Resubmissions
05-08-2022 00:27
220805-arzaqsdhbr 405-08-2022 00:08
220805-ae97gadgaq 1004-08-2022 21:57
220804-1twwhacfbj 604-08-2022 21:36
220804-1f571scdbn 404-08-2022 21:29
220804-1ccfjaccbj 404-08-2022 21:26
220804-z998dscbdj 4Analysis
-
max time kernel
1043s -
max time network
1008s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
05-08-2022 00:08
Static task
static1
Behavioral task
behavioral1
Sample
doc_230.rtf
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
doc_230.rtf
Resource
win10v2004-20220721-en
General
-
Target
doc_230.rtf
-
Size
23KB
-
MD5
bddec1adf7efc6b52d78f793cc5a84c8
-
SHA1
fbc3b3a4003a73067ad612171c3342063cc9bf2b
-
SHA256
4d3823da1dc741d7b575341842e7a23b2c4a28265c17b75034f5c34006979bbd
-
SHA512
524d7b272fdf9eabd84c2c9bb4bde6430b659ef3f4cf1905b2b3660b3e215ca915c07a9460beb73e5cab962bfd9bf998afa89a1a007665ce2445a3c19f517685
Malware Config
Signatures
-
Modifies system executable filetype association 2 TTPs 7 IoCs
Processes:
OneDrive.exeOneDriveSetup.exeOneDrive.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx\ = "{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}" OneDrive.exe Key deleted \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx\ = "{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx\ = "{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}" OneDrive.exe -
Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
Processes:
svchost.exedescription pid process target process PID 6020 created 1972 6020 svchost.exe OneDriveSetup.exe PID 6020 created 3220 6020 svchost.exe OneDriveSetup.exe -
Downloads MZ/PE file
-
Executes dropped EXE 7 IoCs
Processes:
DDESPY.exeDDESPY.exeOneDriveSetup.exeOneDriveSetup.exeFileSyncConfig.exeOneDrive.exeChromeRecovery.exepid process 5744 DDESPY.exe 1608 DDESPY.exe 1972 OneDriveSetup.exe 3220 OneDriveSetup.exe 4592 FileSyncConfig.exe 2828 OneDrive.exe 4128 ChromeRecovery.exe -
Registers COM server for autorun 1 TTPs 64 IoCs
Processes:
OneDrive.exeOneDrive.exeOneDriveSetup.exeFileSyncConfig.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32\ThreadingModel = "Apartment" OneDrive.exe Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\WOW6432Node\CLSID\{5999E1EE-711E-48D2-9884-851A709F543D}\LocalServer32 OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\WOW6432Node\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32\ThreadingModel = "Apartment" OneDrive.exe Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\CLSID\{A926714B-7BFC-4D08-A035-80021395FFA8}\LocalServer32 OneDrive.exe Key deleted \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\CLSID\{9AA2F32D-362A-42D9-9328-24A483E2CCC3}\InprocServer32 OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_CLASSES\CLSID\{917E8742-AA3B-7318-FA12-10485FB322A2}\LOCALSERVER32 OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\WOW6432Node\CLSID\{7B37E4E2-C62F-4914-9620-8FB5062718CC}\LocalServer32 OneDrive.exe Key deleted \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\WOW6432Node\CLSID\{AB807329-7324-431B-8B36-DBD581F56E0B}\LocalServer32 OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\WOW6432Node\CLSID\{6bb93b4e-44d8-40e2-bd97-42dbcf18a40f}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe\" /cci" OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\CLSID\{A926714B-7BFC-4D08-A035-80021395FFA8}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\FileCoAuth.exe\"" OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32\ThreadingModel = "Apartment" OneDrive.exe Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\WOW6432Node\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30}\InprocServer32 OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\WOW6432Node\CLSID\{20894375-46AE-46E2-BAFD-CB38975CDCE6}\InprocServer32\ThreadingModel = "Apartment" OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\WOW6432Node\CLSID\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\FileCoAuthLib.dll" OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\WOW6432Node\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\FileSyncShell.dll" OneDrive.exe Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\WOW6432Node\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}\LocalServer32 OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\amd64\\FileSyncShell64.dll" OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\amd64\\FileSyncShell64.dll" OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\WOW6432Node\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\FileCoAuth.exe\"" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\WOW6432Node\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32 OneDrive.exe Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\CLSID\{9AA2F32D-362A-42D9-9328-24A483E2CCC3}\InprocServer32 OneDrive.exe Key deleted \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\CLSID\{021E4F06-9DCC-49AD-88CF-ECC2DA314C8A}\LocalServer32 OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\WOW6432Node\CLSID\{2e7c0a19-0438-41e9-81e3-3ad3d64f55ba}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe\" /cci /client=Personal" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\WOW6432Node\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282}\InprocServer32\ThreadingModel = "Apartment" OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\WOW6432Node\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\FileCoAuth.exe\"" OneDrive.exe Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\WOW6432Node\CLSID\{021E4F06-9DCC-49AD-88CF-ECC2DA314C8A}\LocalServer32 OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\WOW6432Node\CLSID\{94269C4E-071A-4116-90E6-52E557067E4E}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\FileCoAuth.exe\"" OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\WOW6432Node\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32\ThreadingModel = "Apartment" OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32\ThreadingModel = "Apartment" OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\WOW6432Node\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32\ThreadingModel = "Apartment" OneDrive.exe Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\WOW6432Node\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32 OneDrive.exe Key deleted \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\WOW6432Node\CLSID\{9AA2F32D-362A-42D9-9328-24A483E2CCC3}\InprocServer32 OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\CLSID\{20894375-46AE-46E2-BAFD-CB38975CDCE6}\InprocServer32\ThreadingModel = "Apartment" OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\CLSID\{021E4F06-9DCC-49AD-88CF-ECC2DA314C8A}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\FileCoAuth.exe\"" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\CLSID\{A926714B-7BFC-4D08-A035-80021395FFA8}\LocalServer32 OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\CLSID\{021E4F06-9DCC-49AD-88CF-ECC2DA314C8A}\LocalServer32 OneDrive.exe Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\WOW6432Node\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32 