plugx | hxxps://gofile[.]io/d/a4qZbh

Analysis

max time kernel
242s
max time network
245s
platform
windows10_x64
resource
win10-20220310-en
submitted
25/03/2022, 08:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://gofile.io/d/a4qZbh

Score

10^/10

plugx trojan

Malware Config

Signatures

PlugX
PlugX is a RAT (Remote Access Trojan) that has been around since 2008.
trojan plugx

PlugX Rat Payload 1 IoCs

resource	yara_rule
behavioral1/memory/4320-134-0x000000001FF90000-0x0000000020716000-memory.dmp	PlugX

Executes dropped EXE 2 IoCs

pid	Process
4320	Proxy Checker by xRisky v2 [ All Type ].exe
5804	Proxy Checker by xRisky v2 [ All Type ].exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\Proxy Checker by xRisky v2 [ All Type ]\Country Databases\DbipLite-Country.mmdb	chrome.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\Proxy Checker by xRisky v2 [ All Type ]\Country Databases\GeoLite2-Country.mmdb	chrome.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\Proxy Checker by xRisky v2 [ All Type ]\Proxy Checker by xRisky v2 [ All Type ].exe	chrome.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\Proxy Checker by xRisky v2 [ All Type ]\Youtube Channel.lnk	chrome.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\Proxy Checker by xRisky v2 [ All Type ]\Telegram Channel.lnk	chrome.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\Proxy Checker by xRisky v2 [ All Type ]\Read before using.txt	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
3944	chrome.exe
3944	chrome.exe
2176	chrome.exe
2176	chrome.exe
3476	chrome.exe
3476	chrome.exe
5904	chrome.exe
5904	chrome.exe
5992	chrome.exe
5992	chrome.exe
5992	chrome.exe
5992	chrome.exe
6076	chrome.exe
6076	chrome.exe
4996	chrome.exe
4996	chrome.exe
4320	Proxy Checker by xRisky v2 [ All Type ].exe
5804	Proxy Checker by xRisky v2 [ All Type ].exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 39 IoCs

pid	Process
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeRestorePrivilege	4308	7zG.exe
Token: 35	4308	7zG.exe
Token: SeSecurityPrivilege	4308	7zG.exe
Token: SeSecurityPrivilege	4308	7zG.exe
Token: SeDebugPrivilege	4320	Proxy Checker by xRisky v2 [ All Type ].exe
Token: SeDebugPrivilege	5804	Proxy Checker by xRisky v2 [ All Type ].exe

