Analysis
-
max time kernel
1190s -
max time network
1203s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
08-09-2022 21:11
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://google.com
Resource
win10-20220812-en
General
-
Target
http://google.com
Malware Config
Extracted
C:\Program Files (x86)\WinRAR\Rar.txt
-n@inclist.txt
Extracted
C:\Program Files (x86)\WinRAR\WhatsNew.txt
https
http
http://weirdsgn.com
http://icondesignlab.com
https://rarlab.com/themes/WinRAR_Classic_48x36.theme.rar
Extracted
C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\@Please_Read_Me@.txt
wannacry
12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw
Extracted
redline
@qkies_new
185.106.92.226:40788
-
auth_value
5f7830eb916fd279a18af5cfd263c4e5
Extracted
redline
@lovelopfy
185.106.92.226:40788
-
auth_value
bfdb82ba515e153efb45d9a22230c5b9
Signatures
-
Modifies system executable filetype association 2 TTPs 8 IoCs
Processes:
uninstall.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} uninstall.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/102748-481-0x000000000055ADD6-mapping.dmp family_redline behavioral1/memory/102748-519-0x0000000000540000-0x0000000000560000-memory.dmp family_redline behavioral1/memory/8688-1054-0x000000000041ADD2-mapping.dmp family_redline behavioral1/memory/8688-1092-0x0000000000400000-0x0000000000420000-memory.dmp family_redline -
Wannacry
WannaCry is a ransomware cryptoworm.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Downloads MZ/PE file
-
Executes dropped EXE 64 IoCs
Processes:
winrar-x32-611.exeuninstall.exeWinRAR.exesetup.exeWinRAR.exegta 5 mod menu free.exeCheatEngine74.exeCheatEngine74.tmpCheatEngine74.exeCheatEngine74.tmp_setup64.tmpKernelmoduleunloader.exewindowsrepair.exeCheat Engine.execheatengine-x86_64-SSE4-AVX2.exeTutorial-i386.exeWinRAR.exeWannaCry.EXEtaskdl.exe@WanaDecryptor@.exe@WanaDecryptor@.exetaskhsvc.exetaskse.exetaskdl.exe@WanaDecryptor@.exetaskdl.exetaskse.exe@WanaDecryptor@.exetaskdl.exetaskse.exe@WanaDecryptor@.exetaskdl.exetaskse.exe@WanaDecryptor@.exeChromeRecovery.exetaskdl.exetaskse.exe@WanaDecryptor@.exetaskdl.exetaskse.exe@WanaDecryptor@.exetaskdl.exetaskse.exe@WanaDecryptor@.exetaskdl.exetaskse.exe@WanaDecryptor@.exetaskdl.exetaskse.exe@WanaDecryptor@.exetaskdl.exetaskse.exe@WanaDecryptor@.exeWinRAR.exetaskdl.exetaskse.exe@WanaDecryptor@.exetaskdl.exetaskse.exe@WanaDecryptor@.exetaskdl.exe@WanaDecryptor@.exetaskse.exetaskdl.exepid process 3784 winrar-x32-611.exe 3752 uninstall.exe 4720 WinRAR.exe 4416 setup.exe 9428 WinRAR.exe 9892 gta 5 mod menu free.exe 11384 CheatEngine74.exe 11560 CheatEngine74.tmp 12020 CheatEngine74.exe 12200 CheatEngine74.tmp 12692 _setup64.tmp 12804 Kernelmoduleunloader.exe 12992 windowsrepair.exe 13380 Cheat Engine.exe 13672 cheatengine-x86_64-SSE4-AVX2.exe 13760 Tutorial-i386.exe 15252 WinRAR.exe 15724 WannaCry.EXE 16072 taskdl.exe 16696 @WanaDecryptor@.exe 16972 @WanaDecryptor@.exe 17228 taskhsvc.exe 18236 taskse.exe 18248 taskdl.exe 18260 @WanaDecryptor@.exe 18856 taskdl.exe 18924 taskse.exe 18936 @WanaDecryptor@.exe 19308 taskdl.exe 19392 taskse.exe 19404 @WanaDecryptor@.exe 19788 taskdl.exe 19836 taskse.exe 19848 @WanaDecryptor@.exe 20292 ChromeRecovery.exe 20596 taskdl.exe 20644 taskse.exe 20656 @WanaDecryptor@.exe 20944 taskdl.exe 20992 taskse.exe 21004 @WanaDecryptor@.exe 21276 taskdl.exe 21324 taskse.exe 21336 @WanaDecryptor@.exe 21644 taskdl.exe 21692 taskse.exe 21700 @WanaDecryptor@.exe 21960 taskdl.exe 22004 taskse.exe 22012 @WanaDecryptor@.exe 22272 taskdl.exe 22316 taskse.exe 22324 @WanaDecryptor@.exe 22788 WinRAR.exe 23212 taskdl.exe 23264 taskse.exe 23272 @WanaDecryptor@.exe 23580 taskdl.exe 23624 taskse.exe 23632 @WanaDecryptor@.exe 23884 taskdl.exe 23936 @WanaDecryptor@.exe 23928 taskse.exe 24204 taskdl.exe -
Modifies extensions of user files 6 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
WannaCry.EXEdescription ioc process File renamed C:\Users\Admin\Pictures\TestBackup.raw.WNCRYT => C:\Users\Admin\Pictures\TestBackup.raw.WNCRY WannaCry.EXE File opened for modification C:\Users\Admin\Pictures\TestBackup.raw.WNCRY WannaCry.EXE File created C:\Users\Admin\Pictures\ApproveConvert.raw.WNCRYT WannaCry.EXE File renamed C:\Users\Admin\Pictures\ApproveConvert.raw.WNCRYT => C:\Users\Admin\Pictures\ApproveConvert.raw.WNCRY WannaCry.EXE File opened for modification C:\Users\Admin\Pictures\ApproveConvert.raw.WNCRY WannaCry.EXE File created C:\Users\Admin\Pictures\TestBackup.raw.WNCRYT WannaCry.EXE -
Registers COM server for autorun 1 TTPs 3 IoCs
Processes:
uninstall.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ = "C:\\Program Files (x86)\\WinRAR\\rarext64.dll" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ThreadingModel = "Apartment" uninstall.exe -
Stops running service(s) 3 TTPs
-
Drops startup file 2 IoCs
Processes:
WannaCry.EXEdescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD466E.tmp WannaCry.EXE File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD4676.tmp WannaCry.EXE -
Loads dropped DLL 21 IoCs
Processes:
CheatEngine74.tmpcheatengine-x86_64-SSE4-AVX2.exetaskhsvc.exepid process 2336 11560 CheatEngine74.tmp 11560 CheatEngine74.tmp 11560 CheatEngine74.tmp 13672 cheatengine-x86_64-SSE4-AVX2.exe 13672 cheatengine-x86_64-SSE4-AVX2.exe 13672 cheatengine-x86_64-SSE4-AVX2.exe 13672 cheatengine-x86_64-SSE4-AVX2.exe 13672 cheatengine-x86_64-SSE4-AVX2.exe 13672 cheatengine-x86_64-SSE4-AVX2.exe 13672 cheatengine-x86_64-SSE4-AVX2.exe 13672 cheatengine-x86_64-SSE4-AVX2.exe 13672 cheatengine-x86_64-SSE4-AVX2.exe 17228 taskhsvc.exe 17228 taskhsvc.exe 17228 taskhsvc.exe 17228 taskhsvc.exe 17228 taskhsvc.exe 17228 taskhsvc.exe 17228 taskhsvc.exe 2336 -
Modifies file permissions 1 TTPs 3 IoCs
Processes:
icacls.exeicacls.exeicacls.exepid process 12736 icacls.exe 13104 icacls.exe 15836 icacls.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\zbgottfhrm154 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Rar$EXb15252.4438\\tasksche.exe\"" reg.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 236 freegeoip.app -
Drops file in System32 directory 64 IoCs
Processes:
cheatengine-x86_64-SSE4-AVX2.exedescription ioc process File opened for modification C:\Windows\SysWOW64\riched20.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SysWOW64\profapi.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SysWOW64\DevDispItemProvider.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SYSTEM32\wsock32.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\System32\powrprof.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\System32\psapi.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SYSTEM32\msimg32.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SysWOW64\wkscli.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\System32\shcore.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\System32\KERNEL32.DLL cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SysWOW64\ole32.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SysWOW64\CoreUIComponents.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SYSTEM32\ntdll.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SysWOW64\davclnt.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SysWOW64\bcryptPrimitives.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SysWOW64\MPR.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SysWOW64\cscapi.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SysWOW64\MFPlat.DLL cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SysWOW64\DPAPI.DLL cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SysWOW64\edputil.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\System32\imagehlp.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\System32\user32.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SysWOW64\USER32.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SysWOW64\RPCRT4.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SysWOW64\SHELL32.