OneDrive.exe Key deleted \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\CLSID\{389510b7-9e58-40d7-98bf-60b911cb0ea9}\LocalServer32 OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\WOW6432Node\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32\ThreadingModel = "Apartment" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\CLSID\{021E4F06-9DCC-49AD-88CF-ECC2DA314C8A}\LocalServer32 OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 OneDrive.exe Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\WOW6432Node\CLSID\{20894375-46AE-46E2-BAFD-CB38975CDCE6}\InprocServer32 OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32\ThreadingModel = "Apartment" OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30}\InprocServer32\ThreadingModel = "Apartment" OneDrive.exe Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\WOW6432Node\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\FileSyncShell.dll" OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\WOW6432Node\CLSID\{021E4F06-9DCC-49AD-88CF-ECC2DA314C8A}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\FileCoAuth.exe" OneDrive.exe Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\CLSID\{94269C4E-071A-4116-90E6-52E557067E4E}\LocalServer32 OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\WOW6432Node\CLSID\{2e7c0a19-0438-41e9-81e3-3ad3d64f55ba}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe\" /cci /client=Personal" OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\WOW6432Node\CLSID\{A3CA1CF4-5F3E-4AC0-91B9-0D3716E1EAC3}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe /cci /client=Personal" OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\WOW6432Node\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32\ThreadingModel = "Apartment" OneDrive.exe Key deleted \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\CLSID\{C5FF006E-2AE9-408C-B85B-2DFDD5449D9C}\InprocServer32 OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\amd64\\FileSyncShell64.dll" OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32\ThreadingModel = "Apartment" OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_CLASSES\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\INPROCSERVER32 FileSyncConfig.exe Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}\LocalServer32 OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\WOW6432Node\CLSID\{A926714B-7BFC-4D08-A035-80021395FFA8}\LocalServer32 OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\WOW6432Node\CLSID\{A3CA1CF4-5F3E-4AC0-91B9-0D3716E1EAC3}\LocalServer32 OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\WOW6432Node\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282}\InprocServer32 OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\WOW6432Node\CLSID\{389510b7-9e58-40d7-98bf-60b911cb0ea9}\LocalServer32 OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\WOW6432Node\CLSID\{9AA2F32D-362A-42D9-9328-24A483E2CCC3}\InprocServer32\ThreadingModel = "Apartment" OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\WOW6432Node\CLSID\{021E4F06-9DCC-49AD-88CF-ECC2DA314C8A}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\FileCoAuth.exe\"" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\CLSID\{389510b7-9e58-40d7-98bf-60b911cb0ea9}\LocalServer32 OneDriveSetup.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
OneDriveSetup.exeOneDrive.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Control Panel\International\Geo\Nation OneDriveSetup.exe Key value queried \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Control Panel\International\Geo\Nation OneDrive.exe -
Loads dropped DLL 40 IoCs
Processes:
FileSyncConfig.exeOneDrive.exepid process 4592 FileSyncConfig.exe 4592 FileSyncConfig.exe 4592 FileSyncConfig.exe 4592 FileSyncConfig.exe 4592 FileSyncConfig.exe 4592 FileSyncConfig.exe 4592 FileSyncConfig.exe 2828 OneDrive.exe 2828 OneDrive.exe 2828 OneDrive.exe 2828 OneDrive.exe 2828 OneDrive.exe 2828 OneDrive.exe 2828 OneDrive.exe 2828 OneDrive.exe 2828 OneDrive.exe 2828 OneDrive.exe 2828 OneDrive.exe 2828 OneDrive.exe 2828 OneDrive.exe 2828 OneDrive.exe 2828 OneDrive.exe 2828 OneDrive.exe 2828 OneDrive.exe 2828 OneDrive.exe 2828 OneDrive.exe 2828 OneDrive.exe 2828 OneDrive.exe 2828 OneDrive.exe 2828 OneDrive.exe 2828 OneDrive.exe 2828 OneDrive.exe 2828 OneDrive.exe 2828 OneDrive.exe 2828 OneDrive.exe 2828 OneDrive.exe 2828 OneDrive.exe 2828 OneDrive.exe 2828 OneDrive.exe 2828 OneDrive.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
OneDriveSetup.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Delete Cached Update Binary = "C:\\Windows\\system32\\cmd.exe /q /c del /q \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\Update\\OneDriveSetup.exe\"" OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Delete Cached Standalone Update Binary = "C:\\Windows\\system32\\cmd.exe /q /c del /q \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\StandaloneUpdater\\OneDriveSetup.exe\"" OneDriveSetup.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 7 IoCs
Processes:
elevation_service.exedescription ioc process File created C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir4496_872651556\ChromeRecovery.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir4496_872651556\ChromeRecovery.exe elevation_service.exe File created C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir4496_872651556\manifest.json elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir4496_872651556\manifest.json elevation_service.exe File created C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir4496_872651556\_metadata\verified_contents.json elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir4496_872651556\_metadata\verified_contents.json elevation_service.exe File created C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir4496_872651556\ChromeRecoveryCRX.crx elevation_service.exe -
Drops file in Windows directory 2 IoCs
Processes:
DDESPY.exeDDESPY.exedescription ioc process File opened for modification C:\Windows\ddespy.ini DDESPY.exe File opened for modification C:\Windows\ddespy.ini DDESPY.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 14 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
OneDrive.exeWINWORD.EXEWINWORD.EXEWINWORD.EXEWINWORD.EXEdescription ioc process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 OneDrive.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz OneDrive.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 15 IoCs
Processes:
WINWORD.EXEWINWORD.EXEchrome.exeWINWORD.EXEWINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Processes:
OneDrive.exeOneDriveSetup.exeOneDrive.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OneDrive.exe = "11000" OneDrive.exe Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION OneDrive.exe Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Software\Microsoft\Internet Explorer\IESettingSync OneDrive.exe Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" OneDrive.exe Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION OneDrive.exe Set value (int) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OneDrive.exe = "11000" OneDriveSetup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OneDrive.exe = "11000" OneDrive.exe Set value (int) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" OneDrive.exe -
