Analysis
-
max time kernel
1991s -
max time network
2280s -
platform
windows10-2004_x64 -
resource
win10v2004-20220715-en -
resource tags
arch:x64arch:x86image:win10v2004-20220715-enlocale:en-usos:windows10-2004-x64system -
submitted
18/07/2022, 04:41
Behavioral task
behavioral1
Sample
SecuriteInfo.com.W32.AIDetect.malware2.21162.exe
Resource
win10v2004-20220715-en
General
-
Target
SecuriteInfo.com.W32.AIDetect.malware2.21162.exe
-
Size
1.4MB
-
MD5
9156ad371784d9d3639d617e52216f35
-
SHA1
d83523bbbf918da1408faf0fb815456acb862b85
-
SHA256
24c617f6c994a7a2f8520020365669fbd3cf5535f893118cefc39401394c2e15
-
SHA512
fe99810ee3d2c9c970ce30a3a619ab2890fc8024f77e57f9f6e0420d70da18ebd132f61db9623f9ca9815ed4488c955be7893cdd211dfebecf8413a45597a146
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\{01014416-0FD7-4A0F-AB45-C50E6225EFAD}\String1033.txt
Extracted
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]
wannacry
115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn
Signatures
-
Modifies system executable filetype association 2 TTPs 12 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\DragDropHandlers\WinZip\ = "{E0D79305-84BE-11CE-9641-444553540000}" winzip64.exe Key created \REGISTRY\MACHINE\Software\Classes\lnkfile\shellex\DragDropHandlers\WinZip msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\DragDropHandlers\WinZip msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\DragDropHandlers\WinZip\ = "{E0D79305-84BE-11CE-9641-444553540000}" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinZip msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinZip winzip64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinZip\ = "{E0D79304-84BE-11CE-9641-444553540000}" winzip64.exe Key created \REGISTRY\MACHINE\Software\Classes\lnkfile\shellex\ContextMenuHandlers\WinZip msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinZip\ = "{E0D79304-84BE-11CE-9641-444553540000}" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\DragDropHandlers msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\DragDropHandlers\WinZip winzip64.exe -
Wannacry
WannaCry is a ransomware cryptoworm.
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions ZwLoader.exe -
Contacts a large (551) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates new service(s) 1 TTPs
-
Downloads MZ/PE file
-
Drops file in Drivers directory 4 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\protected_elam.sys SecurityService.exe File opened for modification C:\Windows\system32\drivers\protected_elam.sys SecurityService.exe File created C:\Windows\system32\drivers\webshieldfilter.sys SecurityService.exe File created C:\Windows\system32\drivers\protected_elam.sys SecurityService.exe -
Executes dropped EXE 64 IoCs
pid Process 4000 ChromeRecovery.exe 260 winzip26-bing.exe 1520 winzip26-bing.exe 488 CloseFAH.exe 2076 ISBEW64.exe 5088 ISBEW64.exe 2724 ISBEW64.exe 2704 ISBEW64.exe 3924 ISBEW64.exe 828 ISBEW64.exe 3460 ISBEW64.exe 2628 ISBEW64.exe 3204 ISBEW64.exe 2036 ISBEW64.exe 2076 ISBEW64.exe 5088 ISBEW64.exe 444 ISBEW64.exe 2704 ISBEW64.exe 3924 ISBEW64.exe 1512 ISBEW64.exe 3396 ISBEW64.exe 1968 ISBEW64.exe 3776 ISBEW64.exe 4208 ISBEW64.exe 804 ISBEW64.exe 4492 ISBEW64.exe 548 ISBEW64.exe 4776 ISBEW64.exe 2192 ISBEW64.exe 5004 ISBEW64.exe 1524 ISBEW64.exe 1796 ISBEW64.exe 1260 ISBEW64.exe 60 ISBEW64.exe 1524 WzPreviewer64.exe 2036 WzPreloader.exe 804 winzip64.exe 8 WzCABCacheSyncHelper64.exe 1812 ISBEW64.exe 5124 ISBEW64.exe 5216 ISBEW64.exe 5252 ISBEW64.exe 5288 ISBEW64.exe 5364 ISBEW64.exe 5404 ISBEW64.exe 5468 ISBEW64.exe 5504 ISBEW64.exe 5576 ISBEW64.exe 5760 FAHConsole.exe 5780 FAHWindow64.exe 5828 adxregistrator.exe 6028 adxregistrator.exe 5248 WZUpdateNotifier.exe 5216 WzBGTComServer64.exe 5192 WzBGTools64.exe 5532 winzip64.exe 4276 WzCABCacheSyncHelper64.exe 5316 winzip64.exe 2364 WzCABCacheSyncHelper64.exe 5960 ZwLoader.exe 808 software_reporter_tool.exe 180 software_reporter_tool.exe 4248 software_reporter_tool.exe 5804 software_reporter_tool.exe -
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools ZwLoader.exe -
Modifies extensions of user files 19 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\GetOut.tif.WNCRYT => C:\Users\Admin\Pictures\GetOut.tif.WNCRY WannaCry.EXE File renamed C:\Users\Admin\Pictures\ResolvePing.png.WNCRYT => C:\Users\Admin\Pictures\ResolvePing.png.WNCRY WannaCry.EXE File renamed C:\Users\Admin\Pictures\PushAdd.png.WNCRYT => C:\Users\Admin\Pictures\PushAdd.png.WNCRY WannaCry.EXE File created C:\Users\Admin\Pictures\UnregisterFormat.png.WNCRYT WannaCry.EXE File opened for modification C:\Users\Admin\Pictures\UnregisterFormat.png.WNCRY WannaCry.EXE File opened for modification C:\Users\Admin\Pictures\ExpandUnpublish.raw.WNCRY WannaCry.EXE File opened for modification C:\Users\Admin\Pictures\GetOut.tif.WNCRY WannaCry.EXE File renamed C:\Users\Admin\Pictures\LockUnregister.tiff.WNCRYT => C:\Users\Admin\Pictures\LockUnregister.tiff.WNCRY WannaCry.EXE File opened for modification C:\Users\Admin\Pictures\LockUnregister.tiff.WNCRY WannaCry.EXE File renamed C:\Users\Admin\Pictures\UnregisterFormat.png.WNCRYT => C:\Users\Admin\Pictures\UnregisterFormat.png.WNCRY WannaCry.EXE File opened for modification C:\Users\Admin\Pictures\PushAdd.png.WNCRY WannaCry.EXE File created C:\Users\Admin\Pictures\ResolvePing.png.WNCRYT WannaCry.EXE File opened for modification C:\Users\Admin\Pictures\ResolvePing.png.WNCRY WannaCry.EXE File created C:\Users\Admin\Pictures\ExpandUnpublish.raw.WNCRYT WannaCry.EXE File renamed C:\Users\Admin\Pictures\ExpandUnpublish.raw.WNCRYT => C:\Users\Admin\Pictures\ExpandUnpublish.raw.WNCRY WannaCry.EXE File created C:\Users\Admin\Pictures\GetOut.tif.WNCRYT WannaCry.EXE File created C:\Users\Admin\Pictures\LockUnregister.tiff.WNCRYT WannaCry.EXE File created C:\Users\Admin\Pictures\PushAdd.png.WNCRYT WannaCry.EXE File opened for modification C:\Users\Admin\Pictures\LockUnregister.tiff WannaCry.EXE -
Registers COM server for autorun 1 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E0D79306-84BE-11CE-9641-444553540000}\InProcServer32 winzip64.exe Set value (str) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000_Classes\WOW6432Node\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\RuntimeVersion = "v2.0.50727" adxregistrator.exe Set value (str) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000_Classes\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\ = "mscoree.dll" adxregistrator.exe Set value (str) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000_Classes\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\ThreadingModel = "Both" adxregistrator.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\Class = "WinZipExpressForOffice.AddinModule" adxregistrator.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{523EB855-2A2D-4A56-8581-FF17D9728093}\InProcServer32\ = "oleaut32.dll" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E0D7930A-84BE-11CE-9641-444553540002}\LocalServer32\ = "C:\\Program Files\\WinZip\\WzPreviewer64.exe" WzPreviewer64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E0D79305-84BE-11CE-9641-444553540000}\InProcServer32\ThreadingModel = "Apartment" winzip64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E0D79304-84BE-11CE-9641-444553540000}\InProcServer32 MsiExec.exe Key created \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000_Classes\WOW6432Node\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\3.5.14535.0 adxregistrator.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\3.5.14535.0\RuntimeVersion = "v2.0.50727" adxregistrator.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E0D79305-84BE-11CE-9641-444553540000}\InProcServer32\ = "C:\\Program Files\\WinZip\\WZSHLS64.DLL" winzip64.exe Set value (str) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000_Classes\WOW6432Node\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\ = "mscoree.dll" adxregistrator.exe Set value (str) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000_Classes\WOW6432Node\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\Assembly = "WinZipExpressForOffice, Version=3.5.14535.0, Culture=neutral, PublicKeyToken=86e07f6d9d2175ee" adxregistrator.exe Set value (str) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000_Classes\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\ = "C:\\Program Files\\WinZip\\adxloader64.WinZipExpressForOffice.dll" adxregistrator.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\3.5.14535.0\Class = "WinZipExpressForOffice.AddinModule" adxregistrator.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E0D79304-84BE-11CE-9641-444553540000}\InProcServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000_Classes\WOW6432Node\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\3.5.14535.0\Assembly = "WinZipExpressForOffice, Version=3.5.14535.0, Culture=neutral, PublicKeyToken=86e07f6d9d2175ee" adxregistrator.exe Set value (str) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000_Classes\WOW6432Node\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\Assembly = "WinZipExpressForOffice, PublicKeyToken=86E07F6D9D2175EE" adxregistrator.exe Key deleted \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000_Classes\WOW6432Node\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\3.5.14535.0 adxregistrator.exe Set value (str) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000_Classes\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\3.5.14535.0\Assembly = "WinZipExpressForOffice, Version=3.5.14535.0, Culture=neutral, PublicKeyToken=86e07f6d9d2175ee" adxregistrator.exe Set value (str) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000_Classes\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\ThreadingModel = "Apartment" adxregistrator.exe Set value (str) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000_Classes\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\Assembly = "WinZipExpressForOffice, PublicKeyToken=86E07F6D9D2175EE" adxregistrator.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\3.5.14535.0 adxregistrator.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E0D79304-84BE-11CE-9641-444553540000}\InProcServer32\ThreadingModel = "Apartment" winzip64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{523EB855-2A2D-4A56-8581-FF17D9728093}\InProcServer32\ThreadingModel = "Both" MsiExec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000_Classes\WOW6432Node\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\ThreadingModel = "Apartment" adxregistrator.exe Set value (str) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000_Classes\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\Class = "WinZipExpressForOffice.AddinModule" adxregistrator.exe Key created \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000_Classes\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\3.5.14535.0 adxregistrator.exe Key deleted \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000_Classes\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\3.5.14535.0 adxregistrator.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\3.5.14535.0\CodeBase = "file:///C:/Program Files/WinZip/WinZipExpressForOffice.DLL" adxregistrator.exe Set value (str) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000_Classes\WOW6432Node\CLSID\{d79b57ed-727c-4ab8-ba67-e7c6fd30fac1}\LocalServer32\ = "\"C:\\Program Files (x86)\\PCProtect\\PCProtect.exe\" -ToastActivated" PCProtect.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E0D79307-84BE-11CE-9641-444553540000}\InProcServer32 MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E0D79307-84BE-11CE-9641-444553540000}\InProcServer32 winzip64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E0D79306-84BE-11CE-9641-444553540000}\InProcServer32\ = "C:\\Program Files\\WinZip\\WZSHLS64.DLL" winzip64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32 adxregistrator.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\3.5.14535.0 adxregistrator.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E0D79306-84BE-11CE-9641-444553540000}\InProcServer32\ThreadingModel = "Apartment" winzip64.exe Key created \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000_Classes\WOW6432Node\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32 adxregistrator.exe Set value (str) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000_Classes\WOW6432Node\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\ThreadingModel = "Both" adxregistrator.exe Set value (str) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000_Classes\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\3.5.14535.0\RuntimeVersion = "v2.0.50727" adxregistrator.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\RuntimeVersion = "v2.0.50727" adxregistrator.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\ThreadingModel = "Apartment" adxregistrator.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{784C04A3-2E5A-4E7C-A7F7-7D97E27859AD}\LocalServer32\ = "C:\\Program Files\\WinZip\\winzip64.exe" winzip64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E0D79306-84BE-11CE-9641-444553540000}\InProcServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E0D79307-84BE-11CE-9641-444553540000}\InProcServer32\ = "C:\\Program Files\\WinZip\\wzshls64.dll" MsiExec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000_Classes\WOW6432Node\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\CodeBase = "file:///C:/Program Files/WinZip/WinZipExpressForOffice.DLL" adxregistrator.exe Set value (str) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000_Classes\WOW6432Node\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\3.5.14535.0\Class = "WinZipExpressForOffice.AddinModule" adxregistrator.exe Key created \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000_Classes\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32 adxregistrator.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E0D79305-84BE-11CE-9641-444553540000}\InProcServer32\ = "C:\\Program Files\\WinZip\\wzshls64.dll" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E0D79305-84BE-11CE-9641-444553540000}\InProcServer32\ThreadingModel = "Apartment" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E0D79306-84BE-11CE-9641-444553540000}\InProcServer32 MsiExec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000_Classes\WOW6432Node\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\3.5.14535.0\CodeBase = "file:///C:/Program Files/WinZip/WinZipExpressForOffice.DLL" adxregistrator.exe Set value (str) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000_Classes\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\3.5.14535.0\CodeBase = "file:///C:/Program Files/WinZip/WinZipExpressForOffice.DLL" adxregistrator.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\CodeBase = "file:///C:/Program Files/WinZip/WinZipExpressForOffice.DLL" adxregistrator.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9CA9DBE8-C0B1-42c9-B6C7-856BE5756855}\LocalServer32\ = "\"C:\\Program Files\\WinZip\\WzBGTComServer64.exe\"" WzBGTComServer64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{784C04A3-2E5A-4E7C-A7F7-7D97E27859AD}\LocalServer32 winzip64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\ThreadingModel = "Both" adxregistrator.exe Set value (str) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000_Classes\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\3.5.14535.0\Class = "WinZipExpressForOffice.AddinModule" adxregistrator.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E0D79306-84BE-11CE-9641-444553540000}\InProcServer32\ = "C:\\Program Files\\WinZip\\wzshls64.dll" MsiExec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000_Classes\WOW6432Node\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\Class = "WinZipExpressForOffice.AddinModule" adxregistrator.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\Assembly = "WinZipExpressForOffice, PublicKeyToken=86E07F6D9D2175EE" adxregistrator.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{523EB855-2A2D-4A56-8581-FF17D9728093}\InProcServer32\InprocServer32 = 41003000310036004600300046003100310031003700330046004300440031003700440042003600000034006b00480038004800730024006a0049003d00270045006600280049007a00500069005a004700450043004400430036003e004d0035004b0044005900530055006e0066002800480041002a004c005b00780065005800290079002400660031002c004200460079004000580039002d00410045007d0026004d003500500025005900500072006f006700720061006d005f0044006100740061003e004d0035004b0044005900530055006e0066002800480041002a004c005b007800650058002900790000000000 MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E0D79305-84BE-11CE-9641-444553540000}\InProcServer32 MsiExec.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion ZwLoader.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion ZwLoader.exe -
Checks computer location settings 2 TTPs 11 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\Control Panel\International\Geo\Nation winzip64.exe Key value queried \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\Control Panel\International\Geo\Nation winzip26-bing.exe Key value queried \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\Control Panel\International\Geo\Nation winzip64.exe Key value queried \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\Control Panel\International\Geo\Nation winzip64.exe Key value queried \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\Control Panel\International\Geo\Nation Powder.exe Key value queried \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\Control Panel\International\Geo\Nation Powder.exe Key value queried \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\Control Panel\International\Geo\Nation winzip64.exe Key value queried \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\Control Panel\International\Geo\Nation winzip64.exe Key value queried \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\Control Panel\International\Geo\Nation PCProtect_Setup.exe Key value queried \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\Control Panel\International\Geo\Nation winzip64.exe Key value queried \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\Control Panel\International\Geo\Nation winzip64.exe -
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD355B.tmp WannaCry.EXE File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD3572.tmp WannaCry.EXE -
Loads dropped DLL 64 IoCs
pid Process 3116 MsiExec.exe 4060 MsiExec.exe 4060 MsiExec.exe 4060 MsiExec.exe 4060 MsiExec.exe 4060 MsiExec.exe 4060 MsiExec.exe 4060 MsiExec.exe 4060 MsiExec.exe 4060 MsiExec.exe 4060 MsiExec.exe 4060 MsiExec.exe 4060 MsiExec.exe 4060 MsiExec.exe 4060 MsiExec.exe 4060 MsiExec.exe 4060 MsiExec.exe 4060 MsiExec.exe 4060 MsiExec.exe 4060 MsiExec.exe 4060 MsiExec.exe 4060 MsiExec.exe 4060 MsiExec.exe 4060 MsiExec.exe 4060 MsiExec.exe 4060 MsiExec.exe 4060 MsiExec.exe 4060 MsiExec.exe 4060 MsiExec.exe 3116 MsiExec.exe 3116 MsiExec.exe 3116 MsiExec.exe 3116 MsiExec.exe 3116 MsiExec.exe 3116 MsiExec.exe 3116 MsiExec.exe 3116 MsiExec.exe 4060 MsiExec.exe 4060 MsiExec.exe 4060 MsiExec.exe 3116 MsiExec.exe 3116 MsiExec.exe 3116 MsiExec.exe 3116 MsiExec.exe 4492 MsiExec.exe 4492 MsiExec.exe 4492 MsiExec.exe 4492 MsiExec.exe 4492 MsiExec.exe 4492 MsiExec.exe 4492 MsiExec.exe 4492 MsiExec.exe 4492 MsiExec.exe 4492 MsiExec.exe 4492 MsiExec.exe 4492 MsiExec.exe 4492 MsiExec.exe 4492 MsiExec.exe 4492 MsiExec.exe 4492 MsiExec.exe 4492 MsiExec.exe 4492 MsiExec.exe 4492 MsiExec.exe 4492 MsiExec.exe -
Modifies file permissions 1 TTPs 7 IoCs
pid Process 928 icacls.exe 4128 icacls.exe 1112 icacls.exe 5332 icacls.exe 3280 icacls.exe 4128 icacls.exe 2292 icacls.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 10 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\pivepxpsij972 = "\"C:\\Users\\Admin\\Downloads\\WannaCry-main\\WannaCry-main\\tasksche.exe\"" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinZip FAH = "C:\\Program Files\\WinZip\\FAHConsole.exe" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Powder.exe Set value (str) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Powder = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\powder-desktop\\Powder.exe\" --start-hidden" Powder.exe Key created \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe Key created \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinZip UN = "\"C:\\Program Files\\WinZip\\WZUpdateNotifier.exe\" -show" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA winzip64.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA winzip64.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA winzip64.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA winzip64.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA winzip64.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA winzip64.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA winzip64.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA winzip64.exe -