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SysWOW64\windows.storage.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SysWOW64\ntlanman.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SysWOW64\MSASN1.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\System32\bcryptPrimitives.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SysWOW64\policymanager.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SysWOW64\wintypes.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SysWOW64\SETUPAPI.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\System32\profapi.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\System32\GDI32.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SYSTEM32\uxtheme.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SYSTEM32\opengl32.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SysWOW64\shcore.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SysWOW64\clbcatq.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SysWOW64\dcomp.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SysWOW64\dlnashext.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\System32\oleaut32.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SysWOW64\WMVCore.DLL cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SysWOW64\MMDevApi.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\system32\shfolder.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SysWOW64\GDI32.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SysWOW64\CoreMessaging.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\System32\msvcrt.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SYSTEM32\hhctrl.ocx cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SysWOW64\WINSTA.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SysWOW64\WINTRUST.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\System32\cfgmgr32.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\System32\shlwapi.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SysWOW64\explorerframe.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SysWOW64\WindowsCodecs.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SYSTEM32\wininet.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SysWOW64\cfgmgr32.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SysWOW64\dataexchange.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SysWOW64\OneCoreUAPCommonProxyStub.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\System32\kernel.appcore.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\System32\clbcatq.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SysWOW64\powrprof.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SysWOW64\IMM32.DLL cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SysWOW64\audiodev.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SysWOW64\RTWorkQ.DLL cheatengine-x86_64-SSE4-AVX2.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
Processes:
WannaCry.EXE@WanaDecryptor@.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@WanaDecryptor@.bmp" WannaCry.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@WanaDecryptor@.bmp" @WanaDecryptor@.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
setup.exegta 5 mod menu free.exedescription pid process target process PID 4416 set thread context of 102748 4416 setup.exe AppLaunch.exe PID 9892 set thread context of 8688 9892 gta 5 mod menu free.exe AppLaunch.exe -
Drops file in Program Files directory 64 IoCs
Processes:
CheatEngine74.tmpwinrar-x32-611.exeelevation_service.exedescription ioc process File created C:\Program Files\Cheat Engine 7.4\is-NI3SO.tmp CheatEngine74.tmp File created C:\Program Files\Cheat Engine 7.4\include\winapi\is-1VCPS.tmp CheatEngine74.tmp File created C:\Program Files\Cheat Engine 7.4\clibs32\is-U783H.tmp CheatEngine74.tmp File created C:\Program Files (x86)\WinRAR\License.txt winrar-x32-611.exe File created C:\Program Files (x86)\WinRAR\RarExt64.dll winrar-x32-611.exe File opened for modification C:\Program Files\Cheat Engine 7.4\Cheat Engine.exe CheatEngine74.tmp File opened for modification C:\Program Files\Cheat Engine 7.4\allochook-i386.dll CheatEngine74.tmp File opened for modification C:\Program Files\Cheat Engine 7.4\libipt-32.dll CheatEngine74.tmp File created C:\Program Files\Cheat Engine 7.4\plugins\is-3NI6O.tmp CheatEngine74.tmp File created C:\Program Files\Cheat Engine 7.4\plugins\c# template\CEPluginLibrary\is-3IURD.tmp CheatEngine74.tmp File created C:\Program Files\Cheat Engine 7.4\include\is-HDMKI.tmp CheatEngine74.tmp File opened for modification C:\Program Files\Cheat Engine 7.4\unins000.dat CheatEngine74.tmp File created C:\Program Files (x86)\WinRAR\Rar.exe winrar-x32-611.exe File created C:\Program Files (x86)\WinRAR\WinRAR.exe winrar-x32-611.exe File opened for modification C:\Program Files\Cheat Engine 7.4\win32\symsrv.dll CheatEngine74.tmp File created C:\Program Files\Cheat Engine 7.4\unins000.dat CheatEngine74.tmp File created C:\Program Files\Cheat Engine 7.4\is-4M2GE.tmp CheatEngine74.tmp File created C:\Program Files\Cheat Engine 7.4\autorun\dlls\src\Common\is-M4D0J.tmp CheatEngine74.tmp File created C:\Program Files\Cheat Engine 7.4\is-IE392.tmp CheatEngine74.tmp File opened for modification C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir20252_1071291561\_metadata\verified_contents.json elevation_service.exe File opened for modification C:\Program Files (x86)\WinRAR\ReadMe.txt winrar-x32-611.exe File created C:\Program Files (x86)\WinRAR\Order.htm winrar-x32-611.exe File created C:\Program Files\Cheat Engine 7.4\is-O38RH.tmp CheatEngine74.tmp File created C:\Program Files\Cheat Engine 7.4\include\winapi\is-NIC54.tmp CheatEngine74.tmp File created C:\Program Files\Cheat Engine 7.4\is-ABLA6.tmp CheatEngine74.tmp File created C:\Program Files\Cheat Engine 7.4\include\is-N4B4M.tmp CheatEngine74.tmp File created C:\Program Files\Cheat Engine 7.4\include\is-A6HT2.tmp CheatEngine74.tmp File created C:\Program Files\Cheat Engine 7.4\plugins\example-c\is-KFUEK.tmp CheatEngine74.tmp File opened for modification C:\Program Files (x86)\WinRAR\Descript.ion winrar-x32-611.exe File created C:\Program Files (x86)\WinRAR\Uninstall.exe winrar-x32-611.exe File opened for modification C:\Program Files\Cheat Engine 7.4\ced3d11hook.dll CheatEngine74.tmp File created C:\Program Files\Cheat Engine 7.4\is-5AP5L.tmp CheatEngine74.tmp File created C:\Program Files\Cheat Engine 7.4\is-GOQG3.tmp CheatEngine74.tmp File created C:\Program Files\Cheat Engine 7.4\is-TDI0U.tmp CheatEngine74.tmp File created C:\Program Files\Cheat Engine 7.4\autorun\is-BHD86.tmp CheatEngine74.tmp File created C:\Program Files\Cheat Engine 7.4\plugins\example-c\is-GV8NC.tmp CheatEngine74.tmp File created C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir20252_1071291561\manifest.json elevation_service.exe File created C:\Program Files\Cheat Engine 7.4\include\is-J6GSA.tmp CheatEngine74.tmp File created C:\Program Files\Cheat Engine 7.4\include\is-61TDG.tmp CheatEngine74.tmp File created C:\Program Files\Cheat Engine 7.4\include\winapi\is-H9BQH.tmp CheatEngine74.tmp File created C:\Program Files\Cheat Engine 7.4\is-9HTEL.tmp CheatEngine74.tmp File created C:\Program Files\Cheat Engine 7.4\languages\is-078BB.tmp CheatEngine74.tmp File opened for modification C:\Program Files (x86)\WinRAR\WinRAR.exe winrar-x32-611.exe File created C:\Program Files\Cheat Engine 7.4\include\is-CCVD4.tmp CheatEngine74.tmp File created C:\Program Files\Cheat Engine 7.4\is-031VS.tmp CheatEngine74.tmp File created C:\Program Files\Cheat Engine 7.4\autorun\ceshare\is-J5O2J.tmp CheatEngine74.tmp File created C:\Program Files\Cheat Engine 7.4\autorun\dlls\src\Mono\MonoDataCollector\is-GAP0R.tmp CheatEngine74.tmp File created C:\Program Files\Cheat Engine 7.4\autorun\is-D84EF.tmp CheatEngine74.tmp File created C:\Program Files\Cheat Engine 7.4\autorun\is-ISS14.tmp CheatEngine74.tmp