Modifies registry class 64 IoCs
Processes:
OneDriveSetup.exeOneDrive.exeOneDrive.exeFileSyncConfig.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\CLSID\{917E8742-AA3B-7318-FA12-10485FB322A2}\VersionIndependentProgID\ = "NucleusNativeMessaging.NucleusNativeMessaging" OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\odopen OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\Interface\{31508CC7-9BC7-494B-9D0F-7B1C7F144182} OneDrive.exe Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\Interface\{679EC955-75AA-4FB2-A7ED-8C0152ECF409}\ProxyStubClsid32 OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\amd64\\FileSyncShell64.dll" OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\WOW6432Node\Interface\{9E1CD0DF-72E7-4284-9598-342C0A46F96B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" OneDrive.exe Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\WOW6432Node\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\Interface\{EE15BBBB-9E60-4C52-ABCB-7540FF3DF6B3}\TypeLib\Version = "1.0" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30} OneDrive.exe Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\SyncEngineStorageProviderHandlerProxy.SyncEngineStorageProviderHandlerProxy\CurVer OneDrive.exe Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\CLSID\{389510b7-9e58-40d7-98bf-60b911cb0ea9} OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ShellFolder FileSyncConfig.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\Interface\{02C98E2C-6C9F-49F8-9B57-3A6E1AA09A67}\ = "ISyncInformationLookupCallback" OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\SyncEngineFileInfoProvider.SyncEngineFileInfoProvider\CLSID\ = "{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}" OneDrive.exe Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\WOW6432Node\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}\TypeLib OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6} FileSyncConfig.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30}\InprocServer32\ThreadingModel = "Apartment" OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_CLASSES\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\INPROCSERVER32 FileSyncConfig.exe Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\WOW6432Node\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32 OneDrive.exe Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\Interface\{6A821279-AB49-48F8-9A27-F6C59B4FF024} OneDrive.exe Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\Interface\{8D3F8F15-1DE1-4662-BF93-762EABE988B2}\ProxyStubClsid32 OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\WOW6432Node\CLSID\{6bb93b4e-44d8-40e2-bd97-42dbcf18a40f} OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\WOW6432Node\Interface\{53de12aa-df96-413d-a25e-c75b6528abf2}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}" OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\Interface\{a7126d4c-f492-4eb9-8a2a-f673dbdd3334}\TypeLib\Version = "1.0" OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\OOBERequestHandler.OOBERequestHandler\ = "OOBERequestHandler Class" OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32\ThreadingModel = "Apartment" OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\Interface\{8B9F14F4-9559-4A3F-B7D0-312E992B6D98}\ = "IGetSelectiveSyncInformationCallback" OneDrive.exe Key deleted \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\WOW6432Node\Interface\{fac14b75-7862-4ceb-be41-f53945a61c17}\TypeLib OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\WOW6432Node\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}\LocalServer32 OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\Interface\{fac14b75-7862-4ceb-be41-f53945a61c17}\TypeLib\Version = "1.0" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\WOW6432Node\Interface\{0d4e4444-cb20-4c2b-b8b2-94e5656ecae8}\TypeLib OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\TypeLib\{638805C3-4BA3-4AC8-8AAC-71A0BA2BC284}\1.0\ = "FileCoAuthLibrary 1.0 Type Library" OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\Interface\{AF60000F-661D-472A-9588-F062F6DB7A0E}\TypeLib\Version = "1.0" OneDrive.exe Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\WOW6432Node\CLSID\{20894375-46AE-46E2-BAFD-CB38975CDCE6}\InprocServer32 OneDrive.exe Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\WOW6432Node\CLSID\{A926714B-7BFC-4D08-A035-80021395FFA8}\ProgID OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32\ThreadingModel = "Apartment" OneDrive.exe Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\Interface\{10C9242E-D604-49B5-99E4-BF87945EF86C}\TypeLib OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\Interface\{0d4e4444-cb20-4c2b-b8b2-94e5656ecae8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\WOW6432Node\Interface\{10C9242E-D604-49B5-99E4-BF87945EF86C}\ProxyStubClsid32 OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\WOW6432Node\Interface\{F062BA81-ADFE-4A92-886A-23FD851D6406}\ = "IGetLinkCallback" OneDrive.exe Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\Interface\{53de12aa-df96-413d-a25e-c75b6528abf2} OneDrive.exe Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\WOW6432Node\CLSID\{5999E1EE-711E-48D2-9884-851A709F543D}\VersionIndependentProgID OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\CLSID\{94269C4E-071A-4116-90E6-52E557067E4E}\VersionIndependentProgID\ = "OOBERequestHandler.OOBERequestHandler" OneDrive.exe Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\odopen OneDrive.exe Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\WOW6432Node\Interface\{390AF5A7-1390-4255-9BC9-935BFCFA5D57} OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\WOW6432Node\Interface\{3A4E62AE-45D9-41D5-85F5-A45B77AB44E5}\TypeLib\Version = "1.0" OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\WOW6432Node\Interface\{0776ae27-5ab9-4e18-9063-1836da63117a}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" OneDrive.exe Key deleted \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\WOW6432Node\Interface\{b5c25645-7426-433f-8a5f-42b7ff27a7b2}\ProxyStubClsid32 OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\TypeLib\{638805C3-4BA3-4AC8-8AAC-71A0BA2BC284}\1.0\FLAGS OneDrive.exe Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\Interface\{F0AF7C30-EAE4-4644-961D-54E6E28708D6}\TypeLib OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\VersionIndependentProgID\ = "SyncEngineFileInfoProvider.SyncEngineFileInfoProvider" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\WOW6432Node\Interface\{679EC955-75AA-4FB2-A7ED-8C0152ECF409}\TypeLib OneDrive.exe Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\WOW6432Node\CLSID\{AB807329-7324-431B-8B36-DBD581F56E0B}\Programmable OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\ = "SyncingOverlayHandler2 Class" OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\WOW6432Node\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\ = "FileSyncEx" OneDrive.exe Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\WOW6432Node\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}\ProgID OneDrive.exe Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\CLSID\{A926714B-7BFC-4D08-A035-80021395FFA8}\LocalServer32 OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\ContextMenuOptIn OneDrive.exe Key deleted \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\FileSyncClient.AutoPlayHandler\shell\import\DropTarget OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\WOW6432Node\CLSID\{94269C4E-071A-4116-90E6-52E557067E4E}\LocalServer32 OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\CLSID\{A926714B-7BFC-4D08-A035-80021395FFA8}\VersionIndependentProgID OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\WOW6432Node\Interface\{1196AE48-D92B-4BC7-85DE-664EC3F761F1}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}" OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\WOW6432Node\Interface\{d8c80ebb-099c-4208-afa3-fbc4d11f8a3c}\ = "IGetLibrariesCallback" OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\Interface\{d8c80ebb-099c-4208-afa3-fbc4d11f8a3c}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" OneDriveSetup.exe -
Suspicious behavior: AddClipboardFormatListener 10 IoCs
Processes:
WINWORD.EXEOneDrive.exeOneDrive.exeWINWORD.EXEWINWORD.EXEWINWORD.EXEpid process 5040 WINWORD.EXE 5040 WINWORD.EXE 5808 OneDrive.exe 2828 OneDrive.exe 3824 WINWORD.EXE 3824 WINWORD.EXE 4724 WINWORD.EXE 4724 WINWORD.EXE 5556 WINWORD.EXE 5556 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
chrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exeOneDrive.exeOneDriveSetup.exeOneDriveSetup.exeOneDrive.exechrome.exespyxx.exepid process 3564 chrome.exe 3564 chrome.exe 2536 chrome.exe 2536 chrome.exe 5724 chrome.exe 5724 chrome.exe 5612 chrome.exe 5612 chrome.exe 6072 chrome.exe 6072 chrome.exe 5164 chrome.exe 5164 chrome.exe 3516 chrome.exe 3516 chrome.exe 5604 chrome.exe 5604 chrome.exe 5660 chrome.exe 5660 chrome.exe 5504 chrome.exe 5504 chrome.exe 4864 chrome.exe 4864 chrome.exe 4864 chrome.exe 4864 chrome.exe 5808 OneDrive.exe 5808 OneDrive.exe 1972 OneDriveSetup.exe 1972 OneDriveSetup.exe 1972 OneDriveSetup.exe 1972 OneDriveSetup.exe 3220 OneDriveSetup.exe 3220 OneDriveSetup.exe 3220 OneDriveSetup.exe 3220 OneDriveSetup.exe 3220 OneDriveSetup.exe 3220 OneDriveSetup.exe 3220 OneDriveSetup.exe 3220 OneDriveSetup.exe 3220 OneDriveSetup.exe 3220 OneDriveSetup.exe 3220 OneDriveSetup.exe 3220 OneDriveSetup.exe 3220 OneDriveSetup.exe 3220 OneDriveSetup.exe 3220 OneDriveSetup.exe 3220 OneDriveSetup.exe 3220 OneDriveSetup.exe 3220 OneDriveSetup.exe 3220 OneDriveSetup.exe 3220 OneDriveSetup.exe 3220 OneDriveSetup.exe 3220 OneDriveSetup.exe 3220 OneDriveSetup.exe 3220 OneDriveSetup.exe 3220 OneDriveSetup.exe 3220 OneDriveSetup.exe 3220 OneDriveSetup.exe 3220 OneDriveSetup.exe 2828 OneDrive.exe 2828 OneDrive.exe 3544 chrome.exe 3544 chrome.exe 3200 spyxx.exe 3200 spyxx.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
spyxx.exepid process 3200 spyxx.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 29 IoCs
Processes:
chrome.exepid process 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
OneDriveSetup.exesvchost.exeOneDriveSetup.exespyxx.exedescription pid process Token: SeIncreaseQuotaPrivilege 1972 OneDriveSetup.exe Token: SeTcbPrivilege 6020 svchost.exe Token: SeTcbPrivilege 6020 svchost.exe Token: SeIncreaseQuotaPrivilege 3220 OneDriveSetup.exe Token: SeDebugPrivilege 3200 spyxx.exe Token: SeDebugPrivilege 3200 spyxx.exe Token: SeDebugPrivilege 3200 spyxx.exe Token: SeDebugPrivilege 3200 spyxx.exe Token: SeDebugPrivilege 3200 spyxx.exe Token: SeDebugPrivilege 3200 spyxx.exe Token: SeDebugPrivilege 3200 spyxx.exe Token: SeDebugPrivilege 3200 spyxx.exe Token: SeDebugPrivilege 3200 spyxx.exe Token: SeDebugPrivilege 3200 spyxx.exe Token: SeDebugPrivilege 3200 spyxx.exe Token: SeDebugPrivilege 3200 spyxx.exe Token: SeDebugPrivilege 3200 spyxx.exe Token: SeDebugPrivilege 3200 spyxx.exe Token: SeDebugPrivilege 3200 spyxx.exe Token: SeDebugPrivilege 3200 spyxx.exe Token: SeDebugPrivilege 3200 spyxx.exe Token: SeDebugPrivilege 3200 spyxx.exe Token: SeDebugPrivilege 3200 spyxx.exe Token: SeDebugPrivilege 3200 spyxx.exe Token: SeDebugPrivilege 3200 spyxx.exe Token: SeDebugPrivilege 3200 spyxx.exe Token: SeDebugPrivilege 3200 spyxx.exe Token: SeDebugPrivilege 3200 spyxx.exe Token: SeDebugPrivilege 3200 spyxx.exe Token: SeDebugPrivilege 3200 spyxx.exe Token: SeDebugPrivilege 3200 spyxx.exe Token: SeDebugPrivilege 3200 spyxx.exe Token: SeDebugPrivilege 3200 spyxx.exe Token: SeDebugPrivilege 3200 spyxx.exe Token: SeDebugPrivilege 3200 spyxx.exe Token: SeDebugPrivilege 3200 spyxx.exe Token: SeDebugPrivilege 3200 spyxx.exe Token: SeDebugPrivilege 3200 spyxx.exe Token: SeDebugPrivilege 3200 spyxx.exe Token: SeDebugPrivilege 3200 spyxx.exe Token: SeDebugPrivilege 3200 spyxx.exe Token: SeDebugPrivilege 3200 spyxx.exe Token: SeDebugPrivilege 3200 spyxx.exe Token: SeDebugPrivilege 3200 spyxx.exe Token: SeDebugPrivilege 3200 spyxx.exe Token: SeDebugPrivilege 3200 spyxx.exe Token: SeDebugPrivilege 3200 spyxx.exe Token: SeDebugPrivilege 3200 spyxx.exe Token: SeDebugPrivilege 3200 spyxx.exe Token: SeDebugPrivilege 3200 spyxx.exe Token: SeDebugPrivilege 3200 spyxx.exe Token: SeDebugPrivilege 3200 spyxx.exe Token: SeDebugPrivilege 3200 spyxx.exe Token: SeDebugPrivilege 3200 spyxx.exe Token: SeDebugPrivilege 3200 spyxx.exe Token: SeDebugPrivilege 3200 spyxx.exe Token: SeDebugPrivilege 3200 spyxx.exe Token: SeDebugPrivilege 3200 spyxx.exe Token: SeDebugPrivilege 3200 spyxx.exe Token: SeDebugPrivilege 3200 spyxx.exe Token: SeDebugPrivilege 3200 spyxx.exe Token: SeDebugPrivilege 3200 spyxx.exe Token: SeDebugPrivilege 3200 spyxx.exe Token: SeDebugPrivilege 3200 spyxx.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
chrome.exeDDESPY.exeOneDrive.exeOneDrive.exepid process 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 1608 DDESPY.exe 1608 DDESPY.exe 5808 OneDrive.exe 5808 OneDrive.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 5808 OneDrive.exe 5808 OneDrive.exe 2828 OneDrive.exe 2828 OneDrive.exe 2828 OneDrive.exe 2828 OneDrive.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe -
Suspicious use of SendNotifyMessage 48 IoCs
Processes:
chrome.exeOneDrive.exeOneDrive.exepid process 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 5808 OneDrive.exe 5808 OneDrive.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 5808 OneDrive.exe 5808 OneDrive.exe 2828 OneDrive.exe 2828 OneDrive.exe 2828 OneDrive.exe 2828 OneDrive.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