Drops desktop.ini file(s) 21 IoCs
description ioc Process File opened for modification C:\Users\Admin\Documents\desktop.ini winzip64.exe File opened for modification C:\Users\Public\Documents\desktop.ini winzip64.exe File opened for modification C:\Users\Admin\Documents\desktop.ini winzip64.exe File opened for modification C:\Users\Public\desktop.ini winzip64.exe File opened for modification C:\Users\Public\desktop.ini winzip64.exe File opened for modification C:\Users\Public\desktop.ini winzip64.exe File opened for modification C:\Users\Admin\Documents\desktop.ini winzip64.exe File opened for modification C:\Users\Public\desktop.ini winzip64.exe File opened for modification C:\Users\Public\desktop.ini winzip64.exe File opened for modification C:\Users\Admin\Documents\desktop.ini winzip64.exe File opened for modification C:\Users\Public\Documents\desktop.ini winzip64.exe File opened for modification C:\Users\Public\desktop.ini winzip64.exe File opened for modification C:\Users\Public\Documents\desktop.ini winzip64.exe File opened for modification C:\Users\Admin\Documents\desktop.ini winzip64.exe File opened for modification C:\Users\Admin\Documents\desktop.ini winzip64.exe File opened for modification C:\Users\Admin\Documents\desktop.ini winzip64.exe File opened for modification C:\Users\Public\Documents\desktop.ini winzip64.exe File opened for modification C:\Users\Public\Documents\desktop.ini winzip64.exe File opened for modification C:\Users\Public\Documents\desktop.ini winzip64.exe File opened for modification C:\Users\Public\Documents\desktop.ini winzip64.exe File opened for modification C:\Users\Public\desktop.ini winzip64.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\E: winzip26-bing.exe File opened (read-only) \??\S: winzip26-bing.exe File opened (read-only) \??\V: winzip26-bing.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\J: winzip26-bing.exe File opened (read-only) \??\I: winzip26-bing.exe File opened (read-only) \??\P: winzip26-bing.exe File opened (read-only) \??\U: winzip26-bing.exe File opened (read-only) \??\W: winzip26-bing.exe File opened (read-only) \??\X: winzip26-bing.exe File opened (read-only) \??\Z: winzip26-bing.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\F: winzip26-bing.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\L: winzip26-bing.exe File opened (read-only) \??\T: winzip26-bing.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: winzip26-bing.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\H: winzip26-bing.exe File opened (read-only) \??\Q: winzip26-bing.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\M: winzip26-bing.exe File opened (read-only) \??\B: winzip26-bing.exe File opened (read-only) \??\N: winzip26-bing.exe File opened (read-only) \??\O: winzip26-bing.exe File opened (read-only) \??\Y: winzip26-bing.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\A: winzip26-bing.exe File opened (read-only) \??\R: winzip26-bing.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\K: winzip26-bing.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum ZwLoader.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 ZwLoader.exe -
Drops file in System32 directory 20 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\AppCenter\bb31922a-2e71-4ea5-8b24-36e4a6804bc8\Logs.db-journal SecurityService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00002.jrs svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.jfm svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jtx svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00001.jrs svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA winzip64.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA winzip64.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\AppCenter\bb31922a-2e71-4ea5-8b24-36e4a6804bc8\Logs.db SecurityService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jcp svchost.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\SecurityService\SecurityService_Url_0y5odhsgmzbzdute3dv1u0i2p1urm0we\2u50hwmi.tmp SecurityService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSStmp.log svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat svchost.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\SecurityService\SecurityService_Url_0y5odhsgmzbzdute3dv1u0i2p1urm0we\2u50hwmi.newcfg SecurityService.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\AppCenter\bb31922a-2e71-4ea5-8b24-36e4a6804bc8\Logs.db SecurityService.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\AppCenter\bb31922a-2e71-4ea5-8b24-36e4a6804bc8\Logs.db-journal SecurityService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\PCProtect\vdf_1658127478.zip SecurityService.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]" WannaCry.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]" @[email protected] -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\PCProtect\netstandard.dll PCProtect_Setup.exe File opened for modification C:\Program Files (x86)\PCProtect\SAVAPI\xbv00160.vdf SecurityService.exe File opened for modification C:\Program Files (x86)\PCProtect\SAVAPI\xbv00191.vdf SecurityService.exe File opened for modification C:\Program Files (x86)\PCProtect\SAVAPI\xbv00194.vdf SecurityService.exe File created C:\Program Files\WinZip\en-US\WzWXFcmbpdf64.dll.mui msiexec.exe File created C:\Program Files\WinZip\AddinExpress.OL.2005.dll msiexec.exe File created C:\Program Files\WinZip\en-US\USRCOMBO.WJF msiexec.exe File opened for modification C:\Program Files (x86)\PCProtect\SAVAPI\xbv00172.vdf SecurityService.exe File created C:\Program Files (x86)\PCProtect\SAVAPI\DotNetZip-13ulrzqk.tmp SecurityService.exe File created C:\Program Files\WinZip\AddinExpress.MSO.2005.dll msiexec.exe File created C:\Program Files (x86)\PCProtect\System.Reflection.dll PCProtect_Setup.exe File created C:\Program Files (x86)\PCProtect\System.Xml.Serialization.dll PCProtect_Setup.exe File opened for modification C:\Program Files (x86)\PCProtect\SAVAPI\xbv00018.vdf SecurityService.exe File created C:\Program Files (x86)\PCProtect\SAVAPI\DotNetZip-n3epflwl.tmp SecurityService.exe File opened for modification C:\Program Files (x86)\PCProtect\SAVAPI\xbv00201.vdf SecurityService.exe File opened for modification C:\Program Files (x86)\PCProtect\SAVAPI\xbv00246.vdf SecurityService.exe File created C:\Program Files (x86)\PCProtect\SAVAPI\tmp\avupdate_tmp_19HF1V\savapi4-ave2\win32\en\aeheur_mv.dat.gz avupdate.exe File created C:\Program Files\WinZip\BoxService.dll msiexec.exe File created C:\Program Files (x86)\PCProtect\SAVAPI\aelidb.dat PCProtect_Setup.exe File created C:\Program Files (x86)\PCProtect\SAVAPI\savapi_post.bat PCProtect_Setup.exe File opened for modification C:\Program Files (x86)\PCProtect\SAVAPI\xbv00087.vdf SecurityService.exe File created C:\Program Files (x86)\PCProtect\SAVAPI\DotNetZip-15z3taj1.tmp SecurityService.exe File created C:\Program Files (x86)\PCProtect\SAVAPI\aesbx.dll avupdate.exe File created C:\Program Files\WinZip\WzWXFmfire64.dll msiexec.exe File created C:\Program Files (x86)\PCProtect\System.ComponentModel.Annotations.dll PCProtect_Setup.exe File created C:\Program Files (x86)\PCProtect\SAVAPI\on_access\win32\win7\avkmgr.cat PCProtect_Setup.exe File created C:\Program Files (x86)\PCProtect\System.Net.WebSockets.dll PCProtect_Setup.exe File created C:\Program Files (x86)\PCProtect\SAVAPI\DotNetZip-01bduzzl.tmp SecurityService.exe File opened for modification C:\Program Files (x86)\PCProtect\SAVAPI\xbv00139.vdf SecurityService.exe File created C:\Program Files (x86)\PCProtect\SAVAPI\DotNetZip-q14zylsd.tmp SecurityService.exe File opened for modification C:\Program Files (x86)\PCProtect\SAVAPI\xbv00244.vdf SecurityService.exe File created C:\Program Files\WinZip\WzWXFcldme64.dll msiexec.exe File opened for modification C:\Program Files\WinZip\wzcab.dll MsiExec.exe File opened for modification C:\Program Files (x86)\PCProtect\installer.log PCProtect_Setup.exe File created C:\Program Files\WinZip\IMClient.dll msiexec.exe File created C:\Program Files\WinZip\NASCloudService.dll msiexec.exe File created C:\Program Files (x86)\PCProtect\System.Runtime.WindowsRuntime.UI.Xaml.dll PCProtect_Setup.exe File created C:\Program Files (x86)\PCProtect\SAVAPI\aebb.dll PCProtect_Setup.exe File opened for modification C:\Program Files (x86)\PCProtect\SAVAPI\xbv00015.vdf SecurityService.exe File opened for modification C:\Program Files (x86)\PCProtect\SAVAPI\xbv00064.vdf SecurityService.exe File created C:\Program Files (x86)\PCProtect\SAVAPI\DotNetZip-vpu0izrw.tmp SecurityService.exe File created C:\Program Files (x86)\PCProtect\SAVAPI\DotNetZip-yb1gdye4.tmp SecurityService.exe File created C:\Program Files\WinZip\en-US\ZipShareService.resources.dll msiexec.exe File created C:\Program Files (x86)\PCProtect\PresentationCore.dll PCProtect_Setup.exe File created C:\Program Files (x86)\PCProtect\System.Windows.Presentation.dll PCProtect_Setup.exe File created C:\Program Files (x86)\PCProtect\SAVAPI\avupdate.log avupdate.exe File created C:\Program Files (x86)\PCProtect\SAVAPI\tmp\avupdate_tmp_19HF1V\savapi4-ave2\win32\en\aehelp.dll avupdate.exe File created C:\Program Files (x86)\PCProtect\System.Security.Cryptography.Csp.dll PCProtect_Setup.exe File created C:\Program Files (x86)\PCProtect\mscorrc.dll PCProtect_Setup.exe File created C:\Program Files (x86)\PCProtect\driver\i386\OemWin2k.inf PCProtect_Setup.exe File created C:\Program Files (x86)\PCProtect\SAVAPI\on_access\win64\win7\avgio.dll PCProtect_Setup.exe File created C:\Program Files (x86)\PCProtect\SAVAPI\DotNetZip-qu3q5dku.tmp SecurityService.exe File created C:\Program Files\WinZip\CloudStorageService.dll msiexec.exe File created C:\Program Files\WinZip\WzWXFln64.dll msiexec.exe File created C:\Program Files (x86)\PCProtect\System.Reflection.Emit.dll PCProtect_Setup.exe File opened for modification C:\Program Files (x86)\PCProtect\SAVAPI\xbv00239.vdf SecurityService.exe File created C:\Program Files (x86)\PCProtect\SAVAPI\tmp\avupdate_tmp_19HF1V\savapi4-ave2\win32\en\aescript.dll avupdate.exe File created C:\Program Files (x86)\PCProtect\SAVAPI\DotNetZip-0ir4dw1o.tmp SecurityService.exe File created C:\Program Files (x86)\PCProtect\SAVAPI\DotNetZip-3jhj5yyz.tmp SecurityService.exe File opened for modification C:\Program Files (x86)\PCProtect\SAVAPI\xbv00176.vdf SecurityService.exe File created C:\Program Files (x86)\PCProtect\SAVAPI\aeheur.dll avupdate.exe File created C:\Program Files\WinZip\en-US\WXFSGNPDF.resources.dll msiexec.exe File created C:\Program Files (x86)\PCProtect\PresentationFramework.Luna.dll PCProtect_Setup.exe File created C:\Program Files (x86)\PCProtect\lib_SCAPI.dll PCProtect_Setup.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI9FFB.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA9E4.tmp msiexec.exe File opened for modification C:\Windows\win.ini winzip64.exe File opened for modification C:\Windows\Installer\MSIA0C8.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB7AA.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIDA95.tmp msiexec.exe File created C:\Windows\Installer\{CD95F661-A5C4-44F5-A6AA-ECDD91C2413F}\SbkupStub64_ShortCut_StartMenu.exe msiexec.exe File opened for modification C:\Windows\win.ini winzip64.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\{CD95F661-A5C4-44F5-A6AA-ECDD91C2413F}\ARPPRODUCTICON.exe msiexec.exe File created C:\Windows\Installer\{CD95F661-A5C4-44F5-A6AA-ECDD91C2413F}\Sbkup64_ShortCut_StartMenu.exe msiexec.exe File created C:\Windows\Installer\{CD95F661-A5C4-44F5-A6AA-ECDD91C2413F}\WinZip64_Shortcut_StartMenu.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI1E35.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA4BA.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA634.tmp msiexec.exe File opened for modification C:\Windows\WIN.INI winzip64.exe File opened for modification C:\Windows\Installer\{CD95F661-A5C4-44F5-A6AA-ECDD91C2413F}\WinZip64_Shortcut_Desktop.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI1E34.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIAB62.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI517.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1CF8.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID74D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID76F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI781.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI14B5.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA4DB.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5C8.tmp msiexec.exe File created C:\Windows\Installer\{CD95F661-A5C4-44F5-A6AA-ECDD91C2413F}\Sbkup64_ShortCut_Desktop.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI1C5B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB942.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID965.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID975.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIED87.tmp msiexec.exe File opened for modification C:\Windows\Installer\{CD95F661-A5C4-44F5-A6AA-ECDD91C2413F}\PdfUtil64_ShortCut_StartMenu.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI1A83.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA169.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA995.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIDAA6.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIDAD8.tmp msiexec.exe File created C:\Windows\Installer\{CD95F661-A5C4-44F5-A6AA-ECDD91C2413F}\WinZip64_Shortcut_Desktop.exe msiexec.exe File opened for modification C:\Windows\Installer\MSIA0A8.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIAA26.tmp msiexec.exe File opened for modification C:\Windows\Installer\{CD95F661-A5C4-44F5-A6AA-ECDD91C2413F}\ImgUtilStub64_Shortcut_Desktop.exe msiexec.exe File created C:\Windows\Installer\{CD95F661-A5C4-44F5-A6AA-ECDD91C2413F}\ImgUtilStub64_Shortcut_StartMenu.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI20A7.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID73D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIDA46.tmp msiexec.exe File opened for modification C:\Windows\Installer\{CD95F661-A5C4-44F5-A6AA-ECDD91C2413F}\SbkupStub64_ShortCut_StartMenu.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI1A94.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\{CD95F661-A5C4-44F5-A6AA-ECDD91C2413F}\WinZip64_Shortcut_MenuGroup.exe msiexec.exe File opened for modification C:\Windows\Installer\{CD95F661-A5C4-44F5-A6AA-ECDD91C2413F}\Sbkup64_ShortCut_Desktop.exe msiexec.exe File opened for modification C:\Windows\Installer\{CD95F661-A5C4-44F5-A6AA-ECDD91C2413F}\WinZip64_Shortcut_Preloader.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI1B31.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA118.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC634.tmp msiexec.exe File opened for modification C:\Windows\win.ini winzip64.exe File created C:\Windows\Installer\e5a99c1.msi msiexec.exe File opened for modification C:\Windows\Installer\MSID9C4.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIDAB7.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5A8.tmp msiexec.exe File opened for modification C:\Windows\Installer\{CD95F661-A5C4-44F5-A6AA-ECDD91C2413F}\PdfUtilStub64_Shortcut_Desktop.exe msiexec.exe File opened for modification C:\Windows\win.ini winzip64.exe File created C:\Windows\ELAMBKUP\protected_elam.sys SecurityService.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4676 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 1940 4568 WerFault.exe 565 -
Checks SCSI registry key(s) 3 TTPs 17 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000cd8915632a09e1fe0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000cd8915630000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3f000000ffffffff000000000700010000680900cd891563000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000cd89156300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000cd89156300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Checks processor information in registry 2 TTPs 13 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString Powder.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Powder.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Powder.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Powder.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 Powder.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz Powder.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5176 schtasks.exe 3152 schtasks.exe 5160 schtasks.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 3744 tasklist.exe -
Enumerates system info in registry 2 TTPs 24 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Kills process with taskkill 3 IoCs
pid Process 7060 taskkill.exe 6948 taskkill.exe 2900 taskkill.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\corel.com\Total = "0" winzip64.exe Set value (str) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" winzip64.exe Set value (int) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\corel.com\Total = "3486" winzip64.exe Set value (int) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\corel.com\Total = "1946" winzip64.exe Set value (int) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\corel.com\Total = "1237" winzip64.exe Set value (int) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "235" winzip64.exe Set value (data) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "3072" winzip64.exe Set value (int) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\corel.com\Total = "111" winzip64.exe Set value (int) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\ipm.corel.com\ = "3781" winzip64.exe Key created \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch winzip64.exe Set value (int) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "1237" winzip64.exe Set value (int) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\ipm.corel.com\ = "1946" winzip64.exe Set value (int) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\ipm.corel.com\ = "4194" winzip64.exe Set value (int) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "111" winzip64.exe Key created \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total winzip64.exe Set value (int) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\ipm.corel.com\ = "3073" winzip64.exe Set value (int) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "235" winzip64.exe Set value (int) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\corel.com\Total = "1529" winzip64.exe Set value (str) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" winzip64.exe Set value (int) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "1244" winzip64.exe Set value (int) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "235" winzip64.exe Set value (int) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "111" winzip64.exe Set value (int) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "1242" winzip64.exe Set value (int) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\ipm.corel.com\ = "3486" winzip64.exe Set value (int) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "4194" winzip64.exe Set value (int) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\ipm.corel.com\ = "235" winzip64.exe Set value (int) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "3073" winzip64.exe Set value (int) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\corel.com\Total = "111" winzip64.exe Set value (int) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\ipm.corel.com\ = "820" winzip64.exe Set value (int) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\corel.com\Total = "1242" winzip64.exe Key created \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\Software\Microsoft\Internet Explorer\Toolbar Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\corel.com winzip64.exe Set value (int) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\ipm.corel.com\ = "0" winzip64.exe Set value (int) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\ipm.corel.com\ = "4194" winzip64.exe Key created \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\Software\Microsoft\Internet Explorer\DOMStorage\corel.com winzip64.exe Set value (int) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\ipm.corel.com\ = "1943" winzip64.exe Set value (int) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\corel.com\Total = "1237" winzip64.