File created C:\Program Files\Cheat Engine 7.4\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-D77VG.tmp CheatEngine74.tmp File opened for modification C:\Program Files\Cheat Engine 7.4\win64\dbghelp.dll CheatEngine74.tmp File opened for modification C:\Program Files\Cheat Engine 7.4\Tutorial-i386.exe CheatEngine74.tmp File opened for modification C:\Program Files\Cheat Engine 7.4\lua53-64.dll CheatEngine74.tmp File created C:\Program Files\Cheat Engine 7.4\win64\is-HQMRK.tmp CheatEngine74.tmp File created C:\Program Files\Cheat Engine 7.4\is-13CCH.tmp CheatEngine74.tmp File created C:\Program Files\Cheat Engine 7.4\autorun\dlls\src\Mono\MonoDataCollector\is-B8JJ4.tmp CheatEngine74.tmp File created C:\Program Files\Cheat Engine 7.4\plugins\is-87KBG.tmp CheatEngine74.tmp File created C:\Program Files\Cheat Engine 7.4\autorun\dlls\src\Mono\MonoDataCollector\is-1RTRR.tmp CheatEngine74.tmp File created C:\Program Files\Cheat Engine 7.4\plugins\c# template\CEPluginLibrary\SDK\is-SS9TS.tmp CheatEngine74.tmp File opened for modification C:\Program Files\Cheat Engine 7.4\libmikmod64.dll CheatEngine74.tmp File opened for modification C:\Program Files\Cheat Engine 7.4\libmikmod32.dll CheatEngine74.tmp File created C:\Program Files\Cheat Engine 7.4\is-3BHOM.tmp CheatEngine74.tmp File created C:\Program Files\Cheat Engine 7.4\include\sec_api\is-8LUF4.tmp CheatEngine74.tmp File created C:\Program Files\Cheat Engine 7.4\languages\is-HI3A8.tmp CheatEngine74.tmp -
Drops file in Windows directory 3 IoCs
Processes:
cheatengine-x86_64-SSE4-AVX2.exedescription ioc process File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.15063.0_none_108e4f62dfe5d999\comctl32.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.15063.0_none_583b8639f462029f\COMCTL32.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.15063.0_none_d802f55807fa1ec7\gdiplus.dll cheatengine-x86_64-SSE4-AVX2.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exepid process 12600 sc.exe 12644 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 102840 4416 WerFault.exe setup.exe 8804 9892 WerFault.exe gta 5 mod menu free.exe 14012 13760 WerFault.exe Tutorial-i386.exe -
Checks processor information in registry 2 TTPs 7 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
firefox.exeCheatEngine74.tmpdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 CheatEngine74.tmp Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ CheatEngine74.tmp Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 17700 vssadmin.exe -
Processes:
iexplore.exeIEXPLORE.EXEWinRAR.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch WinRAR.exe Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" WinRAR.exe Set value (int) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{91884557-2FCB-11ED-A7A3-72FCFC427ACC} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Modifies registry class 64 IoCs
Processes:
uninstall.exechrome.execheatengine-x86_64-SSE4-AVX2.exeWinRAR.exeCheatEngine74.tmpWinRAR.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r19 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bz2\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA} uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r09\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r29\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.rev\ = "WinRAR.REV" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r12\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r16\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.txz\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon uninstall.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\3\0\NodeSlot = "6" cheatengine-x86_64-SSE4-AVX2.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance WinRAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CheatEngine\shell\open\command CheatEngine74.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance WinRAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r09 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.zip\ShellNew uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon uninstall.exe Set value (data) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 cheatengine-x86_64-SSE4-AVX2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r16 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.xz uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon\ = "C:\\Program Files (x86)\\WinRAR\\WinRAR.exe,0" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.zip\ShellNew\FileName = "C:\\Program Files (x86)\\WinRAR\\zipnew.dat" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tlz\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r08 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r25\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cab uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.cab\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.taz uninstall.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings cheatengine-x86_64-SSE4-AVX2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r07\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r24\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ShellNew uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.uu\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CheatEngine\shell\open\command\ = "\"C:\\Program Files\\Cheat Engine 7.4\\Cheat Engine.exe\" \"%1\"" CheatEngine74.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.zipx\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open uninstall.exe Set value (data) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\3 = 14002e80922b16d365937a46956b92703aca08af0000 cheatengine-x86_64-SSE4-AVX2.exe Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" cheatengine-x86_64-SSE4-AVX2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.uu uninstall.exe Set value (int) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1" cheatengine-x86_64-SSE4-AVX2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r26\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r00\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CheatEngine\shell\open CheatEngine74.tmp Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg cheatengine-x86_64-SSE4-AVX2.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell cheatengine-x86_64-SSE4-AVX2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r01\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r02\ = "WinRAR" uninstall.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs net.exe
-
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 677 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 682 Cheat Engine 7.4 : luascript-ceshare -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
chrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exeAppLaunch.exechrome.exeAppLaunch.exechrome.exechrome.exeCheatEngine74.tmpCheatEngine74.tmpcheatengine-x86_64-SSE4-AVX2.exechrome.exetaskhsvc.exechrome.exepid process 4080 chrome.exe 4080 chrome.exe 4792 chrome.exe 4792 chrome.exe 1620 chrome.exe 1620 chrome.exe 4656 chrome.exe 4656 chrome.exe 2472 chrome.exe 2472 chrome.exe 4460 chrome.exe 4460 chrome.exe 4544 chrome.exe 4544 chrome.exe 3752 chrome.exe 3752 chrome.exe 3988 chrome.exe 3988 chrome.exe 5052 chrome.exe 5052 chrome.exe 4440 chrome.exe 4440 chrome.exe 4792 chrome.exe 4792 chrome.exe 1828 chrome.exe 1828 chrome.exe 3812 chrome.exe 3812 chrome.exe 3956 chrome.exe 3956 chrome.exe 103208 chrome.exe 103208 chrome.exe 103208 chrome.exe 103208 chrome.exe 102748 AppLaunch.exe 102748 AppLaunch.exe 7824 chrome.exe 7824 chrome.exe 8688 AppLaunch.exe 8688 AppLaunch.exe 11200 chrome.exe 11200 chrome.exe 11312 chrome.exe 11312 chrome.exe 11560 CheatEngine74.tmp 11560 CheatEngine74.tmp 12200 CheatEngine74.tmp 12200 CheatEngine74.tmp 13672 cheatengine-x86_64-SSE4-AVX2.exe 13672 cheatengine-x86_64-SSE4-AVX2.exe 13672 cheatengine-x86_64-SSE4-AVX2.exe 13672 cheatengine-x86_64-SSE4-AVX2.exe 13672 cheatengine-x86_64-SSE4-AVX2.exe 13672 cheatengine-x86_64-SSE4-AVX2.exe 15204 chrome.exe 15204 chrome.exe 17228 taskhsvc.exe 17228 taskhsvc.exe 17228 taskhsvc.exe 17228 taskhsvc.exe 17228 taskhsvc.exe 17228 taskhsvc.exe 22732 chrome.exe 22732 chrome.exe -
