r "C:\Users\Admin\AppData\Local\Temp\AIE4CCE.tmp"4⤵
- Views/modifies file attributes
PID:2580
-
-
C:\Windows\SysWOW64\attrib.exeC:\Windows\System32\attrib.exe -r "C:\Users\Admin\AppData\Local\Temp\EXE4056.bat"4⤵
- Views/modifies file attributes
PID:2936
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" del "C:\Users\Admin\AppData\Local\Temp\EXE4056.bat" "4⤵PID:1816
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" cls"4⤵PID:1056
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=532 /prefetch:82⤵PID:2068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1120,11950793431525503215,10357421546827139221,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4152 /prefetch:82⤵PID:2340
-
-
C:\Users\Admin\Desktop\New folder\SpeedifyInstaller.exe"C:\Users\Admin\Desktop\New folder\SpeedifyInstaller.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
PID:2500 -
C:\Windows\SysWOW64\wusa.exewusa.exe "C:\Users\Admin\AppData\Local\Temp\Speedify\Windows6.1-KB3033929.msu"2⤵
- Drops file in Windows directory
PID:3020
-
-
C:\Users\Admin\Desktop\New folder\SpeedifyInstaller.exe"C:\Users\Admin\Desktop\New folder\SpeedifyInstaller.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2608
-
C:\Users\Admin\Desktop\New folder\SpeedifyInstaller.exe"C:\Users\Admin\Desktop\New folder\SpeedifyInstaller.exe"1⤵
- Loads dropped DLL
PID:2160
-
C:\Users\Admin\Desktop\New folder\SpeedifyInstaller.exe"C:\Users\Admin\Desktop\New folder\SpeedifyInstaller.exe"1⤵
- Loads dropped DLL
PID:1508
-
C:\Users\Admin\Desktop\New folder\SpeedifyInstaller.exe"C:\Users\Admin\Desktop\New folder\SpeedifyInstaller.exe"1⤵
- Loads dropped DLL
PID:1996
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1a41⤵
- Suspicious use of AdjustPrivilegeToken
PID:2336
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\Hotspot_Shield_11.0.1_20220325224930.log1⤵
- Opens file in notepad (likely ransom note)
PID:2892
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\Hotspot_Shield_11.0.1_20220325224930.log1⤵
- Opens file in notepad (likely ransom note)
PID:2376
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1448
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003A4" "0000000000000300"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2640
-
C:\Users\Admin\Desktop\New folder\SpeedifyInstaller.exe"C:\Users\Admin\Desktop\New folder\SpeedifyInstaller.exe"1⤵
- Loads dropped DLL
PID:2576
-
C:\Users\Admin\Desktop\New folder\SpeedifyInstaller.exe"C:\Users\Admin\Desktop\New folder\SpeedifyInstaller.exe"1⤵
- Loads dropped DLL
PID:1628
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:896 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 968105F585BA0EDC2E9157538551D04B C2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2308
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding DB4D01DFACB1C2B2CFCE0088DFAAA0E9 C2⤵
- Loads dropped DLL
PID:2188
-