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\WebAuthBroker.exe = "10000" MsiExec.exe Set value (int) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "111" winzip64.exe Set value (int) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\ipm.corel.com\ = "1946" winzip64.exe Set value (int) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "3068" winzip64.exe Set value (int) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "1240" winzip64.exe Set value (int) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "1242" winzip64.exe Set value (int) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\corel.com\Total = "2655" winzip64.exe Set value (int) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "3072" winzip64.exe Set value (int) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\corel.com\Total = "3072" winzip64.exe Set value (int) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\corel.com\Total = "124" winzip64.exe Set value (int) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\ipm.corel.com\ = "819" winzip64.exe Set value (int) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\corel.com\Total = "1242" winzip64.exe Set value (int) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\ipm.corel.com\ = "111" winzip64.exe Set value (int) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\corel.com\Total = "3781" winzip64.exe Set value (int) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\corel.com\Total = "1237" winzip64.exe Set value (int) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\ipm.corel.com\ = "111" winzip64.exe Key created \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\Software\Microsoft\Internet Explorer\IESettingSync winzip64.exe Set value (int) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\ipm.corel.com\ = "1237" winzip64.exe Set value (int) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\corel.com\Total = "820" winzip64.exe Set value (int) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\ipm.corel.com\ = "1235" winzip64.exe Set value (int) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "3781" winzip64.exe Set value (int) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\corel.com\Total = "3781" winzip64.exe Set value (int) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\ipm.corel.com\ = "3072" winzip64.exe Set value (int) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\corel.com\Total = "3490" winzip64.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\WinZip\Splitter\Enabled = "1" winzip64.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\WinZip\UpdateCheck\Period = "7" winzip64.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" winzip64.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Nico Mak Computing\WinZip\WXF\WzWXFcmbpdf WzCABCacheSyncHelper64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\WinZip\WXF\WzWXFdbox winzip64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs SecurityService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\WinZip\WXF\WzWXFzshare\Default winzip64.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Nico Mak Computing\WinZip\WinZip winzip64.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Nico Mak Computing\WinZip\WXF\WzAddrgcts WzCABCacheSyncHelper64.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" winzip64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA SecurityService.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\WinZip\Statistics\Collect = "1" winzip64.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\WinZip\WXF\WzWXFcldme\Default\WritableRootFolder = "\\" winzip64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\PowerPoint\AddIns\WinZipExpressForOffice.AddinModule adxregistrator.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\WinZip\winzip\Setup = "0" winzip64.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\WinZip\wzshlext\AddToFolder = "1" winzip64.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\WinZip\ListView\Col_Size = "5,R,48,T" winzip64.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\WinZip\ListView\Col_Encrypt = "1,L,18,T" winzip64.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Nico Mak Computing\WinZip\WXF\WzWXFcnvp WzCABCacheSyncHelper64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates SecurityService.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\WinZip\WXF\WzWXFoned\Default\WritableRootFolder = "\\" winzip64.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\WinZip\ListView\Col_Name = "2,L,216,T" winzip64.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\WinZip\ListView\Col_Path = "10,L,-2,F" winzip64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed SecurityService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Nico Mak Computing\WinZip\wzshlext winzip64.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\WinZip Computing\WinZip Computing = "Please look in the Nico Mak Computing section for WinZip keys, values, and settings." winzip64.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Nico Mak Computing\WinZip\WXF\WzWXFnas\Default WzCABCacheSyncHelper64.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" adxregistrator.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs SecurityService.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\WinZip\winzip\ReuseWindows = "1" winzip64.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Nico Mak Computing\WinZip\WXF\WzWXFssync\Default winzip64.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Word\AddIns\WinZipExpressForOffice.AddinModule\Description = "AddinModule" adxregistrator.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed SecurityService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates SecurityService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\WinZip\WXF\WzWXFcldme\Default\MaxUploadSizeMB = "0" winzip64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\WinZip\WXF\WzWXFoned winzip64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher SecurityService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\WinZip\fm\.BZ2 = "1" winzip64.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\WinZip\ListView\GridLines = "0" winzip64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\WinZip\WXF\WzWXFgdrv\Default winzip64.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\WinZip\wzshlext\MenuCfgTable = "222222222222222222222222222221" winzip64.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\Common\Email\Services\ = "<?xml version=\"1.0\" encoding=\"UTF-8\"?><mailservices default=\"Gmail\"><mailservice name=\"Gmail\" login=\"yes\" help=\"yes\" encryption=\"tls\"><smtp server=\"smtp.gmail.com\" port=\"587\"/><domains>gmail.com</domains></mailservice><mailservice name=\"Hotmail\" login=\"yes\" help=\"no\" encryption=\"tls\"><smtp server=\"smtp.live.com\" port=\"587\"/><domains>hotmail.*;live.*;msnhotmail.com</domains></mailservice><mailservice name=\"Yahoo!\" login=\"yes\" help=\"yes\" encryption=\"none\"><smtp server=\"plus.smtp.mail.yahoo.com\" port=\"465\"/><domains>yahoo.com;sbcglobal.com</domains></mailservice><mailservice name=\"Outlook.com\" login=\"yes\" help=\"yes\" encryption=\"tls\"><smtp server=\"smtp-mail.outlook.com\" port=\"587\"/><domains>outlook.com;*.onmicrosoft.com</domains></mailservice></mailservices>" winzip64.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Nico Mak Computing\WinZip\WXF\WzWXFivrs WzCABCacheSyncHelper64.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\WinZip\fm\.TBZ2 = "1" winzip64.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\WinZip\winzip\AlwaysOnTop = "0" winzip64.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Nico Mak Computing\WinZip\Splitter winzip64.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\WinZip\UpdateCheck\AskFirst = "0" winzip64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs SecurityService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs SecurityService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\PowerPoint adxregistrator.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Nico Mak Computing\WinZip winzip64.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\WinZip\WXF\WzWXFbox\Default\MaxUploadSizeMB = "0" winzip64.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\WinZip\fm\.VHD = "0" winzip64.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\WinZip\caution\ErrDelFileCaution = "0" winzip64.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\WinZip\ListView\Col_Packed = "7,R,54,T" winzip64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\Common\Email\Services winzip64.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\Common\Email winzip64.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Nico Mak Computing\WinZip\fm\.CAB = "1" winzip64.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\166F59DC4C5A5F446AAACEDD192C14F3\MainGUI = "WinZip" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\166F59DC4C5A5F446AAACEDD192C14F3\MediaFireCloud = "CloudSvc" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinZip.RegFile winzip64.exe Key created \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\1\MRUListEx = ffffffff Explorer.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vhd\ShellEx\{8895B1C6-B41F-4C1C-A562-0D564250836F} WzPreviewer64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wztheme\WinZip.Theme\ShellNew msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinZip.ZipX\ = "WinZip Zipx File" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\166F59DC4C5A5F446AAACEDD192C14F3\PdfUtil = "\x06Applets" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shell\PCProtect\SeparatorAfter SecurityService.exe Set value (int) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" Explorer.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.B64\ShellEx WzPreviewer64.exe Key created \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000_Classes\Component Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29} adxregistrator.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\3.5.14535.0 adxregistrator.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinZip.SetupConfig\shell\open\ = "Configure WinZip" winzip64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E0D79306-84BE-11CE-9641-444553540000}\InProcServer32 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.cab\ = "WinZip" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\166F59DC4C5A5F446AAACEDD192C14F3\CloudMeCloudFiles = "CloudMeCloud" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\166F59DC4C5A5F446AAACEDD192C14F3\Themes = "WinZip" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.GZ WzPreviewer64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinZip\ = "WinZip File" winzip64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.swjf\ = "WinZip.SecureBackup" winzip64.exe Set value (str) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202020202020202020202 Explorer.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\166F59DC4C5A5F446AAACEDD192C14F3\PdfUtilDesktopIcon = "\x06PdfUtil" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\PCProtect\Icon = "\"C:\\Program Files (x86)\\PCProtect\\PCProtect.exe\"" SecurityService.exe Set value (str) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\SniffedFolderType = "Generic" Explorer.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\166F59DC4C5A5F446AAACEDD192C14F3\ImgUtilFiles = "\x06ImgUtil" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinZip\ = "{E0D79305-84BE-11CE-9641-444553540000}" MsiExec.exe Key created \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\Shell Explorer.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.BHX\WinZip\ShellNew msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.MIM\ = "WinZip" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\166F59DC4C5A5F446AAACEDD192C14F3\NASCloudFiles = "NASCloud" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\166F59DC4C5A5F446AAACEDD192C14F3\DropboxCloudFiles = "DropboxCloud" msiexec.exe Set value (int) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\17\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" Explorer.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cab\ShellEx WzPreviewer64.exe Set value (data) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1 = 6400310000000000f2543438100057414e4e41437e3100004c0009000400efbef2542938f25434382e0000000b3f020000000b000000000000000000000000000000406d6100570061006e006e0061004300720079002d006d00610069006e00000018000000 Explorer.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.hqx\ShellEx\{8895B1C6-B41F-4C1C-A562-0D564250836F}\ = "{E0D7930A-84BE-11CE-9641-444553540002}" WzPreviewer64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.jpeg winzip64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.7z msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\166F59DC4C5A5F446AAACEDD192C14F3\SugarSyncCloud = "CloudSvc" msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}" Explorer.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WzExpForSPExtension\shell\open\command\ = "\"C:\\Program Files\\WinZip\\WzExpForSPExtension.exe\" \"%1\"" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.BZ2 WzPreviewer64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.LZS\ShellEx\{8895B1C6-B41F-4C1C-A562-0D564250836F} WzPreviewer64.exe Set value (data) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\2 = 8a00310000000000f2547739100052414e534f4d7e312e302d4d00006e0009000400efbef2547739f25478392e000000a42d02000000080000000000000000000000000000009b911f00520041004e0053004f004d0057004100520045002d00570041004e004e0041004300520059002d0032002e0030002d006d006100730074006500720000001c000000 Explorer.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\166F59DC4C5A5F446AAACEDD192C14F3\Previewer = "WinZip" msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000_Classes\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\RuntimeVersion = "v2.0.50727" adxregistrator.exe Set value (str) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000_Classes\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32\ = "C:\\Program Files\\WinZip\\adxloader64.WinZipExpressForOffice.dll" adxregistrator.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\166F59DC4C5A5F446AAACEDD192C14F3\AddressBookEnglishFiles = "AddressBook" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinZip.RegFile\shell\open winzip64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E0D7930A-84BE-11CE-9641-444553540002}\LocalServer32\ = "C:\\Program Files\\WinZip\\WzPreviewer64.exe" WzPreviewer64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.gz\ = "WinZip" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wjf\WinZip.JobFile\ShellNew msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vmdk\WinZip\ShellNew msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\166F59DC4C5A5F446AAACEDD192C14F3\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinZip.RegFile\shell\open winzip64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinZip.RegFile\shell\ = "open" winzip64.exe Key created \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000_Classes\discord-973501835119837244\DefaultIcon PowderRecorderCli.exe Key created \REGISTRY\MACHINE\Software\Classes\.wzmul msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinZip.ZipX\shell\print\command\ = "\"C:\\Program Files\\WinZip\\winzip64.exe\" /print /ni \"%1\"" winzip64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.RAR\WinZip msiexec.exe Set value (data) \REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 Explorer.EXE -
Modifies registry key 1 TTPs 1 IoCs
pid Process 6784 reg.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\C4D8249BB310BA6E0A062CB88F91E00716FC6694 SecurityService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\C4D8249BB310BA6E0A062CB88F91E00716FC6694\Blob = 030000000100000014000000c4d8249bb310ba6e0a062cb88f91e00716fc66942000000001000000320300003082032e30820216a003020102021100bdb09ca1e11fa45c1d7294f3a9d1aa8f300d06092a864886f70d01010b0500303f310b300906035504061302454e3130302e06035504030c27504350726f74656374204d616c6963696f75732055524c2050726f74656374696f6e20434120323020170d3032303732333036353930325a180f32303632303730383036353930325a303f310b300906035504061302454e3130302e06035504030c27504350726f74656374204d616c6963696f75732055524c2050726f74656374696f6e204341203230820122300d06092a864886f70d01010105000382010f003082010a0282010100d102fac59471f2454e80b9ee0861ed6bc62c3adfc79948a74cab6431221d7b71df61aa005a245e6c3327cda20d5c08adb0d221feb6341439cede4d10d764e688b7eabc1894335631312cf2bb7018c589ba265131a95e54f5632f511c7f64f87025a21b0f37aaf37258301de0e6985740c2bc17b760f47b6ce2abce7c04bff132729f8d8813a4a627589f2add6ff03882c301b842988c8437cf996bac4b8052ba490037f68e5c534c9ede75ed439b281ad72ce839e02e73464b10929aa8d1b67302beb4e67d5bb38bfca987818ffe16130e77dc73b89a042671727239f9c7b1dad7e1b249c30f51a713dd9dd7f7eba4617c90ae2c806af2cec304d8759e219fe10203010001a3233021300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106300d06092a864886f70d01010b050003820101006eb668d320d84b9f59d812e9a3068a34722825f733c6696c0c55284315bf3c20c42bbd426d0e3c7e8bd22e5247fd2fb804dfb86d9549d3d8c0cc3bc60b2a74915d6dd4261b511962038e61962c9f3616c2cc77b8a26a42a3fb7e0ac68780c1d56c862a7d5a3561ffb6e4ba1831aef8af3bf77ecfbba594f92f52dda9f651ccef81d9c48004c8994ae66f506f91bfe552ea3504799fda74b92e2345712f7d4ba41bbc8e749d3dd582086e6cdcf45bec67b1e4c561add6cf57efb1927ab416939f6f7a28f9d929ec6fd434b67b4a723a629be6304c57a5ecf2684dcc8a2b45356520917b928b2479bc6273dca8d697f9389947424e6d44a6cd7d2c8588bdf62250 SecurityService.exe -
Suspicious behavior: AddClipboardFormatListener 8 IoCs
pid Process 3052 Explorer.EXE 3052 Explorer.EXE 3052 Explorer.EXE 3052 Explorer.EXE 6532 EXCEL.EXE 3052 Explorer.EXE 3052 Explorer.EXE 3052 Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 4548 chrome.exe 4548 chrome.exe 4768 chrome.exe 4768 chrome.exe 1516 chrome.exe 1516 chrome.exe 2344 chrome.exe 2344 chrome.exe 4824 chrome.exe 4824 chrome.exe 4820 chrome.exe 4820 chrome.exe 3468 chrome.exe 3468 chrome.exe 4892 chrome.exe 4892 chrome.exe 1384 chrome.exe 1384 chrome.exe 5068 chrome.exe 5068 chrome.exe 1876 chrome.exe 1876 chrome.exe 960 chrome.exe 960 chrome.exe 2120 chrome.exe 2120 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 1680 chrome.exe 1680 chrome.exe 5024 chrome.exe 5024 chrome.exe 2240 chrome.exe 2240 chrome.exe 480 chrome.exe 480 chrome.exe 4060 MsiExec.exe 4060 MsiExec.exe 4060 MsiExec.exe 4060 MsiExec.exe 4060 MsiExec.exe 4060 MsiExec.exe -
Suspicious behavior: GetForegroundWindowSpam 7 IoCs
pid Process 3052 Explorer.EXE 1080 PCProtect_Setup.exe 4172 PowderRecorderCli.exe 4504 winzip64.exe 4556 @[email protected] 5824 taskmgr.exe 6148 OpenWith.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 660 Process not Found 660 Process not Found -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs
pid Process 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 5440 msedge.exe 5440 msedge.exe 5440 msedge.exe 5440 msedge.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 5444 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3804 taskmgr.exe Token: SeSystemProfilePrivilege 3804 taskmgr.exe Token: SeCreateGlobalPrivilege 3804 taskmgr.exe Token: 33 3804 taskmgr.exe Token: SeIncBasePriorityPrivilege 3804 taskmgr.exe Token: 33 5076 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 5076 AUDIODG.EXE Token: SeSecurityPrivilege 116 msiexec.exe Token: SeCreateTokenPrivilege 1520 winzip26-bing.exe Token: SeAssignPrimaryTokenPrivilege 1520 winzip26-bing.exe Token: SeLockMemoryPrivilege 1520 winzip26-bing.exe Token: SeIncreaseQuotaPrivilege 1520 winzip26-bing.exe Token: SeMachineAccountPrivilege 1520 winzip26-bing.exe Token: SeTcbPrivilege 1520 winzip26-bing.exe Token: SeSecurityPrivilege 1520 winzip26-bing.exe Token: SeTakeOwnershipPrivilege 1520 winzip26-bing.exe Token: SeLoadDriverPrivilege 1520 winzip26-bing.exe Token: SeSystemProfilePrivilege 1520 winzip26-bing.exe Token: SeSystemtimePrivilege 1520 winzip26-bing.exe Token: SeProfSingleProcessPrivilege 1520 winzip26-bing.exe Token: SeIncBasePriorityPrivilege 1520 winzip26-bing.exe Token: SeCreatePagefilePrivilege 1520 winzip26-bing.exe Token: SeCreatePermanentPrivilege 1520 winzip26-bing.exe Token: SeBackupPrivilege 1520 winzip26-bing.exe Token: SeRestorePrivilege 1520 winzip26-bing.exe Token: SeShutdownPrivilege 1520 winzip26-bing.exe Token: SeDebugPrivilege 1520 winzip26-bing.exe Token: SeAuditPrivilege 1520 winzip26-bing.exe Token: SeSystemEnvironmentPrivilege 1520 winzip26-bing.exe Token: SeChangeNotifyPrivilege 1520 winzip26-bing.exe Token: SeRemoteShutdownPrivilege 1520 winzip26-bing.exe Token: SeUndockPrivilege 1520 winzip26-bing.exe Token: SeSyncAgentPrivilege 1520 winzip26-bing.exe Token: SeEnableDelegationPrivilege 1520 winzip26-bing.exe Token: SeManageVolumePrivilege 1520 winzip26-bing.exe Token: SeImpersonatePrivilege 1520 winzip26-bing.exe Token: SeCreateGlobalPrivilege 1520 winzip26-bing.exe Token: SeShutdownPrivilege 1520 winzip26-bing.exe Token: SeIncreaseQuotaPrivilege 1520 winzip26-bing.exe Token: SeCreateTokenPrivilege 1520 winzip26-bing.exe Token: SeAssignPrimaryTokenPrivilege 1520 winzip26-bing.exe Token: SeLockMemoryPrivilege 1520 winzip26-bing.exe Token: SeIncreaseQuotaPrivilege 1520 winzip26-bing.exe Token: SeMachineAccountPrivilege 1520 winzip26-bing.exe Token: SeTcbPrivilege 1520 winzip26-bing.exe Token: SeSecurityPrivilege 1520 winzip26-bing.exe Token: SeTakeOwnershipPrivilege 1520 winzip26-bing.exe Token: SeLoadDriverPrivilege 1520 winzip26-bing.exe Token: SeSystemProfilePrivilege 1520 winzip26-bing.exe Token: SeSystemtimePrivilege 1520 winzip26-bing.exe Token: SeProfSingleProcessPrivilege 1520 winzip26-bing.exe Token: SeIncBasePriorityPrivilege 1520 winzip26-bing.exe Token: SeCreatePagefilePrivilege 1520 winzip26-bing.exe Token: SeCreatePermanentPrivilege 1520 winzip26-bing.exe Token: SeBackupPrivilege 1520 winzip26-bing.exe Token: SeRestorePrivilege 1520 winzip26-bing.exe Token: SeShutdownPrivilege 1520 winzip26-bing.exe Token: SeDebugPrivilege 1520 winzip26-bing.exe Token: SeAuditPrivilege 1520 winzip26-bing.exe Token: SeSystemEnvironmentPrivilege 1520 winzip26-bing.exe Token: SeChangeNotifyPrivilege 1520 winzip26-bing.exe Token: SeRemoteShutdownPrivilege 1520 winzip26-bing.exe Token: SeUndockPrivilege 1520 winzip26-bing.exe Token: SeSyncAgentPrivilege 1520 winzip26-bing.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 3804 taskmgr.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe -
Suspicious use of SetWindowsHookAW 8 IoCs
pid Process 804 winzip64.exe 5532 winzip64.exe 5316 winzip64.exe 4504 winzip64.exe 7040 winzip64.exe 5708 winzip64.exe 5260 winzip64.exe 6532 winzip64.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4960 SecuriteInfo.com.W32.AIDetect.malware2.21162.exe 4960 SecuriteInfo.com.W32.AIDetect.malware2.21162.exe 4960 SecuriteInfo.com.W32.AIDetect.malware2.21162.exe 804 winzip64.exe 804 winzip64.exe 5532 winzip64.exe 5532 winzip64.exe 3052 Explorer.EXE 3052 Explorer.EXE 5532 winzip64.exe 5532 winzip64.exe 5316 winzip64.exe 5316 winzip64.exe 5316 winzip64.exe 5316 winzip64.exe 3052 Explorer.EXE 3052 Explorer.EXE 3052 Explorer.EXE 5316 winzip64.exe 5316 winzip64.exe 5316 winzip64.exe 5316 winzip64.exe 3052 Explorer.EXE 3052 Explorer.EXE 3052 Explorer.EXE 3052 Explorer.EXE 3112 PCProtect.exe 3052 Explorer.EXE 4504 winzip64.exe 4504 winzip64.exe 4504 winzip64.exe 4504 winzip64.exe 3052 Explorer.EXE 3052 Explorer.EXE 4504 winzip64.exe 4504 winzip64.exe 4504 winzip64.exe 4504 winzip64.exe 4556 @[email protected] 4556 @[email protected] 3052 Explorer.EXE 6904 @[email protected] 7092 @[email protected] 3052 Explorer.EXE 3052 Explorer.EXE 3052 Explorer.EXE 6352 @[email protected] 3052 Explorer.EXE 3052 Explorer.EXE 3052 Explorer.EXE 2268 @[email protected] 3052 Explorer.EXE 3052 Explorer.EXE 3052 Explorer.EXE 3052 Explorer.EXE 3052 Explorer.EXE 3052 Explorer.EXE 3052 Explorer.EXE 3052 Explorer.EXE 3052 Explorer.EXE 3052 Explorer.EXE 440 @[email protected] 3052 Explorer.EXE 3052 Explorer.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4960 wrote to memory of 2404 4960 SecuriteInfo.com.W32.AIDetect.malware2.21162.exe 82 PID 4960 wrote to memory of 2404 4960 SecuriteInfo.com.W32.AIDetect.malware2.21162.exe 82 PID 4960 wrote to memory of 2404 4960 SecuriteInfo.com.W32.AIDetect.malware2.21162.exe 82 PID 4768 wrote to memory of 3544 4768 chrome.exe 86 PID 4768 wrote to memory of 3544 4768 chrome.exe 86 PID 4768 wrote to memory of 1472 4768 chrome.exe 87 PID 4768 wrote to memory of 1472 4768 chrome.exe 87 PID 4768 wrote to memory of 1472 4768 chrome.exe 87 PID 4768 wrote to memory of 1472 4768 chrome.exe 87 PID 4768 wrote to memory of 1472 4768 chrome.exe 87 PID 4768 wrote to memory of 1472 4768 chrome.exe 87 PID 4768 wrote to memory of 1472 4768 chrome.exe 87 PID 4768 wrote to memory of 1472 4768 chrome.exe 87 PID 4768 wrote to memory of 1472 4768 chrome.exe 87 PID 4768 wrote to memory of 1472 4768 chrome.exe 87 PID 4768 wrote to memory of 1472 4768 chrome.exe 87 PID 4768 wrote to memory of 1472 4768 chrome.exe 87 PID 4768 wrote to memory of 1472 4768 chrome.exe 87 PID 4768 wrote to memory of 1472 4768 chrome.exe 87 PID 4768 wrote to memory of 1472 4768 chrome.exe 87 PID 4768 wrote to memory of 1472 4768 chrome.exe 87 PID 4768 wrote to memory of 1472 4768 chrome.exe 87 PID 4768 wrote to memory of 1472 4768 chrome.exe 87 PID 4768 wrote to memory of 1472 4768 chrome.exe 87 PID 4768 wrote to memory of 1472 4768 chrome.exe 87 PID 4768 wrote to memory of 1472 4768 chrome.exe 87 PID 4768 wrote to memory of 1472 4768 chrome.exe 87 PID 4768 wrote to memory of 1472 4768 chrome.exe 87 PID 4768 wrote to memory of 1472 4768 chrome.exe 87 PID 4768 wrote to memory of 1472 4768 chrome.exe 87 PID 4768 wrote to memory of 1472 4768 chrome.exe 87 PID 4768 wrote to memory of 1472 4768 chrome.exe 87 PID 4768 wrote to memory of 1472 4768 chrome.exe 87 PID 4768 wrote to memory of 1472 4768 chrome.exe 87 PID 4768 wrote to memory of 1472 4768 chrome.exe 87 PID 4768 wrote to memory of 1472 4768 chrome.exe 87 PID 4768 wrote to memory of 1472 4768 chrome.exe 87 PID 4768 wrote to memory of 1472 4768 chrome.exe 87 PID 4768 wrote to memory of 1472 4768 chrome.exe 87 PID 4768 wrote to memory of 1472 4768 chrome.exe 87 PID 4768 wrote to memory of 1472 4768 chrome.exe 87 PID 4768 wrote to memory of 1472 4768 chrome.exe 87 PID 4768 wrote to memory of 1472 4768 chrome.exe 87 PID 4768 wrote to memory of 1472 4768 chrome.exe 87 PID 4768 wrote to memory of 1472 4768 chrome.exe 87 PID 4768 wrote to memory of 4548 4768 chrome.exe 88 PID 4768 wrote to memory of 4548 4768 chrome.exe 88 PID 4768 wrote to memory of 4428 4768 chrome.exe 89 PID 4768 wrote to memory of 4428 4768 chrome.exe 89 PID 4768 wrote to memory of 4428 4768 chrome.exe 89 PID 4768 wrote to memory of 4428 4768 chrome.exe 89 PID 4768 wrote to memory of 4428 4768 chrome.exe 89 PID 4768 wrote to memory of 4428 4768 chrome.exe 89 PID 4768 wrote to memory of 4428 4768 chrome.exe 89 PID 4768 wrote to memory of 4428 4768 chrome.exe 89 PID 4768 wrote to memory of 4428 4768 chrome.exe 89 PID 4768 wrote to memory of 4428 4768 chrome.exe 89 PID 4768 wrote to memory of 4428 4768 chrome.exe 89 PID 4768 wrote to memory of 4428 4768 chrome.exe 89 PID 4768 wrote to memory of 4428 4768 chrome.exe 89 PID 4768 wrote to memory of 4428 4768 chrome.exe 89 PID 4768 wrote to memory of 4428 4768 chrome.exe 89 PID 4768 wrote to memory of 4428 4768 chrome.exe 89 PID 4768 wrote to memory of 4428 4768 chrome.exe 89 -
Views/modifies file attributes 1 TTPs 7 IoCs
pid Process 7096 attrib.exe 5968 attrib.exe 4708 attrib.exe 3808 attrib.exe 6192 attrib.exe 2356 attrib.exe 4856 attrib.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetect.malware2.21162.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetect.malware2.21162.exe"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Users\Admin\AppData\Local\Temp\3⤵PID:2404
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /42⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3804
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffca2794f50,0x7ffca2794f60,0x7ffca2794f703⤵PID:3544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1624 /prefetch:23⤵PID:1472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1956 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:4548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2252 /prefetch:83⤵PID:4428
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2916 /prefetch:13⤵PID:364
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2896 /prefetch:13⤵PID:532
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3884 /prefetch:13⤵PID:3096
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4548 /prefetch:83⤵PID:2628
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4916 /prefetch:83⤵PID:1280
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4816 /prefetch:83⤵PID:3100
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5252 /prefetch:83⤵PID:3472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5276 /prefetch:83⤵PID:2540
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:1516
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5384 /prefetch:83⤵PID:1248
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4584 /prefetch:83⤵PID:1484
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:13⤵PID:1624
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:13⤵PID:2220
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2920 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:2344
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2900 /prefetch:13⤵PID:3236
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:13⤵PID:4092
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:13⤵PID:3340
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:83⤵PID:2172
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4584 /prefetch:83⤵PID:3388
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5360 /prefetch:83⤵PID:3220
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:13⤵PID:3376
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3856 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:4824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3920 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:4820
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3032 /prefetch:13⤵PID:3280
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=900 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:3468
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4872 /prefetch:13⤵PID:5076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:13⤵PID:3424
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:13⤵PID:1392
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4856 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:4892
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1104 /prefetch:13⤵PID:1928
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5244 /prefetch:83⤵PID:4056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:13⤵PID:3152
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:13⤵PID:1624
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:13⤵PID:2216
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:13⤵PID:3840
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:1384
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:13⤵PID:2612
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6176 /prefetch:13⤵PID:916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3956 /prefetch:13⤵PID:2308
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2488 /prefetch:83⤵PID:4520
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:13⤵PID:2296
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4616 /prefetch:13⤵PID:4840
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1520 /prefetch:13⤵PID:3860
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4616 /prefetch:13⤵PID:928
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:13⤵PID:4788
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:13⤵PID:3476
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:13⤵PID:4512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:13⤵PID:1120
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:13⤵PID:1028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6284 /prefetch:83⤵PID:4348
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4588 /prefetch:83⤵PID:3556
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6536 /prefetch:83⤵PID:3608
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6624 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:5068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=2620 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:1876
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5872 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5636 /prefetch:83⤵PID:1668
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3580 /prefetch:83⤵PID:2528
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:83⤵PID:4772
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4876 /prefetch:83⤵PID:2472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6608 /prefetch:13⤵PID:1124
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2488 /prefetch:83⤵PID:480
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6264 /prefetch:13⤵PID:2816
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:13⤵PID:1568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=68 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6752 /prefetch:13⤵PID:1712
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6756 /prefetch:13⤵PID:4536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3976 /prefetch:83⤵PID:4804
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1456 /prefetch:83⤵PID:928
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6864 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:2120
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6684 /prefetch:83⤵PID:1904
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6996 /prefetch:83⤵PID:3100
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6900 /prefetch:83⤵PID:2240
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6452 /prefetch:83⤵PID:3388
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=77 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:13⤵PID:2404
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=78 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:13⤵PID:3152
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=79 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7096 /prefetch:13⤵PID:1536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6168 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:4972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=81 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6772 /prefetch:13⤵PID:2036
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=82 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6876 /prefetch:13⤵PID:4048
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=83 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:13⤵PID:2008
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7220 /prefetch:83⤵PID:3912
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=85 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7124 /prefetch:13⤵PID:3284
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=86 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6992 /prefetch:13⤵PID:2132
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=87 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7492 /prefetch:13⤵PID:4796
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=88 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7060 /prefetch:13⤵PID:5108
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=89 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:13⤵PID:4932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=90 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6824 /prefetch:13⤵PID:3020
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=91 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6520 /prefetch:13⤵PID:364
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=92 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7496 /prefetch:13⤵PID:3380
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=93 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6980 /prefetch:13⤵PID:3716
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:1680
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5464 /prefetch:83⤵PID:1292
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7172 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:5024
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7152 /prefetch:83⤵PID:2584
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --disable-gpu-compositing --lang=en-US --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=98 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6964 /prefetch:13⤵PID:536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=99 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7652 /prefetch:13⤵PID:1860
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=100 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7124 /prefetch:13⤵PID:4044
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=101 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7472 /prefetch:13⤵PID:3192
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=102 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7308 /prefetch:13⤵PID:4600
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7924 /prefetch:83⤵PID:1236
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7956 /prefetch:83⤵PID:3556
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7884 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:2240
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8048 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:480
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=8084 /prefetch:83⤵PID:4892
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=8060 /prefetch:83⤵PID:1516
-
-
C:\Users\Admin\Downloads\winzip26-bing.exe"C:\Users\Admin\Downloads\winzip26-bing.exe"3⤵
- Executes dropped EXE
PID:260 -
C:\Users\Admin\AppData\Local\Temp\e59be84\winzip26-bing.exerun=1 shortcut="C:\Users\Admin\Downloads\winzip26-bing.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:1520
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7852 /prefetch:83⤵PID:5000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=110 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6192 /prefetch:13⤵PID:3216
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2320 /prefetch:83⤵PID:4252
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7504 /prefetch:83⤵PID:5728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7160 /prefetch:83⤵PID:3724
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4800 /prefetch:83⤵PID:5756
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --disable-gpu-compositing --lang=en-US --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=115 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:13⤵PID:5976
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=116 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8384 /prefetch:13⤵PID:548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1524,5571227426334592936,17368608752593675314,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=117 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7960 /prefetch:13⤵PID:5592
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.winzip.com/instcmplt.cgi?pid=WNZP&ver=26.0.15033.0&lang=en&osbits=64&vid=oemg&x-at=bing2⤵
- Adds Run key to start application
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:5440 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffca25546f8,0x7ffca2554708,0x7ffca25547183⤵PID:5400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,11421912426387285757,3835321922594497981,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:23⤵PID:1240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,11421912426387285757,3835321922594497981,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:33⤵PID:364
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,11421912426387285757,3835321922594497981,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:83⤵PID:388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11421912426387285757,3835321922594497981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:13⤵PID:4744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11421912426387285757,3835321922594497981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:13⤵PID:3460
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2080,11421912426387285757,3835321922594497981,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5184 /prefetch:83⤵PID:1680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11421912426387285757,3835321922594497981,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:13⤵PID:3628
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11421912426387285757,3835321922594497981,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:13⤵PID:6068
-
-
-
C:\Program Files\WinZip\winzip64.exe"C:\Program Files\WinZip\winzip64.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookAW
- Suspicious use of SetWindowsHookEx
PID:5532 -
C:\Program Files\WinZip\WzCABCacheSyncHelper64.exe"C:\Program Files\WinZip\WzCABCacheSyncHelper64.exe"3⤵
- Executes dropped EXE
PID:4276
-
-
-
C:\Program Files\WinZip\winzip64.exe"C:\Program Files\WinZip\winzip64.exe" "C:\Users\Admin\Downloads\ZwLoader.zip"2⤵
- Executes dropped EXE
- Checks computer location settings
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookAW
- Suspicious use of SetWindowsHookEx
PID:5316 -
C:\Program Files\WinZip\WzCABCacheSyncHelper64.exe"C:\Program Files\WinZip\WzCABCacheSyncHelper64.exe"3⤵
- Executes dropped EXE
PID:2364
-
-
C:\Users\Admin\Downloads\ZwLoader\ZwLoader.exe"C:\Users\Admin\Downloads\ZwLoader\ZwLoader.exe"3⤵
- Looks for VirtualBox Guest Additions in registry
- Executes dropped EXE
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
PID:5960
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /42⤵
- Checks SCSI registry key(s)