Suspicious behavior: GetForegroundWindowSpam 5 IoCs
Processes:
WinRAR.exeWinRAR.execheatengine-x86_64-SSE4-AVX2.exeWinRAR.exeWinRAR.exepid process 4720 WinRAR.exe 9428 WinRAR.exe 13672 cheatengine-x86_64-SSE4-AVX2.exe 15252 WinRAR.exe 22788 WinRAR.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs
Processes:
chrome.exepid process 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
AUDIODG.EXEAppLaunch.exefirefox.exeAppLaunch.execheatengine-x86_64-SSE4-AVX2.exevssvc.exeWMIC.exedescription pid process Token: 33 1936 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1936 AUDIODG.EXE Token: SeDebugPrivilege 102748 AppLaunch.exe Token: SeDebugPrivilege 7928 firefox.exe Token: SeDebugPrivilege 7928 firefox.exe Token: SeDebugPrivilege 8688 AppLaunch.exe Token: SeDebugPrivilege 13672 cheatengine-x86_64-SSE4-AVX2.exe Token: SeTcbPrivilege 13672 cheatengine-x86_64-SSE4-AVX2.exe Token: SeTcbPrivilege 13672 cheatengine-x86_64-SSE4-AVX2.exe Token: SeLoadDriverPrivilege 13672 cheatengine-x86_64-SSE4-AVX2.exe Token: SeCreateGlobalPrivilege 13672 cheatengine-x86_64-SSE4-AVX2.exe Token: SeLockMemoryPrivilege 13672 cheatengine-x86_64-SSE4-AVX2.exe Token: 33 13672 cheatengine-x86_64-SSE4-AVX2.exe Token: SeSecurityPrivilege 13672 cheatengine-x86_64-SSE4-AVX2.exe Token: SeTakeOwnershipPrivilege 13672 cheatengine-x86_64-SSE4-AVX2.exe Token: SeManageVolumePrivilege 13672 cheatengine-x86_64-SSE4-AVX2.exe Token: SeBackupPrivilege 13672 cheatengine-x86_64-SSE4-AVX2.exe Token: SeCreatePagefilePrivilege 13672 cheatengine-x86_64-SSE4-AVX2.exe Token: SeShutdownPrivilege 13672 cheatengine-x86_64-SSE4-AVX2.exe Token: SeRestorePrivilege 13672 cheatengine-x86_64-SSE4-AVX2.exe Token: 33 13672 cheatengine-x86_64-SSE4-AVX2.exe Token: SeIncBasePriorityPrivilege 13672 cheatengine-x86_64-SSE4-AVX2.exe Token: SeBackupPrivilege 17848 vssvc.exe Token: SeRestorePrivilege 17848 vssvc.exe Token: SeAuditPrivilege 17848 vssvc.exe Token: SeIncreaseQuotaPrivilege 17892 WMIC.exe Token: SeSecurityPrivilege 17892 WMIC.exe Token: SeTakeOwnershipPrivilege 17892 WMIC.exe Token: SeLoadDriverPrivilege 17892 WMIC.exe Token: SeSystemProfilePrivilege 17892 WMIC.exe Token: SeSystemtimePrivilege 17892 WMIC.exe Token: SeProfSingleProcessPrivilege 17892 WMIC.exe Token: SeIncBasePriorityPrivilege 17892 WMIC.exe Token: SeCreatePagefilePrivilege 17892 WMIC.exe Token: SeBackupPrivilege 17892 WMIC.exe Token: SeRestorePrivilege 17892 WMIC.exe Token: SeShutdownPrivilege 17892 WMIC.exe Token: SeDebugPrivilege 17892 WMIC.exe Token: SeSystemEnvironmentPrivilege 17892 WMIC.exe Token: SeRemoteShutdownPrivilege 17892 WMIC.exe Token: SeUndockPrivilege 17892 WMIC.exe Token: SeManageVolumePrivilege 17892 WMIC.exe Token: 33 17892 WMIC.exe Token: 34 17892 WMIC.exe Token: 35 17892 WMIC.exe Token: 36 17892 WMIC.exe Token: SeIncreaseQuotaPrivilege 17892 WMIC.exe Token: SeSecurityPrivilege 17892 WMIC.exe Token: SeTakeOwnershipPrivilege 17892 WMIC.exe Token: SeLoadDriverPrivilege 17892 WMIC.exe Token: SeSystemProfilePrivilege 17892 WMIC.exe Token: SeSystemtimePrivilege 17892 WMIC.exe Token: SeProfSingleProcessPrivilege 17892 WMIC.exe Token: SeIncBasePriorityPrivilege 17892 WMIC.exe Token: SeCreatePagefilePrivilege 17892 WMIC.exe Token: SeBackupPrivilege 17892 WMIC.exe Token: SeRestorePrivilege 17892 WMIC.exe Token: SeShutdownPrivilege 17892 WMIC.exe Token: SeDebugPrivilege 17892 WMIC.exe Token: SeSystemEnvironmentPrivilege 17892 WMIC.exe Token: SeRemoteShutdownPrivilege 17892 WMIC.exe Token: SeUndockPrivilege 17892 WMIC.exe Token: SeManageVolumePrivilege 17892 WMIC.exe Token: 33 17892 WMIC.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
iexplore.exechrome.exeWinRAR.exepid process 2840 iexplore.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4720 WinRAR.exe 4720 WinRAR.exe 4720 WinRAR.exe 4720 WinRAR.exe 4720 WinRAR.exe 4720 WinRAR.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe -
Suspicious use of SendNotifyMessage 37 IoCs
Processes:
chrome.exefirefox.exepid process 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 7928 firefox.exe 7928 firefox.exe 7928 firefox.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe -
Suspicious use of SetWindowsHookEx 32 IoCs
Processes:
iexplore.exeIEXPLORE.EXEwinrar-x32-611.exeWinRAR.exefirefox.exeCheatEngine74.tmpcheatengine-x86_64-SSE4-AVX2.exe@WanaDecryptor@.exe@WanaDecryptor@.exe@WanaDecryptor@.exe@WanaDecryptor@.exeOpenWith.exe@WanaDecryptor@.exe@WanaDecryptor@.exe@WanaDecryptor@.exe@WanaDecryptor@.exe@WanaDecryptor@.exe@WanaDecryptor@.exe@WanaDecryptor@.exe@WanaDecryptor@.exe@WanaDecryptor@.exe@WanaDecryptor@.exe@WanaDecryptor@.exe@WanaDecryptor@.exe@WanaDecryptor@.exepid process 2840 iexplore.exe 2840 iexplore.exe 3812 IEXPLORE.EXE 3812 IEXPLORE.EXE 3784 winrar-x32-611.exe 3784 winrar-x32-611.exe 4720 WinRAR.exe 4720 WinRAR.exe 7928 firefox.exe 11560 CheatEngine74.tmp 13672 cheatengine-x86_64-SSE4-AVX2.exe 16696 @WanaDecryptor@.exe 16972 @WanaDecryptor@.exe 16696 @WanaDecryptor@.exe 16972 @WanaDecryptor@.exe 18260 @WanaDecryptor@.exe 18260 @WanaDecryptor@.exe 18936 @WanaDecryptor@.exe 19200 OpenWith.exe 19404 @WanaDecryptor@.exe 19848 @WanaDecryptor@.exe 20656 @WanaDecryptor@.exe 21004 @WanaDecryptor@.exe 21336 @WanaDecryptor@.exe 21700 @WanaDecryptor@.exe 22012 @WanaDecryptor@.exe 22324 @WanaDecryptor@.exe 23272 @WanaDecryptor@.exe 23632 @WanaDecryptor@.exe 23936 @WanaDecryptor@.exe 24256 @WanaDecryptor@.exe 24568 @WanaDecryptor@.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
iexplore.exechrome.exedescription pid process target process PID 2840 wrote to memory of 3812 2840 iexplore.exe IEXPLORE.EXE PID 2840 wrote to memory of 3812 2840 iexplore.exe IEXPLORE.EXE PID 2840 wrote to memory of 3812 2840 iexplore.exe IEXPLORE.EXE PID 4792 wrote to memory of 3000 4792 chrome.exe chrome.exe PID 4792 wrote to memory of 3000 4792 chrome.exe chrome.exe PID 4792 wrote to memory of 3524 4792 chrome.exe chrome.exe PID 4792 wrote to memory of 3524 4792 chrome.exe chrome.exe PID 4792 wrote to memory of 3524 4792 chrome.exe chrome.exe PID 4792 wrote to memory of 3524 4792 chrome.exe chrome.exe PID 4792 wrote to memory of 3524 4792 chrome.exe chrome.exe PID 4792 wrote to memory of 3524 4792 chrome.exe chrome.exe PID 4792 wrote to memory of 3524 4792 chrome.exe chrome.exe PID 4792 wrote to memory of 3524 4792 chrome.exe chrome.exe PID 4792 wrote to memory of 3524 4792 chrome.exe chrome.exe PID 4792 wrote to memory of 3524 4792 chrome.exe chrome.exe PID 4792 wrote to memory of 3524 4792 chrome.exe chrome.exe PID 4792 wrote to memory of 3524 4792 chrome.exe chrome.exe PID 4792 wrote to memory of 3524 4792 chrome.exe chrome.exe PID 4792 wrote to memory of 3524 4792 chrome.exe chrome.exe PID 4792 wrote to memory of 3524 4792 chrome.exe chrome.exe PID 4792 wrote to memory of 3524 4792 chrome.exe chrome.exe PID 4792 wrote to memory of 3524 4792 chrome.exe chrome.exe PID 4792 wrote to memory of 3524 4792 chrome.exe chrome.exe PID 4792 wrote to memory of 3524 4792 chrome.exe chrome.exe PID 4792 wrote to memory of 3524 4792 chrome.exe chrome.exe PID 4792 wrote to memory of 3524 4792 chrome.exe chrome.exe PID 4792 wrote to memory of 3524 4792 chrome.exe chrome.exe PID 4792 wrote to memory of 3524 4792 chrome.exe chrome.exe PID 4792 wrote to memory of 3524 4792 chrome.exe chrome.exe PID 4792 wrote to memory of 3524 4792 chrome.exe chrome.exe PID 4792 wrote to memory of 3524 4792 chrome.exe chrome.exe PID 4792 wrote to memory of 3524 4792 chrome.exe chrome.exe PID 4792 wrote to memory of 3524 4792 chrome.exe chrome.exe PID 4792 wrote to memory of 3524 4792 chrome.exe chrome.exe PID 4792 wrote to memory of 3524 4792 chrome.exe chrome.exe PID 4792 wrote