Analysis
-
max time kernel
242s -
max time network
245s -
platform
windows10_x64 -
resource
win10-20220310-en -
submitted
25-03-2022 08:52
Static task
static1
URLScan task
urlscan1
Malware Config
Signatures
-
PlugX Rat Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/4320-134-0x000000001FF90000-0x0000000020716000-memory.dmp PlugX -
Executes dropped EXE 2 IoCs
Processes:
Proxy Checker by xRisky v2 [ All Type ].exeProxy Checker by xRisky v2 [ All Type ].exepid process 4320 Proxy Checker by xRisky v2 [ All Type ].exe 5804 Proxy Checker by xRisky v2 [ All Type ].exe -
Drops file in Program Files directory 6 IoCs
Processes:
chrome.exedescription ioc process File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Proxy Checker by xRisky v2 [ All Type ]\Country Databases\DbipLite-Country.mmdb chrome.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Proxy Checker by xRisky v2 [ All Type ]\Country Databases\GeoLite2-Country.mmdb chrome.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Proxy Checker by xRisky v2 [ All Type ]\Proxy Checker by xRisky v2 [ All Type ].exe chrome.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Proxy Checker by xRisky v2 [ All Type ]\Youtube Channel.lnk chrome.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Proxy Checker by xRisky v2 [ All Type ]\Telegram Channel.lnk chrome.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Proxy Checker by xRisky v2 [ All Type ]\Read before using.txt chrome.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies registry class 1 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000_Classes\Local Settings chrome.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
chrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exeProxy Checker by xRisky v2 [ All Type ].exeProxy Checker by xRisky v2 [ All Type ].exepid process 3944 chrome.exe 3944 chrome.exe 2176 chrome.exe 2176 chrome.exe 3476 chrome.exe 3476 chrome.exe 5904 chrome.exe 5904 chrome.exe 5992 chrome.exe 5992 chrome.exe 5992 chrome.exe 5992 chrome.exe 6076 chrome.exe 6076 chrome.exe 4996 chrome.exe 4996 chrome.exe 4320 Proxy Checker by xRisky v2 [ All Type ].exe 5804 Proxy Checker by xRisky v2 [ All Type ].exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 39 IoCs
Processes:
chrome.exepid process 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
7zG.exeProxy Checker by xRisky v2 [ All Type ].exeProxy Checker by xRisky v2 [ All Type ].exedescription pid process Token: SeRestorePrivilege 4308 7zG.exe Token: 35 4308 7zG.exe Token: SeSecurityPrivilege 4308 7zG.exe Token: SeSecurityPrivilege 4308 7zG.exe Token: SeDebugPrivilege 4320 Proxy Checker by xRisky v2 [ All Type ].exe Token: SeDebugPrivilege 5804 Proxy Checker by xRisky v2 [ All Type ].exe -
Suspicious use of FindShellTrayWindow 49 IoCs
Processes:
chrome.exe7zG.exepid process 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 4308 7zG.exe 2176 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
Proxy Checker by xRisky v2 [ All Type ].exeProxy Checker by xRisky v2 [ All Type ].exepid process 4320 Proxy Checker by xRisky v2 [ All Type ].exe 4320 Proxy Checker by xRisky v2 [ All Type ].exe 5804 Proxy Checker by xRisky v2 [ All Type ].exe 5804 Proxy Checker by xRisky v2 [ All Type ].exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 2176 wrote to memory of 2208 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 2208 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 3524 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 3524 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 3524 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 3524 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 3524 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 3524 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 3524 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 3524 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 3524 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 3524 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 3524 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 3524 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 3524 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 3524 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 3524 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 3524 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 3524 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 3524 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 3524 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 3524 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 3524 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 3524 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 3524 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 3524 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 3524 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 3524 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 3524 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 3524 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 3524 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 3524 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 3524 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 3524 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 3524 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 3524 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 3524 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 3524 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 3524 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 3524 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 3524 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 3524 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 3944 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 3944 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 1380 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 1380 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 1380 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 1380 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 1380 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 1380 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 1380 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 1380 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 1380 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 1380 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 1380 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 1380 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 1380 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 1380 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 1380 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 1380 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 1380 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 1380 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 1380 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 1380 2176 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://gofile.io/d/a4qZbh1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffcbcdd4f50,0x7ffcbcdd4f60,0x7ffcbcdd4f702⤵PID:2208
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1548 /prefetch:22⤵PID:3524
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1788 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3944 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2216 /prefetch:82⤵PID:1380