PID:5728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"2⤵PID:5564
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0x80,0x108,0x7ffca2794f50,0x7ffca2794f60,0x7ffca2794f703⤵PID:392
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"2⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:5444 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffca2794f50,0x7ffca2794f60,0x7ffca2794f703⤵PID:5144
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1628 /prefetch:23⤵PID:1768
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1996 /prefetch:83⤵PID:4996
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2756 /prefetch:13⤵PID:3784
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2464 /prefetch:83⤵PID:5352
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --lang=en-US --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2776 /prefetch:13⤵PID:5488
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:13⤵PID:3280
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4584 /prefetch:83⤵PID:5984
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:13⤵PID:5816
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:13⤵PID:5440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2972 /prefetch:83⤵PID:4932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3912 /prefetch:83⤵PID:4764
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2920 /prefetch:83⤵PID:1904
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:13⤵PID:6064
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2496 /prefetch:13⤵PID:5544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:13⤵PID:4980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:13⤵PID:4336
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:13⤵PID:5840
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4644 /prefetch:13⤵PID:960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:13⤵PID:5124
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5816 /prefetch:83⤵PID:4468
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:13⤵PID:3232
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:13⤵PID:1000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:13⤵PID:1376
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=888 /prefetch:83⤵PID:3212
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1604 /prefetch:13⤵PID:4052
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:13⤵PID:4576
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6560 /prefetch:13⤵PID:4092
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:13⤵PID:3048
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6400 /prefetch:13⤵PID:5040
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6408 /prefetch:13⤵PID:988
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1076 /prefetch:13⤵PID:1480
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:13⤵PID:6128
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6616 /prefetch:83⤵PID:2900
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6616 /prefetch:83⤵PID:1112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3632 /prefetch:83⤵PID:5620
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=976 /prefetch:83⤵PID:6004
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6616 /prefetch:13⤵PID:5140
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:13⤵PID:1992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5384 /prefetch:83⤵PID:1028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5552 /prefetch:83⤵PID:2200
-
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\102.286.200\software_reporter_tool.exe"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\102.286.200\software_reporter_tool.exe" --engine=2 --scan-locations=1,2,3,4,5,6,7,8,10 --disabled-locations=9,11 --session-id=bar61aL9B0cjXVzUU1M7nhAEe5SIxmVhNZY5DdeE --registry-suffix=ESET --enable-crash-reporting --srt-field-trial-group-name=Off3⤵
- Executes dropped EXE
PID:808 -
\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\102.286.200\software_reporter_tool.exe"c:\users\admin\appdata\local\google\chrome\user data\swreporter\102.286.200\software_reporter_tool.exe" --crash-handler "--database=c:\users\admin\appdata\local\Google\Software Reporter Tool" --url=https://clients2.google.com/cr/report --annotation=plat=Win32 --annotation=prod=ChromeFoil --annotation=ver=102.286.200 --initial-client-data=0x28c,0x290,0x294,0x268,0x298,0x7ff78de9ecc8,0x7ff78de9ecd8,0x7ff78de9ece84⤵
- Executes dropped EXE
PID:180
-
-
\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\102.286.200\software_reporter_tool.exe"c:\users\admin\appdata\local\google\chrome\user data\swreporter\102.286.200\software_reporter_tool.exe" --enable-crash-reporting --use-crash-handler-with-id="\\.\pipe\crashpad_808_BGOMNKPCIOGJJRJP" --sandboxed-process-id=2 --init-done-notifier=760 --sandbox-mojo-pipe-token=3661897917861546039 --mojo-platform-channel-handle=736 --engine=24⤵
- Executes dropped EXE
PID:4248
-
-
\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\102.286.200\software_reporter_tool.exe"c:\users\admin\appdata\local\google\chrome\user data\swreporter\102.286.200\software_reporter_tool.exe" --enable-crash-reporting --use-crash-handler-with-id="\\.\pipe\crashpad_808_BGOMNKPCIOGJJRJP" --sandboxed-process-id=3 --init-done-notifier=1000 --sandbox-mojo-pipe-token=9853554866268473617 --mojo-platform-channel-handle=9964⤵
- Executes dropped EXE
PID:5804
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6240 /prefetch:83⤵PID:2876
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3824 /prefetch:13⤵PID:4684
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:13⤵PID:4880
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1076 /prefetch:13⤵PID:364
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3596 /prefetch:13⤵PID:5156
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:13⤵PID:3532
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6968 /prefetch:83⤵PID:392
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5956 /prefetch:83⤵PID:5388
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2908 /prefetch:13⤵PID:5124
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7136 /prefetch:13⤵PID:4616
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6292 /prefetch:13⤵PID:4988
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6784 /prefetch:13⤵PID:2988
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5688 /prefetch:83⤵PID:532
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7080 /prefetch:13⤵PID:4728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6808 /prefetch:23⤵PID:1256
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6392 /prefetch:13⤵PID:684
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:13⤵PID:892
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:13⤵PID:5024
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6160 /prefetch:83⤵PID:3512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6160 /prefetch:13⤵PID:2900
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6364 /prefetch:13⤵PID:5620
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:13⤵PID:5588
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4064 /prefetch:13⤵PID:640
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6460 /prefetch:13⤵PID:224
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:13⤵PID:5904
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6768 /prefetch:13⤵PID:5884
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=68 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3920 /prefetch:13⤵PID:5276
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6840 /prefetch:13⤵PID:5212
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=70 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:13⤵PID:4972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=71 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7272 /prefetch:13⤵PID:2876
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=72 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6468 /prefetch:13⤵PID:5128
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=73 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7632 /prefetch:13⤵PID:1876
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=8048 /prefetch:83⤵PID:1936
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=8028 /prefetch:83⤵PID:4868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=76 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8356 /prefetch:13⤵PID:4880
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=77 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7736 /prefetch:13⤵PID:400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=78 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8608 /prefetch:13⤵PID:3140
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=79 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8820 /prefetch:13⤵PID:4692
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=80 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8920 /prefetch:13⤵PID:836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=81 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9076 /prefetch:13⤵PID:3468
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8244 /prefetch:83⤵PID:4920
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=8040 /prefetch:83⤵PID:1736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=8072 /prefetch:83⤵PID:3736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8272 /prefetch:83⤵PID:1332
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=86 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9388 /prefetch:13⤵PID:5732
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=87 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9464 /prefetch:13⤵PID:4900
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=88 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9276 /prefetch:13⤵PID:2388
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=89 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9772 /prefetch:13⤵PID:4392
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=90 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8972 /prefetch:13⤵PID:2144
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=91 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9036 /prefetch:13⤵PID:2820
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=92 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8908 /prefetch:13⤵PID:5040
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=93 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9548 /prefetch:13⤵PID:4636
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=94 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:13⤵PID:2916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=95 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6252 /prefetch:13⤵PID:4868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=96 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7208 /prefetch:13⤵PID:4120
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=97 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:13⤵PID:1820
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=98 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7220 /prefetch:13⤵PID:4912
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=100 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9900 /prefetch:13⤵PID:6080
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=99 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10052 /prefetch:13⤵PID:5056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=101 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8144 /prefetch:13⤵PID:4044
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=102 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10204 /prefetch:13⤵PID:1128
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=104 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10364 /prefetch:13⤵PID:3032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=103 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8844 /prefetch:13⤵PID:4000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=105 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10540 /prefetch:13⤵PID:5988
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=106 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7016 /prefetch:13⤵PID:4228
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=107 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10732 /prefetch:13⤵PID:5824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=108 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10908 /prefetch:13⤵PID:3740
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=110 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11088 /prefetch:13⤵PID:1000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=109 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10948 /prefetch:13⤵PID:5496
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=111 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11032 /prefetch:13⤵PID:6200
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=112 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11196 /prefetch:13⤵PID:6208
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=114 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11760 /prefetch:13⤵PID:6256
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=115 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11608 /prefetch:13⤵PID:6288
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=123 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12988 /prefetch:13⤵PID:6380
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=122 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12860 /prefetch:13⤵PID:6372
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=121 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12720 /prefetch:13⤵PID:6364
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=120 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12580 /prefetch:13⤵PID:6356
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=119 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12440 /prefetch:13⤵PID:6348
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=118 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12300 /prefetch:13⤵PID:6340
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=117 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12160 /prefetch:13⤵PID:6332
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=116 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11632 /prefetch:13⤵PID:6324
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=113 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11072 /prefetch:13⤵PID:6248
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=124 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=13488 /prefetch:13⤵PID:6908
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=125 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9124 /prefetch:13⤵PID:7004
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=126 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=13004 /prefetch:13⤵PID:7080
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=127 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8984 /prefetch:13⤵PID:7152
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=128 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8036 /prefetch:13⤵PID:5360
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=129 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8872 /prefetch:13⤵PID:1608
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=130 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9096 /prefetch:13⤵PID:1644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=131 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8408 /prefetch:13⤵PID:4416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=132 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7100 /prefetch:13⤵PID:1300
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=133 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7092 /prefetch:13⤵PID:5320
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=134 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10516 /prefetch:13⤵PID:5440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=135 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6184 /prefetch:13⤵PID:6276
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=136 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=13424 /prefetch:13⤵PID:6204
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=137 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:13⤵PID:5040
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=138 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10904 /prefetch:13⤵PID:5932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=140 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=13456 /prefetch:13⤵PID:5508
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=139 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:13⤵PID:5500
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=141 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9212 /prefetch:13⤵PID:864
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=142 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9388 /prefetch:13⤵PID:4804
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=143 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9736 /prefetch:13⤵PID:4540
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=144 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6992 /prefetch:13⤵PID:5112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=145 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11320 /prefetch:13⤵PID:1356
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=146 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=13356 /prefetch:13⤵PID:3272
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=147 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8356 /prefetch:13⤵PID:4872
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=148 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7660 /prefetch:13⤵PID:1608
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7248 /prefetch:83⤵PID:2528
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=9356 /prefetch:83⤵PID:4860
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=151 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9828 /prefetch:13⤵PID:1160
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=152 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6984 /prefetch:13⤵PID:4592
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=153 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:13⤵PID:5248
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=154 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12868 /prefetch:13⤵PID:3852
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=9012 /prefetch:83⤵PID:6360
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=12908 /prefetch:83⤵PID:3292
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=157 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8596 /prefetch:13⤵PID:6024
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=12912 /prefetch:83⤵PID:7060
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=13492 /prefetch:83⤵PID:4224
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=160 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8576 /prefetch:13⤵PID:3548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=161 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12924 /prefetch:13⤵PID:6884
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=162 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=13128 /prefetch:13⤵PID:3700
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=163 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12240 /prefetch:13⤵PID:6256
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6460 /prefetch:83⤵PID:3100
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7004 /prefetch:83⤵PID:4992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=9664 /prefetch:83⤵PID:1828
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=167 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9888 /prefetch:13⤵PID:6992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=168 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11456 /prefetch:13⤵PID:5608
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=169 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:13⤵PID:6240
-
-
C:\Users\Admin\Downloads\Powder-latest.exe"C:\Users\Admin\Downloads\Powder-latest.exe"3⤵PID:4520
-
C:\Windows\SysWOW64\cmd.execmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Powder.exe" | %SYSTEMROOT%\System32\find.exe "Powder.exe"4⤵PID:3700
-
C:\Windows\SysWOW64\find.exeC:\Windows\System32\find.exe "Powder.exe"5⤵PID:3096
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq Powder.exe"5⤵
- Enumerates processes with tasklist
PID:3744
-
-
-