WINWORD.EXEOneDrive.exeOneDrive.exeWINWORD.EXEWINWORD.EXEspyxx.exeWINWORD.EXEpid process 5040 WINWORD.EXE 5040 WINWORD.EXE 5040 WINWORD.EXE 5040 WINWORD.EXE 5040 WINWORD.EXE 5040 WINWORD.EXE 5040 WINWORD.EXE 5040 WINWORD.EXE 5040 WINWORD.EXE 5040 WINWORD.EXE 5040 WINWORD.EXE 5040 WINWORD.EXE 5040 WINWORD.EXE 5808 OneDrive.exe 2828 OneDrive.exe 2828 OneDrive.exe 2828 OneDrive.exe 3824 WINWORD.EXE 3824 WINWORD.EXE 3824 WINWORD.EXE 3824 WINWORD.EXE 3824 WINWORD.EXE 3824 WINWORD.EXE 3824 WINWORD.EXE 3824 WINWORD.EXE 3824 WINWORD.EXE 3824 WINWORD.EXE 3824 WINWORD.EXE 3824 WINWORD.EXE 3824 WINWORD.EXE 3824 WINWORD.EXE 3824 WINWORD.EXE 4724 WINWORD.EXE 4724 WINWORD.EXE 4724 WINWORD.EXE 4724 WINWORD.EXE 4724 WINWORD.EXE 4724 WINWORD.EXE 4724 WINWORD.EXE 4724 WINWORD.EXE 4724 WINWORD.EXE 4724 WINWORD.EXE 4724 WINWORD.EXE 4724 WINWORD.EXE 3200 spyxx.exe 3200 spyxx.exe 3200 spyxx.exe 3200 spyxx.exe 3200 spyxx.exe 4724 WINWORD.EXE 4724 WINWORD.EXE 4724 WINWORD.EXE 4724 WINWORD.EXE 4724 WINWORD.EXE 5556 WINWORD.EXE 5556 WINWORD.EXE 5556 WINWORD.EXE 5556 WINWORD.EXE 5556 WINWORD.EXE 5556 WINWORD.EXE 5556 WINWORD.EXE 5556 WINWORD.EXE 5556 WINWORD.EXE 5556 WINWORD.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 2536 wrote to memory of 4032 2536 chrome.exe chrome.exe PID 2536 wrote to memory of 4032 2536 chrome.exe chrome.exe PID 2536 wrote to memory of 3908 2536 chrome.exe chrome.exe PID 2536 wrote to memory of 3908 2536 chrome.exe chrome.exe PID 2536 wrote to memory of 3908 2536 chrome.exe chrome.exe PID 2536 wrote to memory of 3908 2536 chrome.exe chrome.exe PID 2536 wrote to memory of 3908 2536 chrome.exe chrome.exe PID 2536 wrote to memory of 3908 2536 chrome.exe chrome.exe PID 2536 wrote to memory of 3908 2536 chrome.exe chrome.exe PID 2536 wrote to memory of 3908 2536 chrome.exe chrome.exe PID 2536 wrote to memory of 3908 2536 chrome.exe chrome.exe PID 2536 wrote to memory of 3908 2536 chrome.exe chrome.exe PID 2536 wrote to memory of 3908 2536 chrome.exe chrome.exe PID 2536 wrote to memory of 3908 2536 chrome.exe chrome.exe PID 2536 wrote to memory of 3908 2536 chrome.exe chrome.exe PID 2536 wrote to memory of 3908 2536 chrome.exe chrome.exe PID 2536 wrote to memory of 3908 2536 chrome.exe chrome.exe PID 2536 wrote to memory of 3908 2536 chrome.exe chrome.exe PID 2536 wrote to memory of 3908 2536 chrome.exe chrome.exe PID 2536 wrote to memory of 3908 2536 chrome.exe chrome.exe PID 2536 wrote to memory of 3908 2536 chrome.exe chrome.exe PID 2536 wrote to memory of 3908 2536 chrome.exe chrome.exe PID 2536 wrote to memory of 3908 2536 chrome.exe chrome.exe PID 2536 wrote to memory of 3908 2536 chrome.exe chrome.exe PID 2536 wrote to memory of 3908 2536 chrome.exe chrome.exe PID 2536 wrote to memory of 3908 2536 chrome.exe chrome.exe PID 2536 wrote to memory of 3908 2536 chrome.exe chrome.exe PID 2536 wrote to memory of 3908 2536 chrome.exe chrome.exe PID 2536 wrote to memory of 3908 2536 chrome.exe chrome.exe PID 2536 wrote to memory of 3908 2536 chrome.exe chrome.exe PID 2536 wrote to memory of 3908 2536 chrome.exe chrome.exe PID 2536 wrote to memory of 3908 2536 chrome.exe chrome.exe PID 2536 wrote to memory of 3908 2536 chrome.exe chrome.exe PID 2536 wrote to memory of 3908 2536 chrome.exe chrome.exe PID 2536 wrote to memory of 3908 2536 chrome.exe chrome.exe PID 2536 wrote to memory of 3908 2536 chrome.exe chrome.exe PID 2536 wrote to memory of 3908 2536 chrome.exe chrome.exe PID 2536 wrote to memory of 3908 2536 chrome.exe chrome.exe PID 2536 wrote to memory of 3908 2536 chrome.exe chrome.exe PID 2536 wrote to memory of 3908 2536 chrome.exe chrome.exe PID 2536 wrote to memory of 3908 2536 chrome.exe chrome.exe PID 2536 wrote to memory of 3908 2536 chrome.exe chrome.exe PID 2536 wrote to memory of 3564 2536 chrome.exe chrome.exe PID 2536 wrote to memory of 3564 2536 chrome.exe chrome.exe PID 2536 wrote to memory of 2572 2536 chrome.exe chrome.exe PID 2536 wrote to memory of 2572 2536 chrome.exe chrome.exe PID 2536 wrote to memory of 2572 2536 chrome.exe chrome.exe PID 2536 wrote to memory of 2572 2536 chrome.exe chrome.exe PID 2536 wrote to memory of 2572 2536 chrome.exe chrome.exe PID 2536 wrote to memory of 2572 2536 chrome.exe chrome.exe PID 2536 wrote to memory of 2572 2536 chrome.exe chrome.exe PID 2536 wrote to memory of 2572 2536 chrome.exe chrome.exe PID 2536 wrote to memory of 2572 2536 chrome.exe chrome.exe PID 2536 wrote to memory of 2572 2536 chrome.exe chrome.exe PID 2536 wrote to memory of 2572 2536 chrome.exe chrome.exe PID 2536 wrote to memory of 2572 2536 chrome.exe chrome.exe PID 2536 wrote to memory of 2572 2536 chrome.exe chrome.exe PID 2536 wrote to memory of 2572 2536 chrome.exe chrome.exe PID 2536 wrote to memory of 2572 2536 chrome.exe chrome.exe PID 2536 wrote to memory of 2572 2536 chrome.exe chrome.exe PID 2536 wrote to memory of 2572 2536 chrome.exe chrome.exe PID 2536 wrote to memory of 2572 2536 chrome.exe chrome.exe PID 2536 wrote to memory of 2572 2536 chrome.exe chrome.exe PID 2536 wrote to memory of 2572 2536 chrome.exe chrome.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\doc_230.rtf" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x108,0x10c,0x110,0xd8,0xdc,0x7ff9db9a4f50,0x7ff9db9a4f60,0x7ff9db9a4f702⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1644,15544206672150237863,15549726557229827367,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1708 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1644,15544206672150237863,15549726557229827367,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1844 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1644,15544206672150237863,15549726557229827367,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2296 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,15544206672150237863,15549726557229827367,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2980 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,15544206672150237863,15549726557229827367,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,15544206672150237863,15549726557229827367,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3904 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,15544206672150237863,15549726557229827367,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4556 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,15544206672150237863,15549726557229827367,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4700 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,15544206672150237863,15549726557229827367,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4720 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,15544206672150237863,15549726557229827367,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4848 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1644,15544206672150237863,15549726557229827367,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4668 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,15544206672150237863,15549726557229827367,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1644,15544206672150237863,15549726557229827367,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5188 