to memory of 3524 4792 chrome.exe chrome.exe PID 4792 wrote to memory of 3524 4792 chrome.exe chrome.exe PID 4792 wrote to memory of 3524 4792 chrome.exe chrome.exe PID 4792 wrote to memory of 3524 4792 chrome.exe chrome.exe PID 4792 wrote to memory of 3524 4792 chrome.exe chrome.exe PID 4792 wrote to memory of 3524 4792 chrome.exe chrome.exe PID 4792 wrote to memory of 3524 4792 chrome.exe chrome.exe PID 4792 wrote to memory of 3524 4792 chrome.exe chrome.exe PID 4792 wrote to memory of 3524 4792 chrome.exe chrome.exe PID 4792 wrote to memory of 3524 4792 chrome.exe chrome.exe PID 4792 wrote to memory of 4080 4792 chrome.exe chrome.exe PID 4792 wrote to memory of 4080 4792 chrome.exe chrome.exe PID 4792 wrote to memory of 3948 4792 chrome.exe chrome.exe PID 4792 wrote to memory of 3948 4792 chrome.exe chrome.exe PID 4792 wrote to memory of 3948 4792 chrome.exe chrome.exe PID 4792 wrote to memory of 3948 4792 chrome.exe chrome.exe PID 4792 wrote to memory of 3948 4792 chrome.exe chrome.exe PID 4792 wrote to memory of 3948 4792 chrome.exe chrome.exe PID 4792 wrote to memory of 3948 4792 chrome.exe chrome.exe PID 4792 wrote to memory of 3948 4792 chrome.exe chrome.exe PID 4792 wrote to memory of 3948 4792 chrome.exe chrome.exe PID 4792 wrote to memory of 3948 4792 chrome.exe chrome.exe PID 4792 wrote to memory of 3948 4792 chrome.exe chrome.exe PID 4792 wrote to memory of 3948 4792 chrome.exe chrome.exe PID 4792 wrote to memory of 3948 4792 chrome.exe chrome.exe PID 4792 wrote to memory of 3948 4792 chrome.exe chrome.exe PID 4792 wrote to memory of 3948 4792 chrome.exe chrome.exe PID 4792 wrote to memory of 3948 4792 chrome.exe chrome.exe PID 4792 wrote to memory of 3948 4792 chrome.exe chrome.exe -
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://google.com1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2840 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffb57a94f50,0x7ffb57a94f60,0x7ffb57a94f702⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1576 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1648 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2160 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2836 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2708 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3680 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4776 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4896 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4636 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5068 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4936 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4700 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4672 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4932 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4656 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5080 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3596 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3716 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4648 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5504 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3184 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2720 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1672 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5272 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6248 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6504 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6468 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6836 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1020 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6872 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7316 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6884 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7040 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7768 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7916 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8444 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7420 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6720 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7456 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7552 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7580 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7584 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2164 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7696 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7712 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8352 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8296 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7476 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7324 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7704 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8540 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7888 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6892 /prefetch:82⤵
-
C:\Users\Admin\Downloads\winrar-x32-611.exe"C:\Users\Admin\Downloads\winrar-x32-611.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\WinRAR\uninstall.exe"C:\Program Files (x86)\WinRAR\uninstall.exe" /setup3⤵
- Modifies system executable filetype association
- Executes dropped EXE
- Registers COM server for autorun
- Modifies registry class
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=164 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7116 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=68 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1368 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7680 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=70 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7664 /prefetch:12⤵
-
C:\Program Files (x86)\WinRAR\WinRAR.exe"C:\Program Files (x86)\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\setup.rar"2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Rar$EXb4720.46186\setup.exe"C:\Users\Admin\AppData\Local\Temp\Rar$EXb4720.46186\setup.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4416 -s 983244⤵
- Program crash
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5844 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3584 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=73 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7996 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2500 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3484 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=76 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3956 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=77 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6468 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=78 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8380 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=79 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=80 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5428 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7800 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=83 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3804 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=84 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5976 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=85 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1368 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=86 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8304 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=87 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7764 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=88 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4812 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=91 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8624 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=92 