C:\Users\Admin\AppData\Local\Temp\nst700.tmp\custom-installer.exeC:\Users\Admin\AppData\Local\Temp\nst700.tmp\custom-installer.exe --vcredist C:\Users\Admin\AppData\Local\Temp\nst700.tmp\vc_redist.x64.exe --app-id "gg.powder.desktop" --app-version "2.26.0" --install-folder "C:\Users\Admin\AppData\Local\Programs\powder-desktop"4⤵PID:6424
-
C:\Users\Admin\AppData\Local\Temp\nst700.tmp\vc_redist.x64.exeC:\Users\Admin\AppData\Local\Temp\nst700.tmp\vc_redist.x64.exe /q /norestart5⤵PID:6732
-
C:\Windows\Temp\{935EB077-FD82-497F-A3CA-1C11056CFE1A}\.cr\vc_redist.x64.exe"C:\Windows\Temp\{935EB077-FD82-497F-A3CA-1C11056CFE1A}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\nst700.tmp\vc_redist.x64.exe" -burn.filehandle.attached=536 -burn.filehandle.self=532 /q /norestart6⤵PID:7068
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=170 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11764 /prefetch:13⤵PID:6172
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=172 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9288 /prefetch:13⤵PID:6188
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=171 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=13316 /prefetch:13⤵PID:6156
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=173 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6980 /prefetch:13⤵PID:6480
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=175 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9940 /prefetch:13⤵PID:6952
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=176 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12596 /prefetch:13⤵PID:6948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=174 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6592 /prefetch:13⤵PID:6940
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=177 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10232 /prefetch:13⤵PID:6796
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=180 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9248 /prefetch:13⤵PID:1996
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=179 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11652 /prefetch:13⤵PID:4772
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=178 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8264 /prefetch:13⤵PID:2204
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=182 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9896 /prefetch:13⤵PID:6792
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=181 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12176 /prefetch:13⤵PID:6788
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=183 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6736 /prefetch:13⤵PID:7156
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=184 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=13976 /prefetch:13⤵PID:3076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=185 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11316 /prefetch:13⤵PID:6524
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=186 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:13⤵PID:6908
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=187 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9680 /prefetch:13⤵PID:4416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=189 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11796 /prefetch:13⤵PID:2900
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=188 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8580 /prefetch:13⤵PID:1384
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=190 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12520 /prefetch:13⤵PID:1584
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=193 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9024 /prefetch:13⤵PID:5952
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=192 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12492 /prefetch:13⤵PID:1776
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=191 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12528 /prefetch:13⤵PID:2820
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=194 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12044 /prefetch:13⤵PID:7148
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=195 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=14068 /prefetch:13⤵PID:5064
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=196 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=14236 /prefetch:13⤵PID:3144
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=197 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11380 /prefetch:13⤵PID:2264
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=198 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=14300 /prefetch:13⤵PID:4888
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=199 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12476 /prefetch:13⤵PID:908
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=200 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10420 /prefetch:13⤵PID:2148
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=201 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11600 /prefetch:13⤵PID:3100
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=202 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:13⤵PID:5164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=203 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6892 /prefetch:13⤵PID:5616
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=204 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=14056 /prefetch:13⤵PID:220
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=205 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6436 /prefetch:13⤵PID:4380
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=206 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8848 /prefetch:13⤵PID:6768
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=207 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8260 /prefetch:13⤵PID:400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=210 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9024 /prefetch:13⤵PID:5368
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=209 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11348 /prefetch:13⤵PID:768
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=208 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10496 /prefetch:13⤵PID:1664
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=211 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=14184 /prefetch:13⤵PID:5312
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=212 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6360 /prefetch:13⤵PID:2204
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=213 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:13⤵PID:6880
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=214 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8604 /prefetch:13⤵PID:4052
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=215 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=14216 /prefetch:13⤵PID:2336
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=216 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8532 /prefetch:13⤵PID:6648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=217 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10488 /prefetch:13⤵PID:6968
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=218 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:13⤵PID:1188
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=219 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:13⤵PID:116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=220 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4520 /prefetch:13⤵PID:3532
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=221 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8488 /prefetch:13⤵PID:6676
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=222 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:13⤵PID:7004
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=223 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=13140 /prefetch:13⤵PID:5848
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=224 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8568 /prefetch:13⤵PID:6304
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=225 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9176 /prefetch:13⤵PID:3784
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=9684 /prefetch:83⤵PID:6920
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=10208 /prefetch:83⤵PID:6912
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=9336 /prefetch:83⤵PID:5064
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=9680 /prefetch:83⤵PID:2132
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=13568 /prefetch:83⤵PID:2516
-
-
C:\Users\Admin\Downloads\PCProtect_Setup.exe"C:\Users\Admin\Downloads\PCProtect_Setup.exe"3⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
PID:1080 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe path Win32_Process where executablepath="C:\\Program Files (x86)\\PCProtect\\PCProtect.exe" delete4⤵PID:1804
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill" /f /T /IM "avupdate.exe"4⤵
- Kills process with taskkill
PID:6948
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill" /f /T /IM "Update.Win.exe"4⤵
- Kills process with taskkill
PID:2900
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill" /f /T /IM "PasswordExtension.Win.exe"4⤵
- Kills process with taskkill
PID:7060
-
-
C:\Program Files (x86)\PCProtect\SecurityService.exe"C:\Program Files (x86)\PCProtect\SecurityService.exe" "--install"4⤵
- Drops file in Drivers directory
PID:4568 -
C:\Windows\SysWOW64\sc.exe"sc" create SecurityService start= auto binpath= "\"C:\Program Files (x86)\PCProtect\SecurityService.exe\"" displayname= "PC Security Management Service" obj= LocalSystem password= ""5⤵
- Launches sc.exe
PID:4676
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4568 -s 43765⤵
- Program crash
PID:1940
-
-
-
C:\Program Files (x86)\PCProtect\PCProtect.exe"C:\Program Files (x86)\PCProtect\PCProtect.exe" --installed --installer="C:\Users\Admin\Downloads\PCProtect_Setup.exe"4⤵
- Registers COM server for autorun
- Suspicious use of SetWindowsHookEx
PID:3112 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.pcprotect.com/video?logintoken=NzdkNzI4MTUtNmZkNy00NDcyLWE0NGYtODA4MzJkOGY3NzcwXzE2NTgxMjc0MzFAcHJvdGVjdGVkLXNpZ251cC5jb206MmMxNzhlMzgyNjcyODBhYzVkNWI5MDUyYzBmYzM4M2Q2OTE5NzA1YzpmY2NmMmVlZTI3MmZiZGQzZDcxOGZmNmNmMjJhMmZlZDg0NmQ5ODRlMDAyMDAyZjAyMzJlNzNkM2EwMWNlNWE3OjU1NjU4MTM0&source=WIN_GUIV2_CREATED_ACCOUNT&action=NONE&sourceGroup=win-app5⤵
- Adds Run key to start application
- Enumerates system info in registry
PID:6528 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x40,0xe4,0xdc,0xe0,0x108,0x7ffca2e746f8,0x7ffca2e74708,0x7ffca2e747186⤵PID:1936
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,11969685418901645053,18439074009427313132,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2280 /prefetch:26⤵PID:2340
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,11969685418901645053,18439074009427313132,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2700 /prefetch:36⤵PID:2192
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,11969685418901645053,18439074009427313132,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3108 /prefetch:86⤵PID:5308
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,11969685418901645053,18439074009427313132,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3788 /prefetch:16⤵PID:6640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,11969685418901645053,18439074009427313132,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3796 /prefetch:16⤵PID:6800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2180,11969685418901645053,18439074009427313132,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4196 /prefetch:86⤵PID:1648
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://secure.pcprotect.com/?logintoken=NzdkNzI4MTUtNmZkNy00NDcyLWE0NGYtODA4MzJkOGY3NzcwXzE2NTgxMjc0MzFAcHJvdGVjdGVkLXNpZ251cC5jb206MmMxNzhlMzgyNjcyODBhYzVkNWI5MDUyYzBmYzM4M2Q2OTE5NzA1YzpmY2NmMmVlZTI3MmZiZGQzZDcxOGZmNmNmMjJhMmZlZDg0NmQ5ODRlMDAyMDAyZjAyMzJlNzNkM2EwMWNlNWE3OjU1NjU4MTM0&source=WIN_GUIV2_FREE_EDITION_REALTIME_ENABLE_ATTEMPT&action=NONE&sourceGroup=win-app&plan=RTP5⤵
- Adds Run key to start application
- Enumerates system info in registry
PID:4612 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffca2e746f8,0x7ffca2e74708,0x7ffca2e747186⤵PID:5124
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2508,13700991955992704806,17898664797280352646,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:26⤵PID:6628
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2508,13700991955992704806,17898664797280352646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2772 /prefetch:36⤵PID:6908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2508,13700991955992704806,17898664797280352646,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3120 /prefetch:86⤵PID:6816
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2508,13700991955992704806,17898664797280352646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3680 /prefetch:16⤵PID:528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2508,13700991955992704806,17898664797280352646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3700 /prefetch:16⤵PID:4604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2508,13700991955992704806,17898664797280352646,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4156 /prefetch:86⤵PID:4764
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=231 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=13304 /prefetch:13⤵PID:4384
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=232 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4520 /prefetch:13⤵PID:6940
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=233 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=13140 /prefetch:13⤵PID:3100
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=234 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2760 /prefetch:13⤵PID:7144
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=235 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=13472 /prefetch:13⤵PID:4244
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=12236 /prefetch:83⤵PID:2432
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=237 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12272 /prefetch:13⤵PID:6064
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=8520 /prefetch:83⤵PID:5884
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=12948 /prefetch:83⤵PID:624
-
-
C:\Program Files\WinZip\winzip64.exe"C:\Program Files\WinZip\winzip64.exe" "C:\Users\Admin\Downloads\WannaCry-main.zip"3⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookAW
- Suspicious use of SetWindowsHookEx
PID:4504 -
C:\Program Files\WinZip\WzCABCacheSyncHelper64.exe"C:\Program Files\WinZip\WzCABCacheSyncHelper64.exe"4⤵PID:5680
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\WannaCry.EXE"C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\WannaCry.EXE"4⤵
- Modifies extensions of user files
- Drops startup file
- Sets desktop wallpaper using registry
PID:5880 -
C:\Windows\SysWOW64\icacls.exeicacls . /grant Everyone:F /T /C /Q5⤵
- Modifies file permissions
PID:2292
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h .5⤵
- Views/modifies file attributes
PID:7096
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exetaskdl.exe5⤵PID:1408
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 270491658127690.bat5⤵PID:4460
-
C:\Windows\SysWOW64\cscript.execscript.exe //nologo m.vbs6⤵PID:3496
-
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exetaskdl.exe5⤵PID:4648
-
-
C:\Windows\SysWOW64\cmd.exePID:1476
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]PID:7092
-
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]PID:6904
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exePID:3636
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]PID:6352
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "pivepxpsij972" /t REG_SZ /d "\"C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\tasksche.exe\"" /f5⤵PID:6092
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "pivepxpsij972" /t REG_SZ /d "\"C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\tasksche.exe\"" /f6⤵
- Adds Run key to start application
- Modifies registry key
PID:6784
-
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exetaskdl.exe5⤵PID:2356
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exetaskdl.exe5⤵PID:2292
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]PID:2268
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exePID:5164
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]PID:440
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exePID:5080
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exetaskdl.exe5⤵PID:5868
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exePID:6176
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]PID:3124
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exetaskdl.exe5⤵PID:6520
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exePID:5756
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]PID:5716
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exetaskdl.exe5⤵PID:5404
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]PID:4608
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exePID:6724
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exetaskdl.exe5⤵PID:4508
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]PID:4416
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exePID:5540
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exetaskdl.exe5⤵PID:6044
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]PID:3152
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exePID:5292
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exetaskdl.exe5⤵PID:1236
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exePID:3264
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]PID:6436
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exetaskdl.exe5⤵PID:1936
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]PID:4484
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exePID:1992
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exetaskdl.exe5⤵PID:7000
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]PID:4832
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exePID:5408
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exetaskdl.exe5⤵PID:7048
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exePID:7120
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]PID:6992
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exetaskdl.exe5⤵PID:6232
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]PID:6632
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exePID:2156
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exetaskdl.exe5⤵PID:3552
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]PID:4276
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exePID:3612
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exetaskdl.exe5⤵PID:6748
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exePID:5468
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]PID:6976
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exetaskdl.exe5⤵PID:1696
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exePID:7024
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]PID:908
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exetaskdl.exe5⤵PID:5080
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exePID:6696
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]PID:6700
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exetaskdl.exe5⤵PID:704
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exePID:2088
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]PID:1400
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exetaskdl.exe5⤵PID:2156
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]PID:4912
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exePID:7036
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exetaskdl.exe5⤵PID:2624
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]PID:6612
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exePID:4052
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exetaskdl.exe5⤵PID:3648
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exePID:4708
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵PID:928
-
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]PID:6136
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exetaskdl.exe5⤵PID:1812
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]PID:2356
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exePID:5100