Suspicious use of FindShellTrayWindow 49 IoCs

pid	Process
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
4308	7zG.exe
2176	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe
2176	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4320	Proxy Checker by xRisky v2 [ All Type ].exe
4320	Proxy Checker by xRisky v2 [ All Type ].exe
5804	Proxy Checker by xRisky v2 [ All Type ].exe
5804	Proxy Checker by xRisky v2 [ All Type ].exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 2208	2176	chrome.exe	69
PID 2176 wrote to memory of 2208	2176	chrome.exe	69
PID 2176 wrote to memory of 3524	2176	chrome.exe	70
PID 2176 wrote to memory of 3524	2176	chrome.exe	70
PID 2176 wrote to memory of 3524	2176	chrome.exe	70
PID 2176 wrote to memory of 3524	2176	chrome.exe	70
PID 2176 wrote to memory of 3524	2176	chrome.exe	70
PID 2176 wrote to memory of 3524	2176	chrome.exe	70
PID 2176 wrote to memory of 3524	2176	chrome.exe	70
PID 2176 wrote to memory of 3524	2176	chrome.exe	70
PID 2176 wrote to memory of 3524	2176	chrome.exe	70
PID 2176 wrote to memory of 3524	2176	chrome.exe	70
PID 2176 wrote to memory of 3524	2176	chrome.exe	70
PID 2176 wrote to memory of 3524	2176	chrome.exe	70
PID 2176 wrote to memory of 3524	2176	chrome.exe	70
PID 2176 wrote to memory of 3524	2176	chrome.exe	70
PID 2176 wrote to memory of 3524	2176	chrome.exe	70
PID 2176 wrote to memory of 3524	2176	chrome.exe	70
PID 2176 wrote to memory of 3524	2176	chrome.exe	70
PID 2176 wrote to memory of 3524	2176	chrome.exe	70
PID 2176 wrote to memory of 3524	2176	chrome.exe	70
PID 2176 wrote to memory of 3524	2176	chrome.exe	70
PID 2176 wrote to memory of 3524	2176	chrome.exe	70
PID 2176 wrote to memory of 3524	2176	chrome.exe	70
PID 2176 wrote to memory of 3524	2176	chrome.exe	70
PID 2176 wrote to memory of 3524	2176	chrome.exe	70
PID 2176 wrote to memory of 3524	2176	chrome.exe	70
PID 2176 wrote to memory of 3524	2176	chrome.exe	70
PID 2176 wrote to memory of 3524	2176	chrome.exe	70
PID 2176 wrote to memory of 3524	2176	chrome.exe	70
PID 2176 wrote to memory of 3524	2176	chrome.exe	70
PID 2176 wrote to memory of 3524	2176	chrome.exe	70
PID 2176 wrote to memory of 3524	2176	chrome.exe	70
PID 2176 wrote to memory of 3524	2176	chrome.exe	70
PID 2176 wrote to memory of 3524	2176	chrome.exe	70
PID 2176 wrote to memory of 3524	2176	chrome.exe	70
PID 2176 wrote to memory of 3524	2176	chrome.exe	70
PID 2176 wrote to memory of 3524	2176	chrome.exe	70
PID 2176 wrote to memory of 3524	2176	chrome.exe	70
PID 2176 wrote to memory of 3524	2176	chrome.exe	70
PID 2176 wrote to memory of 3524	2176	chrome.exe	70
PID 2176 wrote to memory of 3524	2176	chrome.exe	70
PID 2176 wrote to memory of 3944	2176	chrome.exe	71
PID 2176 wrote to memory of 3944	2176	chrome.exe	71
PID 2176 wrote to memory of 1380	2176	chrome.exe	72
PID 2176 wrote to memory of 1380	2176	chrome.exe	72
PID 2176 wrote to memory of 1380	2176	chrome.exe	72
PID 2176 wrote to memory of 1380	2176	chrome.exe	72
PID 2176 wrote to memory of 1380	2176	chrome.exe	72
PID 2176 wrote to memory of 1380	2176	chrome.exe	72
PID 2176 wrote to memory of 1380	2176	chrome.exe	72
PID 2176 wrote to memory of 1380	2176	chrome.exe	72
PID 2176 wrote to memory of 1380	2176	chrome.exe	72
PID 2176 wrote to memory of 1380	2176	chrome.exe	72
PID 2176 wrote to memory of 1380	2176	chrome.exe	72
PID 2176 wrote to memory of 1380	2176	chrome.exe	72
PID 2176 wrote to memory of 1380	2176	chrome.exe	72
PID 2176 wrote to memory of 1380	2176	chrome.exe	72
PID 2176 wrote to memory of 1380	2176	chrome.exe	72
PID 2176 wrote to memory of 1380	2176	chrome.exe	72
PID 2176 wrote to memory of 1380	2176	chrome.exe	72
PID 2176 wrote to memory of 1380	2176	chrome.exe	72
PID 2176 wrote to memory of 1380	2176	chrome.exe	72
PID 2176 wrote to memory of 1380	2176	chrome.exe	72

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" https://gofile.io/d/a4qZbh
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffcbcdd4f50,0x7ffcbcdd4f60,0x7ffcbcdd4f70
  2⤵
  PID:2208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1548 /prefetch:2
  2⤵
  PID:3524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1788 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2216 /prefetch:8
  2⤵
  PID:1380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2972 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2980 /prefetch:1
  2⤵
  PID:2988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4456 /prefetch:8
  2⤵
  PID:1020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:2656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4868 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:1064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:3324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6160 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6344 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6476 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6784 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6960 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7152 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7460 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7628 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7796 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7948 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8144 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8428 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9336 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9536 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10056 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10196 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10188 /prefetch:1
  2⤵
  PID:5148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10596 /prefetch:1
  2⤵
  PID:5200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2400 /prefetch:8
  2⤵
  PID:5328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4208 /prefetch:1
  2⤵
  PID:5372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10148 /prefetch:1
  2⤵
  PID:5456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7884 /prefetch:1
  2⤵
  PID:5448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7848 /prefetch:1
  2⤵
  PID:5440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8016 /prefetch:1
  2⤵
  PID:5508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7564 /prefetch:1
  2⤵
  PID:5496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10220 /prefetch:1
  2⤵
  PID:5464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7760 /prefetch:1
  2⤵
  PID:5432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  PID:5860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4276 /prefetch:8
  2⤵
  PID:5896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4144 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1612 /prefetch:8
  2⤵
  - Drops file in Program Files directory
  PID:5960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4068 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8144 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6880 /prefetch:8
  2⤵
  PID:4896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=11360 /prefetch:8
  2⤵
  PID:4876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=9768 /prefetch:8
  2⤵
  PID:4848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=11192 /prefetch:8
  2⤵
  PID:4440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4128 /prefetch:8
  2⤵
  PID:4972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6804 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4440 /prefetch:8
  2⤵
  PID:5012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4124 /prefetch:8
  2⤵
  PID:4336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6804 /prefetch:1
  2⤵
  PID:5208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4480 /prefetch:1
  2⤵
  PID:5224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8104 /prefetch:8
  2⤵
  PID:5336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,16722819376530247267,2133906843209296590,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6804 /prefetch:1
  2⤵
  PID:4628