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1644,15544206672150237863,15549726557229827367,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5276 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,15544206672150237863,15549726557229827367,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5228 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1644,15544206672150237863,15549726557229827367,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3456 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,15544206672150237863,15549726557229827367,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3816 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,15544206672150237863,15549726557229827367,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,15544206672150237863,15549726557229827367,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,15544206672150237863,15549726557229827367,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,15544206672150237863,15549726557229827367,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1568 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1644,15544206672150237863,15549726557229827367,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5436 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,15544206672150237863,15549726557229827367,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1644,15544206672150237863,15549726557229827367,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3944 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,15544206672150237863,15549726557229827367,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,15544206672150237863,15549726557229827367,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1644,15544206672150237863,15549726557229827367,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2616 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,15544206672150237863,15549726557229827367,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5316 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,15544206672150237863,15549726557229827367,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1644,15544206672150237863,15549726557229827367,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=812 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1644,15544206672150237863,15549726557229827367,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1644,15544206672150237863,15549726557229827367,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5688 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1644,15544206672150237863,15549726557229827367,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4648 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1644,15544206672150237863,15549726557229827367,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3388 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1644,15544206672150237863,15549726557229827367,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5560 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1644,15544206672150237863,15549726557229827367,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3076 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1644,15544206672150237863,15549726557229827367,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=976 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,15544206672150237863,15549726557229827367,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5980 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,15544206672150237863,15549726557229827367,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2108 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,15544206672150237863,15549726557229827367,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5844 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,15544206672150237863,15549726557229827367,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6208 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1644,15544206672150237863,15549726557229827367,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3764 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,15544206672150237863,15549726557229827367,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1556 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,15544206672150237863,15549726557229827367,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,15544206672150237863,15549726557229827367,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,15544206672150237863,15549726557229827367,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=988 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,15544206672150237863,15549726557229827367,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3636 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1644,15544206672150237863,15549726557229827367,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4008 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1644,15544206672150237863,15549726557229827367,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6732 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,15544206672150237863,15549726557229827367,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1580 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,15544206672150237863,15549726557229827367,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6672 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,15544206672150237863,15549726557229827367,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6204 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,15544206672150237863,15549726557229827367,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6204 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,15544206672150237863,15549726557229827367,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6884 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,15544206672150237863,15549726557229827367,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6764 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,15544206672150237863,15549726557229827367,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7036 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,15544206672150237863,15549726557229827367,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,15544206672150237863,15549726557229827367,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6632 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,15544206672150237863,15549726557229827367,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6048 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,15544206672150237863,15549726557229827367,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,15544206672150237863,15549726557229827367,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,15544206672150237863,15549726557229827367,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7160 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,15544206672150237863,15549726557229827367,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7112 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1644,15544206672150237863,15549726557229827367,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6968 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1644,15544206672150237863,15549726557229827367,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6592 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1644,15544206672150237863,15549726557229827367,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6916 /prefetch:82⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Downloads\DDESPY.exe"C:\Users\Admin\Downloads\DDESPY.exe"1⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Users\Admin\Downloads\DDESPY.exe"C:\Users\Admin\Downloads\DDESPY.exe"1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe"1⤵