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8656 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=90 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8372 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8400 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=94 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7060 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=96 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6796 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=97 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=98 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6960 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5260 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=100 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=101 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7116 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=102 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3688 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=103 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7708 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=104 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7092 /prefetch:12⤵
-
C:\Program Files (x86)\WinRAR\WinRAR.exe"C:\Program Files (x86)\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\gta 5 mod menu free.zip"2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\AppData\Local\Temp\Rar$EXb9428.21672\gta 5 mod menu free.exe"C:\Users\Admin\AppData\Local\Temp\Rar$EXb9428.21672\gta 5 mod menu free.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9892 -s 978964⤵
- Program crash
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=105 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6480 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=106 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8828 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=107 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2624 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=108 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8372 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=109 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8848 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=112 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8852 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=111 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8400 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=110 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6864 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6492 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7812 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=116 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6864 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6224 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6488 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7204 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7552 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6716 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=122 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=123 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6476 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=124 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8416 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=125 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4620 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=126 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6652 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=127 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6172 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=128 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7664 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=129 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=130 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8692 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=131 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8608 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7200 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7592 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\WinRAR\WinRAR.exe"C:\Program Files (x86)\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\WannaCry by Rafael.rar"2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\WannaCry.EXE"C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\WannaCry.EXE"3⤵
- Executes dropped EXE
- Modifies extensions of user files
- Drops startup file
- Sets desktop wallpaper using registry
-
C:\Windows\SysWOW64\attrib.exeattrib +h .4⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\icacls.exeicacls . /grant Everyone:F /T /C /Q4⤵
- Modifies file permissions
-
C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\taskdl.exetaskdl.exe4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 175641662679398.bat4⤵
-
C:\Windows\SysWOW64\cscript.execscript.exe //nologo m.vbs5⤵
-
C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\@WanaDecryptor@.exe@WanaDecryptor@.exe co4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\TaskData\Tor\taskhsvc.exeTaskData\Tor\taskhsvc.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start /b @WanaDecryptor@.exe vs4⤵
-
C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\@WanaDecryptor@.exe@WanaDecryptor@.exe vs5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet6⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin delete shadows /all /quiet7⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete7⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\@WanaDecryptor@.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\@WanaDecryptor@.exe@WanaDecryptor@.exe4⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "zbgottfhrm154" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\tasksche.exe\"" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "zbgottfhrm154" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\tasksche.exe\"" /f5⤵
- Adds Run key to start application
- Modifies registry key
-
C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\taskdl.exetaskdl.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\taskdl.exetaskdl.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\@WanaDecryptor@.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\@WanaDecryptor@.exe@WanaDecryptor@.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\taskdl.exetaskdl.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\@WanaDecryptor@.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\@WanaDecryptor@.exe@WanaDecryptor@.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\taskdl.exetaskdl.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\@WanaDecryptor@.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\@WanaDecryptor@.exe@WanaDecryptor@.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\taskdl.exetaskdl.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\@WanaDecryptor@.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\@WanaDecryptor@.exe@WanaDecryptor@.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\taskdl.exetaskdl.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\@WanaDecryptor@.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\@WanaDecryptor@.exe@WanaDecryptor@.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\taskdl.exetaskdl.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\@WanaDecryptor@.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\@WanaDecryptor@.exe@WanaDecryptor@.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\taskdl.exetaskdl.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\@WanaDecryptor@.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\@WanaDecryptor@.exe@WanaDecryptor@.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\taskdl.exetaskdl.