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2972 /prefetch:12⤵PID:2392
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2980 /prefetch:12⤵PID:2988
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4456 /prefetch:82⤵PID:1020
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:12⤵PID:2656
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4868 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3476 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:12⤵PID:784
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:12⤵PID:1064
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:12⤵PID:160
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:12⤵PID:196
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:12⤵PID:3324
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:12⤵PID:860
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6160 /prefetch:12⤵PID:4336
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6344 /prefetch:12⤵PID:4344
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6476 /prefetch:12⤵PID:4384
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6784 /prefetch:12⤵PID:4436
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6960 /prefetch:12⤵PID:4488
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7152 /prefetch:12⤵PID:4540
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:12⤵PID:4592
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7460 /prefetch:12⤵PID:4684
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7628 /prefetch:12⤵PID:4704
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7796 /prefetch:12⤵PID:4756
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7948 /prefetch:12⤵PID:4808
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8144 /prefetch:12⤵PID:4908
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8428 /prefetch:12⤵PID:4932
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9336 /prefetch:12⤵PID:4984
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9536 /prefetch:12⤵PID:5112
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10056 /prefetch:12⤵PID:4340
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10196 /prefetch:12⤵PID:4356
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10188 /prefetch:12⤵PID:5148
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10596 /prefetch:12⤵PID:5200
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2400 /prefetch:82⤵PID:5328
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4208 /prefetch:12⤵PID:5372
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10148 /prefetch:12⤵PID:5456
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7884 /prefetch:12⤵PID:5448
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7848 /prefetch:12⤵PID:5440
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8016 /prefetch:12⤵PID:5508
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7564 /prefetch:12⤵PID:5496
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10220 /prefetch:12⤵PID:5464
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7760 /prefetch:12⤵PID:5432
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5396 /prefetch:82⤵PID:5860
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4276 /prefetch:82⤵PID:5896
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4144 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5904 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1612 /prefetch:82⤵
- Drops file in Program Files directory
PID:5960 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4068 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5992 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8144 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:6076 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6880 /prefetch:82⤵PID:4896
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=11360 /prefetch:82⤵PID:4876
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=9768 /prefetch:82⤵PID:4848
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=11192 /prefetch:82⤵PID:4440
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4128 /prefetch:82⤵PID:4972
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6804 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4996 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4440 /prefetch:82⤵PID:5012
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4124 /prefetch:82⤵PID:4336
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6804 /prefetch:12⤵PID:5208
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4480 /prefetch:12⤵PID:5224
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8104 /prefetch:82⤵PID:5336
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6804 /prefetch:12⤵PID:4628
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:5188
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Proxy_Checker_by_xRisky_v2_[_All_Type_]\" -spe -an -ai#7zMap20618:140:7zEvent175941⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4308
-
C:\Users\Admin\Downloads\Proxy_Checker_by_xRisky_v2_[_All_Type_]\Proxy Checker by xRisky v2 [ All Type ]\Proxy Checker by xRisky v2 [ All Type ].exe"C:\Users\Admin\Downloads\Proxy_Checker_by_xRisky_v2_[_All_Type_]\Proxy Checker by xRisky v2 [ All Type ]\Proxy Checker by xRisky v2 [ All Type ].exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4320
-
C:\Users\Admin\Downloads\Proxy_Checker_by_xRisky_v2_[_All_Type_]\Proxy Checker by xRisky v2 [ All Type ]\Proxy Checker by xRisky v2 [ All Type ].exe"C:\Users\Admin\Downloads\Proxy_Checker_by_xRisky_v2_[_All_Type_]\Proxy Checker by xRisky v2 [ All Type ]\Proxy Checker by xRisky v2 [ All Type ].exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5804
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
431382dc411acaf4f1f63d84dbcc3950
SHA139dc7c1e471b829f646f3531fabf68f559c66ab3
SHA2567b531972c876290bad082885c5c639b5f3c8e484cd4b11e108743a6c5a330d3c
SHA512d4b13581e10dd396fa7711882d5b3e6884242806ac543915d4cacaea690aa8269c84a1ff25fb571efdce24edcb1bd9c002ef1420fb022b2ef39671724203abbe
-
C:\Users\Admin\Downloads\Proxy_Checker_by_xRisky_v2_[_All_Type_]\Proxy Checker by xRisky v2 [ All Type ]\Proxy Checker by xRisky v2 [ All Type ].exe
MD577b4b8979f7fd3c1e11ff88826c8907b
SHA16046e7921a88f5009133beceedc84cc64d13b263
SHA256d69014aeff7d55a097f1f65f16d9430cdd1f92f25827ee4bc245667b917cd749
SHA5125bf176338ad63c321a1e7bc30ffcc61121a3e8cb06040df433067f42ae5cdea47a5739d1f93a91fdcedfa4e9a95de20b4a73e8f9be7c5593fb81b4467a1546f8
-
C:\Users\Admin\Downloads\Proxy_Checker_by_xRisky_v2_[_All_Type_]\Proxy Checker by xRisky v2 [ All Type ]\Proxy Checker by xRisky v2 [ All Type ].exe
MD577b4b8979f7fd3c1e11ff88826c8907b
SHA16046e7921a88f5009133beceedc84cc64d13b263
SHA256d69014aeff7d55a097f1f65f16d9430cdd1f92f25827ee4bc245667b917cd749
SHA5125bf176338ad63c321a1e7bc30ffcc61121a3e8cb06040df433067f42ae5cdea47a5739d1f93a91fdcedfa4e9a95de20b4a73e8f9be7c5593fb81b4467a1546f8
-
C:\Users\Admin\Downloads\Proxy_Checker_by_xRisky_v2_[_All_Type_]\Proxy Checker by xRisky v2 [ All Type ]\Proxy Checker by xRisky v2 [ All Type ].exe
MD50a119398c5d4634677d63c4509222dbc
SHA108307dce56fb80ce2eeb554d1f26d951d16fb511
SHA2568bcc01d459b1ef60d045bf194be5daacdcd013869d5499c1da6cbebd72b355df
SHA512993072264136f2ab84d78d74f2d9b29336f8e861b94a57b7c0381735507ff45e4237d54fc2b98a46d808a5a7cc98b4ca58b050f384041779918af0abd6f83ba8
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e