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskdl.exetaskdl.exe5⤵PID:6900
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\taskse.exePID:1388
-
-
C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]PID:4736
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\WannaCry-main\WannaCry-main\@[email protected]4⤵PID:1332
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=13192 /prefetch:83⤵PID:7144
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=241 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8224 /prefetch:13⤵PID:3284
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=242 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10364 /prefetch:13⤵PID:5580
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-databases --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=243 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2112 /prefetch:13⤵PID:6520
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-databases --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=244 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8584 /prefetch:13⤵PID:7036
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-databases --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=245 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:13⤵PID:6388
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5956 /prefetch:83⤵PID:5436
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=247 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:13⤵PID:3636
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=248 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8616 /prefetch:13⤵PID:5204
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=249 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9572 /prefetch:13⤵PID:364
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=250 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=14088 /prefetch:13⤵PID:892
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,5829662426911789161,11102339763090192611,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=251 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8412 /prefetch:13⤵PID:4108
-
-
-
C:\Program Files (x86)\PCProtect\PCProtect.exe"C:\Program Files (x86)\PCProtect\PCProtect.exe"2⤵PID:6428
-
-
C:\Users\Admin\AppData\Local\Programs\powder-desktop\Powder.exe"C:\Users\Admin\AppData\Local\Programs\powder-desktop\Powder.exe"2⤵
- Checks computer location settings
- Adds Run key to start application
- Checks processor information in registry
PID:6248 -
C:\Users\Admin\AppData\Local\Programs\powder-desktop\Powder.exe"C:\Users\Admin\AppData\Local\Programs\powder-desktop\Powder.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\powder-desktop" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1660 --field-trial-handle=1716,i,1238844316018624848,113751115895396882,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:23⤵PID:4148
-
-
C:\Users\Admin\AppData\Local\Programs\powder-desktop\Powder.exe"C:\Users\Admin\AppData\Local\Programs\powder-desktop\Powder.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\powder-desktop" --mojo-platform-channel-handle=2000 --field-trial-handle=1716,i,1238844316018624848,113751115895396882,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:83⤵PID:3160
-
-
C:\Users\Admin\AppData\Local\Programs\powder-desktop\PowderRecorderCli.exe./PowderRecorderCli.exe3⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:4172
-
-
C:\Users\Admin\AppData\Local\Programs\powder-desktop\Powder.exe"C:\Users\Admin\AppData\Local\Programs\powder-desktop\Powder.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\powder-desktop" --app-user-model-id=gg.powder.desktop --app-path="C:\Users\Admin\AppData\Local\Programs\powder-desktop\resources\app.asar" --no-sandbox --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --mojo-platform-channel-handle=3236 --field-trial-handle=1716,i,1238844316018624848,113751115895396882,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:13⤵
- Checks computer location settings
PID:1004
-
-
C:\Users\Admin\AppData\Local\Programs\powder-desktop\Powder.exe"C:\Users\Admin\AppData\Local\Programs\powder-desktop\Powder.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\powder-desktop" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=780 --field-trial-handle=1716,i,1238844316018624848,113751115895396882,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:23⤵PID:6024
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /42⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
PID:1288
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /42⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: GetForegroundWindowSpam
PID:5824
-
-
C:\Users\Admin\Desktop\@[email protected]"C:\Users\Admin\Desktop\@[email protected]"2⤵
- Sets desktop wallpaper using registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4556
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe"2⤵PID:5884
-
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Music\ResumeApprove.jfif" /ForceBootstrapPaint3D2⤵PID:4808
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Music\UndoImport.xla"2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
PID:6532
-
-
C:\ZwLoader\VAC.exe"C:\ZwLoader\VAC.exe"2⤵PID:3740
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"2⤵
- Enumerates system info in registry
PID:2856 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x100,0x104,0x108,0xd8,0x10c,0x7ffca2794f50,0x7ffca2794f60,0x7ffca2794f703⤵PID:3032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1580,6883771629270540781,12542406400687283221,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1592 /prefetch:23⤵PID:3484
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1580,6883771629270540781,12542406400687283221,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2012 /prefetch:83⤵PID:3644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1580,6883771629270540781,12542406400687283221,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2444 /prefetch:83⤵PID:3732
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1580,6883771629270540781,12542406400687283221,131072 --lang=en-US --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2944 /prefetch:13⤵PID:5520
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1580,6883771629270540781,12542406400687283221,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2928 /prefetch:13⤵PID:3128
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1580,6883771629270540781,12542406400687283221,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3576 /prefetch:13⤵PID:1772
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1580,6883771629270540781,12542406400687283221,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4504 /prefetch:83⤵PID:4544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1580,6883771629270540781,12542406400687283221,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3576 /prefetch:83⤵PID:2288
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1580,6883771629270540781,12542406400687283221,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3656 /prefetch:13⤵PID:5336
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1580,6883771629270540781,12542406400687283221,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:13⤵PID:5184
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1580,6883771629270540781,12542406400687283221,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3236 /prefetch:83⤵PID:5580
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1580,6883771629270540781,12542406400687283221,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:13⤵PID:1884
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1580,6883771629270540781,12542406400687283221,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3824 /prefetch:13⤵PID:5244
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1580,6883771629270540781,12542406400687283221,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:13⤵PID:1624
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1580,6883771629270540781,12542406400687283221,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:13⤵PID:5684
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1580,6883771629270540781,12542406400687283221,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3076 /prefetch:13⤵PID:6844
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"2⤵
- Enumerates system info in registry
PID:5540 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffca2794f50,0x7ffca2794f60,0x7ffca2794f703⤵PID:2736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1608,12274100893667350810,14579566872038565088,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1620 /prefetch:23⤵PID:4728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1608,12274100893667350810,14579566872038565088,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2040 /prefetch:83⤵PID:5804
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1608,12274100893667350810,14579566872038565088,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2440 /prefetch:83⤵PID:6528
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,12274100893667350810,14579566872038565088,131072 --lang=en-US --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2928 /prefetch:13⤵PID:7120
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,12274100893667350810,14579566872038565088,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2908 /prefetch:13⤵PID:2260
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,12274100893667350810,14579566872038565088,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4928 /prefetch:83⤵PID:3740
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,12274100893667350810,14579566872038565088,131072 --disable-databases --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3844 /prefetch:13⤵PID:6444
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,12274100893667350810,14579566872038565088,131072 --disable-databases --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:13⤵PID:5280
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,12274100893667350810,14579566872038565088,131072 --disable-databases --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3048 /prefetch:13⤵PID:6616
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1608,12274100893667350810,14579566872038565088,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:83⤵PID:6452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,12274100893667350810,14579566872038565088,131072 --disable-databases --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:13⤵PID:4216
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1608,12274100893667350810,14579566872038565088,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5044 /prefetch:83⤵PID:6984
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,12274100893667350810,14579566872038565088,131072 --disable-databases --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:13⤵PID:4932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,12274100893667350810,14579566872038565088,131072 --disable-databases --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:13⤵PID:6856
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,12274100893667350810,14579566872038565088,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:13⤵PID:404
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,12274100893667350810,14579566872038565088,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:13⤵PID:5832
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,12274100893667350810,14579566872038565088,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:13⤵PID:5288
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,12274100893667350810,14579566872038565088,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:13⤵PID:6780
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,12274100893667350810,14579566872038565088,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3128 /prefetch:13⤵PID:6336
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,12274100893667350810,14579566872038565088,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3124 /prefetch:13⤵PID:4472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,12274100893667350810,14579566872038565088,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:13⤵PID:6504
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,12274100893667350810,14579566872038565088,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:13⤵PID:6276
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,12274100893667350810,14579566872038565088,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:13⤵PID:5760
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1608,12274100893667350810,14579566872038565088,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6164 /prefetch:83⤵PID:4056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,12274100893667350810,14579566872038565088,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1532 /prefetch:13⤵PID:3776
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,12274100893667350810,14579566872038565088,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6396 /prefetch:13⤵PID:5924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,12274100893667350810,14579566872038565088,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6180 /prefetch:13⤵PID:2464
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1608,12274100893667350810,14579566872038565088,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 /prefetch:83⤵PID:1344
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,12274100893667350810,14579566872038565088,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:13⤵PID:6420
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1608,12274100893667350810,14579566872038565088,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6276 /prefetch:83⤵PID:6616
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1608,12274100893667350810,14579566872038565088,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7036 /prefetch:83⤵PID:4060
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1608,12274100893667350810,14579566872038565088,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2312 /prefetch:83⤵PID:972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1608,12274100893667350810,14579566872038565088,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3320 /prefetch:83⤵PID:3552
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1608,12274100893667350810,14579566872038565088,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7064 /prefetch:83⤵PID:404
-
-
C:\Program Files\WinZip\winzip64.exe"C:\Program Files\WinZip\winzip64.exe" "C:\Users\Admin\Downloads\CSGhost-v4.rar"3⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookAW
PID:7040 -
C:\Program Files\WinZip\WzCABCacheSyncHelper64.exe"C:\Program Files\WinZip\WzCABCacheSyncHelper64.exe"4⤵PID:1520
-
-
C:\Users\Admin\Downloads\CSGhost-v4.exe"C:\Users\Admin\Downloads\CSGhost-v4.exe"4⤵PID:1176
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,12274100893667350810,14579566872038565088,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4860 /prefetch:83⤵PID:5300
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1608,12274100893667350810,14579566872038565088,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6628 /prefetch:23⤵PID:2944
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,12274100893667350810,14579566872038565088,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:13⤵PID:6124
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,12274100893667350810,14579566872038565088,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6932 /prefetch:13⤵PID:5956
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,12274100893667350810,14579566872038565088,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6208 /prefetch:13⤵PID:1796
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,12274100893667350810,14579566872038565088,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4828 /prefetch:83⤵PID:1656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=patch.mojom.FilePatcher --field-trial-handle=1608,12274100893667350810,14579566872038565088,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6840 /prefetch:83⤵PID:4596
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=patch.mojom.FilePatcher --field-trial-handle=1608,12274100893667350810,14579566872038565088,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6640 /prefetch:83⤵PID:4448
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=patch.mojom.FilePatcher --field-trial-handle=1608,12274100893667350810,14579566872038565088,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7268 /prefetch:83⤵PID:5156
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,12274100893667350810,14579566872038565088,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6884 /prefetch:13⤵PID:2292
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,12274100893667350810,14579566872038565088,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7184 /prefetch:13⤵PID:2856
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,12274100893667350810,14579566872038565088,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6848 /prefetch:13⤵PID:6164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1608,12274100893667350810,14579566872038565088,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2212 /prefetch:83⤵PID:7036
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,12274100893667350810,14579566872038565088,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6544 /prefetch:13⤵PID:5872
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1608,12274100893667350810,14579566872038565088,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7572 /prefetch:83⤵PID:1088
-
-
C:\Program Files\WinZip\winzip64.exe"C:\Program Files\WinZip\winzip64.exe" "C:\Users\Admin\Downloads\RANSOMWARE-WANNACRY-2.0-master.zip"3⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookAW
PID:5708 -
C:\Program Files\WinZip\WzCABCacheSyncHelper64.exe"C:\Program Files\WinZip\WzCABCacheSyncHelper64.exe"4⤵PID:932
-
-
-
C:\Program Files\WinZip\winzip64.exe"C:\Program Files\WinZip\winzip64.exe" "C:\Users\Admin\Downloads\RANSOMWARE-WANNACRY-2.0-master.zip"3⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookAW
PID:5260 -
C:\Program Files\WinZip\WzCABCacheSyncHelper64.exe"C:\Program Files\WinZip\WzCABCacheSyncHelper64.exe"4⤵PID:4672
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,12274100893667350810,14579566872038565088,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:13⤵PID:4264
-
-
-
C:\Users\Admin\Desktop\CSGhost-v4.exe"C:\Users\Admin\Desktop\CSGhost-v4.exe"2⤵PID:5176
-
-
C:\Program Files (x86)\PCProtect\PCProtect.exe"C:\Program Files (x86)\PCProtect\PCProtect.exe" --custom-scan-context --custom-scan-archives --custom-scan-files="C:\Users\Admin\Desktop\CSGhost-v4.exe" --hide2⤵PID:6504
-
-
C:\Program Files\WinZip\winzip64.exe"C:\Program Files\WinZip\winzip64.exe" "C:\Users\Admin\Downloads\RANSOMWARE-WANNACRY-2.0-master\RANSOMWARE-WANNACRY-2.0-master\Ransomware.WannaCry.zip"2⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookAW
PID:6532 -
C:\Program Files\WinZip\WzCABCacheSyncHelper64.exe"C:\Program Files\WinZip\WzCABCacheSyncHelper64.exe"3⤵PID:1804
-
-
C:\Program Files\WinZip\WzWipe32.exe"C:\Program Files\WinZip\WzWipe32.exe" "C:\Users\Admin\AppData\Local\Temp\wzd406" /nWinZip3⤵PID:1524
-
-
-
C:\Program Files (x86)\PCProtect\PCProtect.exe"C:\Program Files (x86)\PCProtect\PCProtect.exe" --custom-scan-context --custom-scan-archives --custom-scan-files="C:\Users\Admin\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" --hide2⤵PID:1736
-
-
C:\Users\Admin\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"C:\Users\Admin\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"2⤵PID:6708
-
C:\Windows\SysWOW64\attrib.exeattrib +h .3⤵
- Views/modifies file attributes
PID:5968 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:6136
-
-
-
C:\Windows\SysWOW64\icacls.exeicacls . /grant Everyone:F /T /C /Q3⤵
- Modifies file permissions
PID:928
-
-
-
C:\Users\Admin\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"C:\Users\Admin\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"2⤵PID:5768
-
C:\Windows\SysWOW64\icacls.exeicacls . /grant Everyone:F /T /C /Q3⤵
- Modifies file permissions
PID:4128
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h .3⤵
- Views/modifies file attributes
PID:4708
-
-
-
C:\Users\Admin\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"C:\Users\Admin\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"2⤵PID:6708
-
C:\Windows\SysWOW64\icacls.exeicacls . /grant Everyone:F /T /C /Q3⤵
- Modifies file permissions
PID:1112
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h .3⤵
- Views/modifies file attributes
PID:3808
-
-
-
C:\Users\Admin\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"C:\Users\Admin\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"2⤵PID:3396
-