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\@WanaDecryptor@.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\@WanaDecryptor@.exe@WanaDecryptor@.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\taskdl.exetaskdl.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\@WanaDecryptor@.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\@WanaDecryptor@.exe@WanaDecryptor@.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\taskdl.exetaskdl.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\@WanaDecryptor@.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\@WanaDecryptor@.exe@WanaDecryptor@.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\taskdl.exetaskdl.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\@WanaDecryptor@.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\@WanaDecryptor@.exe@WanaDecryptor@.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\taskdl.exetaskdl.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\@WanaDecryptor@.exe@WanaDecryptor@.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\@WanaDecryptor@.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\taskdl.exetaskdl.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\@WanaDecryptor@.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\@WanaDecryptor@.exe@WanaDecryptor@.exe4⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\taskdl.exetaskdl.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\@WanaDecryptor@.exe@WanaDecryptor@.exe4⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\@WanaDecryptor@.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\@WanaDecryptor@.exe@WanaDecryptor@.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\taskdl.exetaskdl.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\Rar$EXb15252.4438\@WanaDecryptor@.exe4⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=134 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6936 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2480 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8740 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5568 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\WinRAR\WinRAR.exe"C:\Program Files (x86)\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\MEMZ.zip"2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\AppData\Local\Temp\Rar$EXb22788.2309\Endermanch@MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\Rar$EXb22788.2309\Endermanch@MEMZ.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Rar$EXb22788.2309\Endermanch@MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\Rar$EXb22788.2309\Endermanch@MEMZ.exe" /watchdog4⤵
-
C:\Users\Admin\AppData\Local\Temp\Rar$EXb22788.2309\Endermanch@MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\Rar$EXb22788.2309\Endermanch@MEMZ.exe" /watchdog4⤵
-
C:\Users\Admin\AppData\Local\Temp\Rar$EXb22788.2309\Endermanch@MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\Rar$EXb22788.2309\Endermanch@MEMZ.exe" /main4⤵
-
C:\Users\Admin\AppData\Local\Temp\Rar$EXb22788.2309\Endermanch@MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\Rar$EXb22788.2309\Endermanch@MEMZ.exe" /watchdog4⤵
-
C:\Users\Admin\AppData\Local\Temp\Rar$EXb22788.2309\Endermanch@MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\Rar$EXb22788.2309\Endermanch@MEMZ.exe" /watchdog4⤵
-
C:\Users\Admin\AppData\Local\Temp\Rar$EXb22788.2309\Endermanch@MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\Rar$EXb22788.2309\Endermanch@MEMZ.exe" /watchdog4⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1544,17003223516269089765,6179686865289574832,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6584 /prefetch:82⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x3901⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="7928.0.1156514292\1663403147" -parentBuildID 20200403170909 -prefsHandle 1540 -prefMapHandle 1532 -prefsLen 1 -prefMapSize 220115 -appdir "C:\Program Files\Mozilla Firefox\browser" - 7928 "\\.\pipe\gecko-crash-server-pipe.7928" 1640 gpu3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="7928.3.945934268\2039937687" -childID 1 -isForBrowser -prefsHandle 1416 -prefMapHandle 1412 -prefsLen 122 -prefMapSize 220115 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 7928 "\\.\pipe\gecko-crash-server-pipe.7928" 2220 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="7928.13.1597258569\1188467133" -childID 2 -isForBrowser -prefsHandle 3344 -prefMapHandle 3340 -prefsLen 6904 -prefMapSize 220115 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 7928 "\\.\pipe\gecko-crash-server-pipe.7928" 3336 tab3⤵
-
C:\Users\Admin\Downloads\CheatEngine74.exe"C:\Users\Admin\Downloads\CheatEngine74.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-AVNNB.tmp\CheatEngine74.tmp"C:\Users\Admin\AppData\Local\Temp\is-AVNNB.tmp\CheatEngine74.tmp" /SL5="$702F8,2408085,845312,C:\Users\Admin\Downloads\CheatEngine74.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-QLBK2.tmp\CheatEngine74.exe"C:\Users\Admin\AppData\Local\Temp\is-QLBK2.tmp\CheatEngine74.exe" /VERYSILENT /ZBDIST3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-JI715.tmp\CheatEngine74.tmp"C:\Users\Admin\AppData\Local\Temp\is-JI715.tmp\CheatEngine74.tmp" /SL5="$10328,23492458,780800,C:\Users\Admin\AppData\Local\Temp\is-QLBK2.tmp\CheatEngine74.exe" /VERYSILENT /ZBDIST4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SYSTEM32\net.exe"net" stop BadlionAntic5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BadlionAntic6⤵
-
C:\Windows\SYSTEM32\net.exe"net" stop BadlionAnticheat5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BadlionAnticheat6⤵
-
C:\Windows\SYSTEM32\sc.exe"sc" delete BadlionAntic5⤵
- Launches sc.exe
-
C:\Windows\SYSTEM32\sc.exe"sc" delete BadlionAnticheat5⤵
- Launches sc.exe
-
C:\Users\Admin\AppData\Local\Temp\is-4A19L.tmp\_isetup\_setup64.tmphelper 105 0x3CC5⤵
- Executes dropped EXE
-
C:\Windows\system32\icacls.exe"icacls" "C:\Program Files\Cheat Engine 7.4" /grant *S-1-15-2-1:(OI)(CI)(RX)5⤵
- Modifies file permissions
-
C:\Program Files\Cheat Engine 7.4\Kernelmoduleunloader.exe"C:\Program Files\Cheat Engine 7.4\Kernelmoduleunloader.exe" /SETUP5⤵
- Executes dropped EXE
-
C:\Program Files\Cheat Engine 7.4\windowsrepair.exe"C:\Program Files\Cheat Engine 7.4\windowsrepair.exe" /s5⤵
- Executes dropped EXE
-
C:\Windows\system32\icacls.exe"icacls" "C:\Program Files\Cheat Engine 7.4" /grant *S-1-15-2-1:(OI)(CI)(RX)5⤵
- Modifies file permissions
-
C:\Program Files\Cheat Engine 7.4\Cheat Engine.exe"C:\Program Files\Cheat Engine 7.4\Cheat Engine.exe"3⤵
- Executes dropped EXE
-
C:\Program Files\Cheat Engine 7.4\cheatengine-x86_64-SSE4-AVX2.exe"C:\Program Files\Cheat Engine 7.4\cheatengine-x86_64-SSE4-AVX2.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Cheat Engine 7.4\Tutorial-i386.exe"C:\Program Files\Cheat Engine 7.4\Tutorial-i386.exe"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 13760 -s 7166⤵
- Program crash
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"1⤵
- Drops file in Program Files directory
-
C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir20252_1071291561\ChromeRecovery.exe"C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir20252_1071291561\ChromeRecovery.exe" --appguid={8A69D345-D564-463c-AFF1-A69D9E530F96} --browser-version=89.0.4389.114 --sessionid={e9514766-e002-4f33-8a5a-4a2ca40f20a1} --system2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Persistence
Change Default File Association
1Registry Run Keys / Startup Folder
2Modify Existing Service
1Hidden Files and Directories
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAFilesize
1KB
MD5045c019fa7a764183eab7d3ab201d8a6
SHA1a1aa3e76e980ec4f6a3c1a16bf569cfc1685f8af
SHA25623b659d70af62e27a3c390412fe101ba1587c4682b0a6efbe532e0c786a6d20d
SHA5129c1376500fdad69832b53ff2826f0662becbf053d8c7db5f1a1d047201ab9f3253866f2019af5445bb0d9fd11c4994c7b1c388d7383919ec617cfef864f94394