- Modifies system executable filetype association
- Registers COM server for autorun
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe" /update /restart2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe /update /restart /peruser /childprocess /extractFilesWithLessThreadCount /renameReplaceOneDriveExe /renameReplaceODSUExe /removeNonCurrentVersions /enableODSUReportingMode3⤵
- Modifies system executable filetype association
- Executes dropped EXE
- Registers COM server for autorun
- Checks computer location settings
- Adds Run key to start application
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncConfig.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncConfig.exe"4⤵
- Executes dropped EXE
- Registers COM server for autorun
- Loads dropped DLL
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe/updateInstalled /background4⤵
- Modifies system executable filetype association
- Executes dropped EXE
- Registers COM server for autorun
- Checks computer location settings
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"1⤵
- Drops file in Program Files directory
-
C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir4496_872651556\ChromeRecovery.exe"C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir4496_872651556\ChromeRecovery.exe" --appguid={8A69D345-D564-463c-AFF1-A69D9E530F96} --browser-version=89.0.4389.114 --sessionid={34975b3d-8a22-4ac2-9fd4-c6e4dd43d2f7} --system2⤵
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"1⤵
-
C:\Windows\system32\curl.execurl -O http://192.3.152.171/document/doc_203.doc2⤵
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Downloads\doc_203.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"1⤵
-
C:\Windows\system32\curl.execurl -O http://192.3.152.171/document/doc_230.doc2⤵
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Downloads\doc_230.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"1⤵
-
C:\Users\Admin\Downloads\SpyPlusPlus-master\SpyPlusPlus-master\spy14.00.25420\spyxx.exe"C:\Users\Admin\Downloads\SpyPlusPlus-master\SpyPlusPlus-master\spy14.00.25420\spyxx.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Downloads\doc_230.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncConfig.exeFilesize
553KB
MD557bd9bd545af2b0f2ce14a33ca57ece9
SHA115b4b5afff9abba2de64cbd4f0989f1b2fbc4bf1
SHA256a3a4b648e4dcf3a4e5f7d13cc3d21b0353e496da75f83246cc8a15fada463bdf
SHA512d134f9881312ddbd0d61f39fd62af5443a4947d3de010fef3b0f6ebf17829bd4c2f13f6299d2a7aad35c868bb451ef6991c5093c2809e6be791f05f137324b39
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LoggingPlatform.DLLFilesize
504KB
MD54ffef06099812f4f86d1280d69151a3f
SHA1e5da93b4e0cf14300701a0efbd7caf80b86621c3
SHA256d5a538a0a036c602492f9b2b6f85de59924da9ec3ed7a7bbf6ecd0979bee54d3
SHA512d667fd0ae46039914f988eb7e407344114944a040468e4ec5a53d562db2c3241737566308d8420bb4f7c89c6ef446a7881b83eaac7daba3271b81754c5c0f34a
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LoggingPlatform.dllFilesize
504KB
MD54ffef06099812f4f86d1280d69151a3f
SHA1e5da93b4e0cf14300701a0efbd7caf80b86621c3
SHA256d5a538a0a036c602492f9b2b6f85de59924da9ec3ed7a7bbf6ecd0979bee54d3
SHA512d667fd0ae46039914f988eb7e407344114944a040468e4ec5a53d562db2c3241737566308d8420bb4f7c89c6ef446a7881b83eaac7daba3271b81754c5c0f34a
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\MSVCP140.dllFilesize
425KB
MD5ce8a66d40621f89c5a639691db3b96b4
SHA1b5f26f17ddd08e1ba73c57635c20c56aaa46b435
SHA256545bb4a00b29b4b5d25e16e1d0969e99b4011033ce3d1d7e827abef09dd317e7
SHA51285fc18e75e4c7f26a2c83578356b1947e12ec002510a574da86ad62114f1640128e58a6858603189317c77059c71ac0824f10b6117fa1c83af76ee480d36b671
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\Telemetry.dllFilesize
451KB
MD550ea1cd5e09e3e2002fadb02d67d8ce6
SHA1c4515f089a4615d920971b28833ec739e3c329f3
SHA256414f6f64d463b3eb1e9eb21d9455837c99c7d9097f6bb61bd12c71e8dce62902
SHA512440ededc1389b253f3a31c4f188fda419daf2f58096cf73cad3e72a746bdcde6bde049ce74c1eb521909d700d50fbfddbf802ead190cd54927ea03b5d0ce81b3
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\Telemetry.dllFilesize
451KB
MD550ea1cd5e09e3e2002fadb02d67d8ce6
SHA1c4515f089a4615d920971b28833ec739e3c329f3
SHA256414f6f64d463b3eb1e9eb21d9455837c99c7d9097f6bb61bd12c71e8dce62902
SHA512440ededc1389b253f3a31c4f188fda419daf2f58096cf73cad3e72a746bdcde6bde049ce74c1eb521909d700d50fbfddbf802ead190cd54927ea03b5d0ce81b3
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\UpdateRingSettings.dllFilesize
432KB
MD5037df27be847ef8ab259be13e98cdd59
SHA1d5541dfa2454a5d05c835ec5303c84628f48e7b2
SHA2569fb3abcafd8e8b1deb13ec0f46c87b759a1cb610b2488052ba70e3363f1935ec
SHA5127e1a04368ec469e4059172c5b44fd08d4ea3d01df98bfd6d4cc91ac45f381862ecf89fe9c6bedce985a12158d840cd6cfa06ce9d22466fbf6110140465002205
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\UpdateRingSettings.dllFilesize
432KB
MD5037df27be847ef8ab259be13e98cdd59
SHA1d5541dfa2454a5d05c835ec5303c84628f48e7b2
SHA2569fb3abcafd8e8b1deb13ec0f46c87b759a1cb610b2488052ba70e3363f1935ec
SHA5127e1a04368ec469e4059172c5b44fd08d4ea3d01df98bfd6d4cc91ac45f381862ecf89fe9c6bedce985a12158d840cd6cfa06ce9d22466fbf6110140465002205
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\VCRUNTIME140.dllFilesize
73KB
MD5cefcd5d1f068c4265c3976a4621543d4
SHA14d874d6d6fa19e0476a229917c01e7c1dd5ceacd
SHA256c79241aec5e35cba91563c3b33ed413ce42309f5145f25dc92caf9c82a753817
SHA512d934c43f1bd47c5900457642b3cbdcd43643115cd3e78b244f3a28fee5eea373e65b6e1cb764e356839090ce4a7a85d74f2b7631c48741d88cf44c9703114ec9
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\msvcp140.dllFilesize
425KB
MD5ce8a66d40621f89c5a639691db3b96b4
SHA1b5f26f17ddd08e1ba73c57635c20c56aaa46b435
SHA256545bb4a00b29b4b5d25e16e1d0969e99b4011033ce3d1d7e827abef09dd317e7
SHA51285fc18e75e4c7f26a2c83578356b1947e12ec002510a574da86ad62114f1640128e58a6858603189317c77059c71ac0824f10b6117fa1c83af76ee480d36b671
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\vcruntime140.dllFilesize
73KB
MD5cefcd5d1f068c4265c3976a4621543d4
SHA14d874d6d6fa19e0476a229917c01e7c1dd5ceacd
SHA256c79241aec5e35cba91563c3b33ed413ce42309f5145f25dc92caf9c82a753817
SHA512d934c43f1bd47c5900457642b3cbdcd43643115cd3e78b244f3a28fee5eea373e65b6e1cb764e356839090ce4a7a85d74f2b7631c48741d88cf44c9703114ec9
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\vcruntime140.dllFilesize
73KB
MD5cefcd5d1f068c4265c3976a4621543d4