C:\Windows\SysWOW64\icacls.exeicacls . /grant Everyone:F /T /C /Q3⤵
- Modifies file permissions
PID:5332
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h .3⤵
- Views/modifies file attributes
PID:2356
-
-
-
C:\Users\Admin\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"C:\Users\Admin\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"2⤵PID:6900
-
C:\Windows\SysWOW64\icacls.exeicacls . /grant Everyone:F /T /C /Q3⤵
- Modifies file permissions
PID:3280
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h .3⤵
- Views/modifies file attributes
PID:6192
-
-
-
C:\Users\Admin\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"C:\Users\Admin\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"2⤵PID:448
-
C:\Windows\SysWOW64\icacls.exeicacls . /grant Everyone:F /T /C /Q3⤵
- Modifies file permissions
PID:4128
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h .3⤵
- Views/modifies file attributes
PID:4856
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /42⤵PID:4856
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3460
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x40c 0x33c1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5076
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"1⤵PID:2424
-
C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir2424_1845389723\ChromeRecovery.exe"C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir2424_1845389723\ChromeRecovery.exe" --appguid={8A69D345-D564-463c-AFF1-A69D9E530F96} --browser-version=89.0.4389.114 --sessionid={fd001846-9245-4a4d-ac8c-461bc36da8f6} --system2⤵
- Executes dropped EXE
PID:4000
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1160
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Modifies system executable filetype association
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:116 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:4264
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A70ABAC2853BF1C34C609760AAE66E6A2⤵
- Loads dropped DLL
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\{01014416-0FD7-4A0F-AB45-C50E6225EFAD}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{01014416-0FD7-4A0F-AB45-C50E6225EFAD}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DB926FDC-2495-4052-8A37-E5D04A15F3DB}3⤵
- Executes dropped EXE
PID:2076
-
-
C:\Users\Admin\AppData\Local\Temp\{01014416-0FD7-4A0F-AB45-C50E6225EFAD}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{01014416-0FD7-4A0F-AB45-C50E6225EFAD}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{55FE02C4-DC91-4CED-9EDD-B3E6D76CE618}3⤵
- Executes dropped EXE
PID:5088
-
-
C:\Users\Admin\AppData\Local\Temp\{01014416-0FD7-4A0F-AB45-C50E6225EFAD}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{01014416-0FD7-4A0F-AB45-C50E6225EFAD}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7C7545F9-0411-4E55-8F98-B3B15BF7E781}3⤵
- Executes dropped EXE
PID:2724
-
-
C:\Users\Admin\AppData\Local\Temp\{01014416-0FD7-4A0F-AB45-C50E6225EFAD}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{01014416-0FD7-4A0F-AB45-C50E6225EFAD}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{850D33F1-3DB1-4942-9471-A57ED9F66177}3⤵
- Executes dropped EXE
PID:2704
-
-
C:\Users\Admin\AppData\Local\Temp\{01014416-0FD7-4A0F-AB45-C50E6225EFAD}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{01014416-0FD7-4A0F-AB45-C50E6225EFAD}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FFECB41B-8CEF-448F-A669-FB00C34582D0}3⤵
- Executes dropped EXE
PID:3924
-
-
C:\Users\Admin\AppData\Local\Temp\{01014416-0FD7-4A0F-AB45-C50E6225EFAD}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{01014416-0FD7-4A0F-AB45-C50E6225EFAD}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8A3D7CB4-FF6E-40D3-9431-C8A63092B9A0}3⤵
- Executes dropped EXE
PID:828
-
-
C:\Users\Admin\AppData\Local\Temp\{01014416-0FD7-4A0F-AB45-C50E6225EFAD}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{01014416-0FD7-4A0F-AB45-C50E6225EFAD}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6E0A6474-7180-4357-A432-4B23B8D15DDB}3⤵
- Executes dropped EXE
PID:3460
-
-
C:\Users\Admin\AppData\Local\Temp\{01014416-0FD7-4A0F-AB45-C50E6225EFAD}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{01014416-0FD7-4A0F-AB45-C50E6225EFAD}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6A6F79CA-46C2-43C6-8FE9-2F2214B18080}3⤵
- Executes dropped EXE
PID:2628
-
-
C:\Users\Admin\AppData\Local\Temp\{01014416-0FD7-4A0F-AB45-C50E6225EFAD}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{01014416-0FD7-4A0F-AB45-C50E6225EFAD}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D85ACBA5-C7FC-4EB5-8EC9-B573BCA09651}3⤵
- Executes dropped EXE
PID:3204
-
-
C:\Users\Admin\AppData\Local\Temp\{01014416-0FD7-4A0F-AB45-C50E6225EFAD}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{01014416-0FD7-4A0F-AB45-C50E6225EFAD}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{93794825-D128-4241-8864-1EB783825FED}3⤵
- Executes dropped EXE
PID:2036
-
-
C:\Users\Admin\AppData\Local\Temp\{7B7A6008-1AF5-4152-A234-63159C18D0C4}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{7B7A6008-1AF5-4152-A234-63159C18D0C4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9436F9E1-FFC3-48BF-BBC3-8655C5DF3AC8}3⤵
- Executes dropped EXE
PID:2076
-
-
C:\Users\Admin\AppData\Local\Temp\{7B7A6008-1AF5-4152-A234-63159C18D0C4}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{7B7A6008-1AF5-4152-A234-63159C18D0C4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{AC76CBDD-6BF9-4E4F-94F5-BB9B6B123E56}3⤵
- Executes dropped EXE
PID:5088
-
-
C:\Users\Admin\AppData\Local\Temp\{7B7A6008-1AF5-4152-A234-63159C18D0C4}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{7B7A6008-1AF5-4152-A234-63159C18D0C4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{10FB2375-A9D3-409E-8655-AAB7D1BAFD63}3⤵
- Executes dropped EXE
PID:444
-
-
C:\Users\Admin\AppData\Local\Temp\{7B7A6008-1AF5-4152-A234-63159C18D0C4}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{7B7A6008-1AF5-4152-A234-63159C18D0C4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{25A40759-80FB-4E3E-9716-D4B39B1F32A8}3⤵
- Executes dropped EXE
PID:2704
-
-
C:\Users\Admin\AppData\Local\Temp\{7B7A6008-1AF5-4152-A234-63159C18D0C4}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{7B7A6008-1AF5-4152-A234-63159C18D0C4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{EAADA687-71FC-491E-B2AD-D5881467A137}3⤵
- Executes dropped EXE
PID:3924
-
-
C:\Users\Admin\AppData\Local\Temp\{7B7A6008-1AF5-4152-A234-63159C18D0C4}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{7B7A6008-1AF5-4152-A234-63159C18D0C4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A0ACA309-A10C-4FFF-867F-AB668D9D2C40}3⤵
- Executes dropped EXE
PID:1512
-
-
C:\Users\Admin\AppData\Local\Temp\{7B7A6008-1AF5-4152-A234-63159C18D0C4}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{7B7A6008-1AF5-4152-A234-63159C18D0C4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8127CEAC-1177-43E3-ACC0-125EE9614413}3⤵
- Executes dropped EXE
PID:3396
-
-
C:\Users\Admin\AppData\Local\Temp\{7B7A6008-1AF5-4152-A234-63159C18D0C4}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{7B7A6008-1AF5-4152-A234-63159C18D0C4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{25E2C77C-11E2-4EF6-90B7-8231DBB58EBA}3⤵
- Executes dropped EXE
PID:1968
-
-
C:\Users\Admin\AppData\Local\Temp\{7B7A6008-1AF5-4152-A234-63159C18D0C4}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{7B7A6008-1AF5-4152-A234-63159C18D0C4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{60BED4D7-EA1B-42AA-A203-523740FFEDAB}3⤵
- Executes dropped EXE
PID:3776
-
-
C:\Users\Admin\AppData\Local\Temp\{7B7A6008-1AF5-4152-A234-63159C18D0C4}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{7B7A6008-1AF5-4152-A234-63159C18D0C4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7ECE8154-631F-4EFC-AD28-2309E3E4698D}3⤵
- Executes dropped EXE
PID:4208
-
-
C:\Users\Admin\AppData\Local\Temp\{53862504-F2B8-48AF-9B79-E387D34B1402}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{53862504-F2B8-48AF-9B79-E387D34B1402}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{28944EF5-A45D-4B89-9DB1-0E1801E46695}3⤵
- Executes dropped EXE
PID:804
-
-
C:\Users\Admin\AppData\Local\Temp\{53862504-F2B8-48AF-9B79-E387D34B1402}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{53862504-F2B8-48AF-9B79-E387D34B1402}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{78C1EDAE-6A0C-4DF5-8D0E-D87323A42F2A}3⤵
- Executes dropped EXE
PID:4492
-
-
C:\Users\Admin\AppData\Local\Temp\{53862504-F2B8-48AF-9B79-E387D34B1402}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{53862504-F2B8-48AF-9B79-E387D34B1402}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{67C4034F-D9C1-48A1-AB29-330FC6F40031}3⤵
- Executes dropped EXE
PID:548
-
-
C:\Users\Admin\AppData\Local\Temp\{53862504-F2B8-48AF-9B79-E387D34B1402}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{53862504-F2B8-48AF-9B79-E387D34B1402}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{649F78D1-2AE6-4635-9289-DA8AFE0040EC}3⤵
- Executes dropped EXE
PID:4776
-
-
C:\Users\Admin\AppData\Local\Temp\{53862504-F2B8-48AF-9B79-E387D34B1402}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{53862504-F2B8-48AF-9B79-E387D34B1402}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C341B77D-F3A1-45B5-AA84-D0C31F7A31CF}3⤵
- Executes dropped EXE
PID:2192
-
-
C:\Users\Admin\AppData\Local\Temp\{53862504-F2B8-48AF-9B79-E387D34B1402}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{53862504-F2B8-48AF-9B79-E387D34B1402}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FBE67055-3A49-44A7-BCB6-B560320AC795}3⤵
- Executes dropped EXE
PID:5004
-
-
C:\Users\Admin\AppData\Local\Temp\{53862504-F2B8-48AF-9B79-E387D34B1402}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{53862504-F2B8-48AF-9B79-E387D34B1402}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5AE8846A-8C20-4208-B9D6-A1CB03776992}3⤵
- Executes dropped EXE
PID:1524
-
-
C:\Users\Admin\AppData\Local\Temp\{53862504-F2B8-48AF-9B79-E387D34B1402}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{53862504-F2B8-48AF-9B79-E387D34B1402}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6E35CDED-5378-4044-823B-7C6D43C80608}3⤵
- Executes dropped EXE
PID:1796
-
-
C:\Users\Admin\AppData\Local\Temp\{53862504-F2B8-48AF-9B79-E387D34B1402}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{53862504-F2B8-48AF-9B79-E387D34B1402}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{16B6B4DA-11A2-4929-B214-46E32DB522BB}3⤵
- Executes dropped EXE
PID:1260
-
-
C:\Users\Admin\AppData\Local\Temp\{53862504-F2B8-48AF-9B79-E387D34B1402}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{53862504-F2B8-48AF-9B79-E387D34B1402}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1EBAF034-E359-4B5C-AEC7-32EFBF5B7C73}3⤵
- Executes dropped EXE
PID:60
-
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 8FC3B6A39F956BF4D3E8CD215428223A2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\CloseFAH.exe"C:\Users\Admin\AppData\Local\Temp\CloseFAH.exe"3⤵
- Executes dropped EXE
PID:488
-
-
C:\Program Files\WinZip\adxregistrator.exe"C:\Program Files\WinZip\adxregistrator.exe" /install="C:\Program Files\WinZip\WinZipExpressForOffice.dll" /privileges=user /GenerateLogFile=false3⤵
- Executes dropped EXE
- Registers COM server for autorun
- Modifies registry class
PID:5828
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks /Create /SC DAILY /TN "WinZip Update Notifier 1" /TR "\"C:\Program Files\WinZip\WZUpdateNotifier.exe\" -checkType=\"scheduled_9AM\" -show" /ST 09:36 /F3⤵
- Creates scheduled task(s)
PID:3152
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks /Create /SC DAILY /TN "WinZip Update Notifier 2" /TR "\"C:\Program Files\WinZip\WZUpdateNotifier.exe\" -checkType=\"scheduled_12PM\" -show" /ST 12:36 /F3⤵
- Creates scheduled task(s)
PID:5160
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks /Create /SC DAILY /TN "WinZip Update Notifier 3" /TR "\"C:\Program Files\WinZip\WZUpdateNotifier.exe\" -checkType=\"scheduled_3PM\" -show" /ST 15:36 /F3⤵
- Creates scheduled task(s)
PID:5176
-
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 5A9BD59A9DCB3DD2AAA40B10D35E8C5F E Global\MSI00002⤵
- Registers COM server for autorun
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
PID:4492 -
C:\Program Files\WinZip\FAHConsole.exe"C:\Program Files\WinZip\FAHConsole.exe"3⤵
- Executes dropped EXE
PID:5760 -
C:\Program Files\WinZip\FAHWindow64.exe"C:\Program Files\WinZip\FAHWindow64.exe" register4⤵
- Executes dropped EXE
PID:5780
-
-
-
C:\Program Files\WinZip\adxregistrator.exe"C:\Program Files\WinZip\adxregistrator.exe" /install="C:\Program Files\WinZip\WinZipExpressForOffice.dll" /privileges=admin /GenerateLogFile=false3⤵
- Executes dropped EXE
- Registers COM server for autorun
- Modifies data under HKEY_USERS
- Modifies registry class
PID:6028
-
-
-
C:\Program Files\WinZip\WzPreviewer64.exe"C:\Program Files\WinZip\WzPreviewer64.exe" -regserver winzip642⤵
- Executes dropped EXE
- Registers COM server for autorun
- Modifies registry class
PID:1524
-
-
C:\Program Files\WinZip\WzPreloader.exe"C:\Program Files\WinZip\WzPreloader.exe"2⤵
- Executes dropped EXE
PID:2036
-
-
C:\Program Files\WinZip\winzip64.exe"C:\Program Files\WinZip\winzip64.exe" /noqp /nodesktop /nostartmenu /nomenugroup /autoinstall /lang 10332⤵
- Modifies system executable filetype association
- Executes dropped EXE
- Registers COM server for autorun
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of SetWindowsHookAW
- Suspicious use of SetWindowsHookEx
PID:804 -
C:\Program Files\WinZip\WzCABCacheSyncHelper64.exe"C:\Program Files\WinZip\WzCABCacheSyncHelper64.exe"3⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:8
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 327D0F4B1A9BB552818616FAD8D312A9 E Global\MSI00002⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\{9220585C-B36E-44D9-9645-C0D1B818DFDC}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{9220585C-B36E-44D9-9645-C0D1B818DFDC}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{75F79232-BE5B-4225-9512-011AE1E89C55}3⤵
- Executes dropped EXE
PID:1812
-
-
C:\Users\Admin\AppData\Local\Temp\{9220585C-B36E-44D9-9645-C0D1B818DFDC}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{9220585C-B36E-44D9-9645-C0D1B818DFDC}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FF42A0AF-B612-4212-AA66-7D5D46F230D9}3⤵
- Executes dropped EXE
PID:5124
-
-
C:\Users\Admin\AppData\Local\Temp\{9220585C-B36E-44D9-9645-C0D1B818DFDC}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{9220585C-B36E-44D9-9645-C0D1B818DFDC}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{708D0131-4F7D-4A40-A878-2CD46A15CDF7}3⤵
- Executes dropped EXE
PID:5216
-
-
C:\Users\Admin\AppData\Local\Temp\{9220585C-B36E-44D9-9645-C0D1B818DFDC}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{9220585C-B36E-44D9-9645-C0D1B818DFDC}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{07512CF4-002C-4902-9927-56393319C66A}3⤵
- Executes dropped EXE
PID:5252
-
-
C:\Users\Admin\AppData\Local\Temp\{9220585C-B36E-44D9-9645-C0D1B818DFDC}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{9220585C-B36E-44D9-9645-C0D1B818DFDC}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B07B3F79-C416-43CB-8856-153D31A2CC5B}3⤵
- Executes dropped EXE
PID:5288
-
-
C:\Users\Admin\AppData\Local\Temp\{9220585C-B36E-44D9-9645-C0D1B818DFDC}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{9220585C-B36E-44D9-9645-C0D1B818DFDC}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{74A5CD3C-8B24-42B7-BB33-7ACB785032ED}3⤵
- Executes dropped EXE
PID:5364
-
-
C:\Users\Admin\AppData\Local\Temp\{9220585C-B36E-44D9-9645-C0D1B818DFDC}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{9220585C-B36E-44D9-9645-C0D1B818DFDC}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{89144EEC-82AA-434B-B6A2-3E9FE687F230}3⤵
- Executes dropped EXE
PID:5404
-
-
C:\Users\Admin\AppData\Local\Temp\{9220585C-B36E-44D9-9645-C0D1B818DFDC}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{9220585C-B36E-44D9-9645-C0D1B818DFDC}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E451FBFE-43AD-4819-981A-FF4A6965A202}3⤵
- Executes dropped EXE
PID:5468
-
-
C:\Users\Admin\AppData\Local\Temp\{9220585C-B36E-44D9-9645-C0D1B818DFDC}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{9220585C-B36E-44D9-9645-C0D1B818DFDC}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9EF8B3A1-82E7-4647-992B-819931E926F2}3⤵
- Executes dropped EXE
PID:5504
-
-
C:\Users\Admin\AppData\Local\Temp\{9220585C-B36E-44D9-9645-C0D1B818DFDC}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{9220585C-B36E-44D9-9645-C0D1B818DFDC}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0567FCD8-48A5-4EAA-A24B-451CC40E41D6}3⤵
- Executes dropped EXE
PID:5576
-
-
-
C:\Program Files\WinZip\WzBGTComServer64.exe"C:\Program Files\WinZip\WzBGTComServer64.exe" /REGSERVER2⤵
- Executes dropped EXE
- Registers COM server for autorun
PID:5216
-
-
C:\Program Files\WinZip\WZUpdateNotifier.exe"C:\Program Files\WinZip\WZUpdateNotifier.exe"2⤵
- Executes dropped EXE
PID:5248
-
-
C:\Program Files\WinZip\WzBGTools64.exe"C:\Program Files\WinZip\WzBGTools64.exe" /s2⤵
- Executes dropped EXE
PID:5192
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:1992
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4436
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost1⤵PID:5456
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5904
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:4468
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4568 -ip 45681⤵PID:4624
-
C:\Program Files (x86)\PCProtect\SecurityService.exe"C:\Program Files (x86)\PCProtect\SecurityService.exe"1⤵
- Drops file in System32 directory
- Modifies registry class
PID:5240 -
C:\Program Files (x86)\PCProtect\SecurityService.exe"C:\Program Files (x86)\PCProtect\SecurityService.exe" --run-service --run-service-id=52402⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies system certificate store
PID:5788 -
C:\Program Files (x86)\PCProtect\Savapi\avupdate.exe"C:\Program Files (x86)\PCProtect\\Savapi\avupdate.exe" --config=avupdate-savapilib-engine.conf --check-product --no-dns-resolve --internet-srvs=https://definition.protected.net --peak-handling-srvs=https://definition.protected.net3⤵
- Drops file in Program Files directory
PID:3628
-
-
C:\Program Files (x86)\PCProtect\Savapi\avupdate.exe"C:\Program Files (x86)\PCProtect\\Savapi\avupdate.exe" --config=avupdate-savapilib-engine.conf --check-product --no-dns-resolve --internet-srvs=https://definition.protected.net --peak-handling-srvs=https://definition.protected.net3⤵PID:1476
-
-
C:\Program Files (x86)\PCProtect\SAVAPI\apc_random_id_generator.exe"C:\Program Files (x86)\PCProtect\SAVAPI\apc_random_id_generator.exe"3⤵PID:1968
-
-
C:\Program Files (x86)\PCProtect\Savapi\avupdate.exe"C:\Program Files (x86)\PCProtect\\Savapi\avupdate.exe" --config=avupdate-savapilib-engine.conf --check-product --no-dns-resolve --internet-srvs=https://definition.protected.net --peak-handling-srvs=https://definition.protected.net3⤵PID:7120
-
-
C:\Program Files (x86)\PCProtect\Savapi\avupdate.exe"C:\Program Files (x86)\PCProtect\\Savapi\avupdate.exe" --config=avupdate-savapilib-engine.conf --check-product --no-dns-resolve --internet-srvs=https://definition.protected.net --peak-handling-srvs=https://definition.protected.net3⤵PID:3040
-
-
C:\Program Files (x86)\PCProtect\Savapi\avupdate.exe"C:\Program Files (x86)\PCProtect\\Savapi\avupdate.exe" --config=avupdate-savapilib-engine.conf --check-product --no-dns-resolve --internet-srvs=https://definition.protected.net --peak-handling-srvs=https://definition.protected.net3⤵PID:3496
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2052
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2712
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x40c 0x33c1⤵PID:8
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3828
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵PID:5680
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost1⤵PID:5956
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc1⤵
- Drops file in System32 directory
PID:4256
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:6148
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x40c 0x33c1⤵PID:5792
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4468
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:6232
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost1⤵PID:6256
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost1⤵PID:7076
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3e93855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
PID:5912
Network
MITRE ATT&CK Enterprise v6
Persistence
Change Default File Association
1Hidden Files and Directories
1New Service
1Registry Run Keys / Startup Folder
2Scheduled Task
1Defense Evasion
File and Directory Permissions Modification
1Hidden Files and Directories
1Install Root Certificate
1Modify Registry
6Virtualization/Sandbox Evasion
2Web Service
1