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5188

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Proxy_Checker_by_xRisky_v2_[_All_Type_]\" -spe -an -ai#7zMap20618:140:7zEvent17594
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4308

C:\Users\Admin\Downloads\Proxy_Checker_by_xRisky_v2_[_All_Type_]\Proxy Checker by xRisky v2 [ All Type ]\Proxy Checker by xRisky v2 [ All Type ].exe
"C:\Users\Admin\Downloads\Proxy_Checker_by_xRisky_v2_[_All_Type_]\Proxy Checker by xRisky v2 [ All Type ]\Proxy Checker by xRisky v2 [ All Type ].exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4320

C:\Users\Admin\Downloads\Proxy_Checker_by_xRisky_v2_[_All_Type_]\Proxy Checker by xRisky v2 [ All Type ]\Proxy Checker by xRisky v2 [ All Type ].exe
"C:\Users\Admin\Downloads\Proxy_Checker_by_xRisky_v2_[_All_Type_]\Proxy Checker by xRisky v2 [ All Type ]\Proxy Checker by xRisky v2 [ All Type ].exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5804

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4320-134-0x000000001FF90000-0x0000000020716000-memory.dmp

Filesize
7.5MB

Download
memory/4320-122-0x00007FFCB9D90000-0x00007FFCBA77C000-memory.dmp

Filesize
9.9MB

Download
memory/4320-125-0x00000000020B0000-0x00000000020B2000-memory.dmp

Filesize
8KB

Download
memory/4320-126-0x0000000002080000-0x000000000208A000-memory.dmp

Filesize
40KB

Download
memory/4320-127-0x00007FFCBA970000-0x00007FFCBAA9C000-memory.dmp

Filesize
1.2MB

Download
memory/4320-128-0x00000000020E0000-0x00000000020FC000-memory.dmp

Filesize
112KB

Download
memory/4320-129-0x00000000020B3000-0x00000000020B5000-memory.dmp

Filesize
8KB

Download
memory/4320-130-0x00000000020BA000-0x00000000020BC000-memory.dmp

Filesize
8KB

Download
memory/4320-131-0x000000001E130000-0x000000001E7AA000-memory.dmp

Filesize
6.5MB

Download
memory/4320-132-0x000000001E8B0000-0x000000001FA70000-memory.dmp

Filesize
17.8MB

Download
memory/4320-133-0x000000001FA70000-0x000000001FF90000-memory.dmp

Filesize
5.1MB

Download
memory/4320-123-0x000000001AC30000-0x000000001ADD0000-memory.dmp

Filesize
1.6MB

Download
memory/4320-135-0x0000000020720000-0x00000000207CE000-memory.dmp

Filesize
696KB

Download
memory/4320-136-0x0000000021D30000-0x00000000220C4000-memory.dmp

Filesize
3.6MB

Download
memory/4320-137-0x0000000023190000-0x0000000023200000-memory.dmp

Filesize
448KB

Download
memory/4320-124-0x000000001D0D0000-0x000000001D13A000-memory.dmp

Filesize
424KB

Download
memory/4320-151-0x000000001E7B0000-0x000000001E85A000-memory.dmp

Filesize
680KB

Download
memory/4320-150-0x00000000224C0000-0x00000000224C3000-memory.dmp

Filesize
12KB

Download
memory/4320-141-0x000000001AF10000-0x000000001AF30000-memory.dmp

Filesize
128KB

Download
memory/4320-147-0x00000000246D0000-0x00000000248DE000-memory.dmp

Filesize
2.1MB

Download
memory/4320-145-0x00000000020BC000-0x00000000020BF000-memory.dmp

Filesize
12KB

Download
memory/5804-144-0x0000000002073000-0x0000000002075000-memory.dmp

Filesize
8KB

Download
memory/5804-143-0x0000000002070000-0x0000000002072000-memory.dmp

Filesize
8KB

Download
memory/5804-146-0x000000000207A000-0x000000000207C000-memory.dmp

Filesize
8KB

Download
memory/5804-142-0x000000001AC10000-0x000000001ADB0000-memory.dmp

Filesize
1.6MB

Download
memory/5804-148-0x0000000022B60000-0x0000000022EF4000-memory.dmp

Filesize
3.6MB

Download
memory/5804-149-0x000000000207C000-0x000000000207F000-memory.dmp

Filesize
12KB

Download
memory/5804-140-0x00007FFCBA970000-0x00007FFCBAA9C000-memory.dmp

Filesize
1.2MB

Download
memory/5804-139-0x00007FFCB9D90000-0x00007FFCBA77C000-memory.dmp

Filesize
9.9MB

Download
memory/5804-152-0x00000000242B0000-0x00000000242B3000-memory.dmp

Filesize
12KB

Download