SHA14d874d6d6fa19e0476a229917c01e7c1dd5ceacd
SHA256c79241aec5e35cba91563c3b33ed413ce42309f5145f25dc92caf9c82a753817
SHA512d934c43f1bd47c5900457642b3cbdcd43643115cd3e78b244f3a28fee5eea373e65b6e1cb764e356839090ce4a7a85d74f2b7631c48741d88cf44c9703114ec9
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\vcruntime140.dllFilesize
73KB
MD5cefcd5d1f068c4265c3976a4621543d4
SHA14d874d6d6fa19e0476a229917c01e7c1dd5ceacd
SHA256c79241aec5e35cba91563c3b33ed413ce42309f5145f25dc92caf9c82a753817
SHA512d934c43f1bd47c5900457642b3cbdcd43643115cd3e78b244f3a28fee5eea373e65b6e1cb764e356839090ce4a7a85d74f2b7631c48741d88cf44c9703114ec9
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exeFilesize
2.3MB
MD5c2938eb5ff932c2540a1514cc82c197c
SHA12d7da1c3bfa4755ba0efec5317260d239cbb51c3
SHA2565d8273bf98397e4c5053f8f154e5f838c7e8a798b125fcad33cab16e2515b665
SHA5125deb54462615e39cf7871418871856094031a383e9ad82d5a5993f1e67b7ade7c2217055b657c0d127189792c3bcf6c1fcfbd3c5606f6134adfafcccfa176441
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeFilesize
40.2MB
MD5fb4aa59c92c9b3263eb07e07b91568b5
SHA16071a3e3c4338b90d892a8416b6a92fbfe25bb67
SHA256e70e80dbbc9baba7ddcee70eda1bb8d0e6612dfb1d93827fe7b594a59f3b48b9
SHA51260aabbe2fd24c04c33e7892eab64f24f8c335a0dd9822eb01adc5459e850769fc200078c5ccee96c1f2013173bc41f5a2023def3f5fe36e380963db034924ace
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeFilesize
40.2MB
MD5fb4aa59c92c9b3263eb07e07b91568b5
SHA16071a3e3c4338b90d892a8416b6a92fbfe25bb67
SHA256e70e80dbbc9baba7ddcee70eda1bb8d0e6612dfb1d93827fe7b594a59f3b48b9
SHA51260aabbe2fd24c04c33e7892eab64f24f8c335a0dd9822eb01adc5459e850769fc200078c5ccee96c1f2013173bc41f5a2023def3f5fe36e380963db034924ace
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeFilesize
40.2MB
MD5fb4aa59c92c9b3263eb07e07b91568b5
SHA16071a3e3c4338b90d892a8416b6a92fbfe25bb67
SHA256e70e80dbbc9baba7ddcee70eda1bb8d0e6612dfb1d93827fe7b594a59f3b48b9
SHA51260aabbe2fd24c04c33e7892eab64f24f8c335a0dd9822eb01adc5459e850769fc200078c5ccee96c1f2013173bc41f5a2023def3f5fe36e380963db034924ace
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\setup\logs\DeviceHealthSummaryConfiguration.iniFilesize
77B
MD5ab41a7ab9cb5375b8a87703457e71b57
SHA13d86d640598ad2d13007bf367019cbbb20c5cb30
SHA25684b3ea000ffc8ef547d7c9c0d51ea4319ea46412d8a83bba4a6f1d7eb9ad568a
SHA512e44807fb76dc6e883fbdb9cc649f791c98d5ae8b3ab832b0c60e589cc52a5655a2e57450dfab38b6c7c9b277078879be768570d0f4e736cacbfedfd6099edfeb
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\CachesMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\Downloads\DDESPY.exeFilesize
352KB
MD5b533fc9cfda3888740620496b33884f7
SHA11d465e0f9c15d800970a8b6eb41ac9629f1e5ffd
SHA256462edcb29a4fa41f3e9c20910731c6b97939963fad61eab464aa98d140bda7c7
SHA51208c75882e65bdab22a110763703d89b5cb7ea03484280d9d157c0a411d54f8444f682db9c49a5ff6daf467cbce09d5ae5574187f0f286f6102c30a108dd0c9a0
-
C:\Users\Admin\Downloads\DDESPY.exeFilesize
352KB
MD5b533fc9cfda3888740620496b33884f7
SHA11d465e0f9c15d800970a8b6eb41ac9629f1e5ffd
SHA256462edcb29a4fa41f3e9c20910731c6b97939963fad61eab464aa98d140bda7c7
SHA51208c75882e65bdab22a110763703d89b5cb7ea03484280d9d157c0a411d54f8444f682db9c49a5ff6daf467cbce09d5ae5574187f0f286f6102c30a108dd0c9a0
-
C:\Users\Admin\Downloads\DDESPY.exeFilesize
352KB
MD5b533fc9cfda3888740620496b33884f7
SHA11d465e0f9c15d800970a8b6eb41ac9629f1e5ffd
SHA256462edcb29a4fa41f3e9c20910731c6b97939963fad61eab464aa98d140bda7c7
SHA51208c75882e65bdab22a110763703d89b5cb7ea03484280d9d157c0a411d54f8444f682db9c49a5ff6daf467cbce09d5ae5574187f0f286f6102c30a108dd0c9a0
-
C:\Windows\ddespy.iniFilesize
284B
MD57dfb5ff2637b3610e8b6a8878f50fe90
SHA1b34f6d03e15a97bab9a2d39cc13160ca7b5fbba9
SHA256efde8cacd66a90ce7db7d162e6d8ca15b6c0f4e6e7676609596a564032f4326a
SHA512c32ec49cd08be9967df7526a09beb179e787f4a631ef5665ac54069466379903ddda138c66a946c56ecb1eaa3d254b4835ccd0072ab4a31d33f63cafaedc1976
-
\??\pipe\crashpad_2536_HKOMBLAUTNLWFXZYMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/1972-148-0x0000000000000000-mapping.dmp
-
memory/2828-170-0x0000000003CF0000-0x0000000003D00000-memory.dmpFilesize
64KB
-
memory/2828-168-0x0000000000000000-mapping.dmp
-
memory/3220-151-0x0000000000000000-mapping.dmp
-
memory/3824-183-0x00007FF9C8470000-0x00007FF9C8480000-memory.dmpFilesize
64KB
-
memory/3824-178-0x00007FF9C5D20000-0x00007FF9C5D30000-memory.dmpFilesize
64KB
-
memory/3824-173-0x00007FF9C8470000-0x00007FF9C8480000-memory.dmpFilesize
64KB
-
memory/3824-184-0x00007FF9C8470000-0x00007FF9C8480000-memory.dmpFilesize
64KB
-
memory/3824-182-0x00007FF9C8470000-0x00007FF9C8480000-memory.dmpFilesize
64KB
-
memory/3824-181-0x00007FF9C8470000-0x00007FF9C8480000-memory.dmpFilesize
64KB
-
memory/3824-179-0x00007FF9C5D20000-0x00007FF9C5D30000-memory.dmpFilesize
64KB
-
memory/3824-175-0x00007FF9C8470000-0x00007FF9C8480000-memory.dmpFilesize
64KB
-
memory/3824-174-0x00007FF9C8470000-0x00007FF9C8480000-memory.dmpFilesize
64KB
-
memory/3824-177-0x00007FF9C8470000-0x00007FF9C8480000-memory.dmpFilesize
64KB
-
memory/3824-176-0x00007FF9C8470000-0x00007FF9C8480000-memory.dmpFilesize
64KB
-
memory/3968-172-0x0000000000000000-mapping.dmp
-
memory/4128-171-0x0000000000000000-mapping.dmp
-
memory/4592-154-0x0000000000000000-mapping.dmp
-
memory/4708-185-0x0000000000000000-mapping.dmp
-
memory/4724-187-0x00007FF9C8470000-0x00007FF9C8480000-memory.dmpFilesize
64KB
-
memory/4724-194-0x00007FF9C8470000-0x00007FF9C8480000-memory.dmpFilesize
64KB
-
memory/4724-197-0x00007FF9C8470000-0x00007FF9C8480000-memory.dmpFilesize
64KB
-
memory/4724-196-0x00007FF9C8470000-0x00007FF9C8480000-memory.dmpFilesize
64KB
-
memory/4724-195-0x00007FF9C8470000-0x00007FF9C8480000-memory.dmpFilesize
64KB
-
memory/4724-190-0x00007FF9C8470000-0x00007FF9C8480000-memory.dmpFilesize
64KB
-
memory/4724-189-0x00007FF9C8470000-0x00007FF9C8480000-memory.dmpFilesize
64KB
-
memory/4724-188-0x00007FF9C8470000-0x00007FF9C8480000-memory.dmpFilesize
64KB
-
memory/4724-186-0x00007FF9C8470000-0x00007FF9C8480000-memory.dmpFilesize
64KB
-
memory/5040-133-0x00007FF9C8470000-0x00007FF9C8480000-memory.dmpFilesize
64KB
-
memory/5040-143-0x00007FF9C8470000-0x00007FF9C8480000-memory.dmpFilesize
64KB
-
memory/5040-136-0x00007FF9C5D20000-0x00007FF9C5D30000-memory.dmpFilesize
64KB
-
memory/5040-135-0x00007FF9C5D20000-0x00007FF9C5D30000-memory.dmpFilesize
64KB
-
memory/5040-142-0x00007FF9C8470000-0x00007FF9C8480000-memory.dmpFilesize
64KB
-
memory/5040-134-0x00007FF9C8470000-0x00007FF9C8480000-memory.dmpFilesize
64KB
-
memory/5040-130-0x00007FF9C8470000-0x00007FF9C8480000-memory.dmpFilesize
64KB
-
memory/5040-144-0x00007FF9C8470000-0x00007FF9C8480000-memory.dmpFilesize
64KB
-
memory/5040-132-0x00007FF9C8470000-0x00007FF9C8480000-memory.dmpFilesize
64KB
-
memory/5040-131-0x00007FF9C8470000-0x00007FF9C8480000-memory.dmpFilesize
64KB
-
memory/5040-145-0x00007FF9C8470000-0x00007FF9C8480000-memory.dmpFilesize
64KB
-
memory/5556-203-0x00007FF9C5D20000-0x00007FF9C5D30000-memory.dmpFilesize
64KB
-
memory/5556-204-0x00007FF9C5D20000-0x00007FF9C5D30000-memory.dmpFilesize
64KB