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAFilesize
724B
MD55a11c6099b9e5808dfb08c5c9570c92f
SHA1e5dc219641146d1839557973f348037fa589fd18
SHA25691291a5edc4e10a225d3c23265d236ecc74473d9893be5bd07e202d95b3fb172
SHA512c2435b6619464a14c65ab116ab83a6e0568bdf7abc5e5a5e19f3deaf56c70a46360965da8b60e1256e9c8656aef9751adb9e762731bb8dbab145f1c8224ac8f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_AB08D151B360DECBDC641483765251CFFilesize
471B
MD5426dfe3ec82e0a77cbdfe9ff46ac9d89
SHA1486658615b3daeccb0e1f0431ef6583078d89785
SHA256653a398fdd1c3b7860432ff4d6e6828e034a70a4da82e9d8d27dbd90f0b88273
SHA51237913532001419bf32516f5e6cd5ff6c9a8c8fb4e49ea35ca2cff79d0353df35af901a925ef4a5e532ade317f92ff766c808dc7843bd630bfe773f94ab47f714
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAFilesize
410B
MD5e9a271580451b62449ae34106e9e8080
SHA100723dfa98009c5179848178a7408fee589a8ec7
SHA256f6060865f0f3d11e4d432bf4428797ab8a25b5e5edade66794f2d9d6c9586d82
SHA5129dee1bc15f8729274847e6e1d84825431db4b32b54a73778bc9c68f3609923e067883aee74cc39a8e6fbba20f3030b8f5292213609ac128b3e6302021eb01b6b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAFilesize
392B
MD5dd197fe88de0da05021d6c7fac03f6de
SHA1bc11a0b558903f988b34eb34c7b530b6057a6a1d
SHA256d1640f8a4ef3fc42af2738d8ef616ea66f0b60fe1431e6e3ab8d3e4f8e99f4a6
SHA512b7cd01b9c94189e66c9e6dcce7bd3c4a39f60168c14873b1f0dedb719347e6c6510820cdea9d724f0660c5dca2100b2a81c1f1f7686b31c481198c954c7b96a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_AB08D151B360DECBDC641483765251CFFilesize
406B
MD5952383b315c729b1d3e6f99eb61e0d70
SHA1c454ddff421eca2149c8812ba8604d368c51a96f
SHA2560044fd35dea27c84edd5d5fd39a7112b55262b0f3bdc6a0f8a4607a9a00a4438
SHA512774dbe3a7268fe8ec6f9823ee3a36e812e55281a29a9c48e2abf730d0fe6646fce6b06ed46e8de86ab2d99f9206d4f7f218f641d6a948d09bc6f7df8f98ad40f
-
\??\pipe\crashpad_4792_TCLGRDHUSPYICNAEMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/3752-218-0x0000000000000000-mapping.dmp
-
memory/3784-171-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/3784-186-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/3784-127-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/3784-128-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/3784-129-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/3784-130-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/3784-131-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/3784-174-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/3784-133-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/3784-134-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/3784-135-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/3784-136-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/3784-137-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/3784-138-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/3784-139-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/3784-140-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/3784-141-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/3784-142-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/3784-143-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/3784-144-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/3784-145-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/3784-146-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/3784-147-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/3784-148-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/3784-149-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/3784-150-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/3784-151-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/3784-154-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/3784-155-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/3784-153-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/3784-156-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/3784-152-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/3784-157-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/3784-158-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/3784-159-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/3784-161-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/3784-166-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/3784-165-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/3784-164-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/3784-163-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/3784-162-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/3784-160-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/3784-167-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/3784-168-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/3784-169-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/3784-170-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/3784-173-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/3784-172-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/3784-124-0x0000000000000000-mapping.dmp
-
memory/3784-132-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/3784-126-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/3784-176-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/3784-177-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/3784-178-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/3784-180-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/3784-181-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/3784-179-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/3784-182-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/3784-183-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/3784-184-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/3784-175-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/3784-185-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/3784-188-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/3784-187-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/3784-125-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/4416-429-0x0000000000000000-mapping.dmp
-
memory/4720-292-0x0000000000000000-mapping.dmp
-
memory/8688-1116-0x0000000008D20000-0x0000000008D6B000-memory.dmpFilesize
300KB
-
memory/8688-1054-0x000000000041ADD2-mapping.dmp
-
memory/8688-1092-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/9428-945-0x0000000000000000-mapping.dmp
-
memory/9892-1042-0x0000000000000000-mapping.dmp
-
memory/11384-1534-0x0000000000400000-0x00000000004DC000-memory.dmpFilesize
880KB
-
memory/11384-1637-0x0000000000400000-0x00000000004DC000-memory.dmpFilesize
880KB
-
memory/11384-1870-0x0000000000400000-0x00000000004DC000-memory.dmpFilesize
880KB
-
memory/11560-1539-0x0000000000000000-mapping.dmp
-
memory/12020-1640-0x0000000000000000-mapping.dmp
-
memory/12020-1820-0x0000000000400000-0x00000000004CC000-memory.dmpFilesize
816KB
-
memory/12020-1704-0x0000000000400000-0x00000000004CC000-memory.dmpFilesize
816KB
-
memory/12200-1680-0x0000000000000000-mapping.dmp
-
memory/12464-1740-0x0000000000000000-mapping.dmp
-
memory/12512-1741-0x0000000000000000-mapping.dmp
-
memory/12532-1742-0x0000000000000000-mapping.dmp
-
memory/12580-1743-0x0000000000000000-mapping.dmp
-
memory/12600-1744-0x0000000000000000-mapping.dmp
-
memory/12644-1745-0x0000000000000000-mapping.dmp
-
memory/12692-1747-0x0000000000000000-mapping.dmp
-
memory/12736-1748-0x0000000000000000-mapping.dmp
-
memory/12804-1754-0x0000000000000000-mapping.dmp
-
memory/12992-1784-0x0000000000000000-mapping.dmp
-
memory/13104-1808-0x0000000000000000-mapping.dmp
-
memory/13380-1821-0x0000000000000000-mapping.dmp
-
memory/13672-1886-0x0000000000000000-mapping.dmp
-
memory/13760-1887-0x0000000000000000-mapping.dmp
-
memory/15252-1931-0x0000000000000000-mapping.dmp
-
memory/15724-2030-0x0000000000000000-mapping.dmp
-
memory/15824-2051-0x0000000000000000-mapping.dmp
-
memory/15836-2052-0x0000000000000000-mapping.dmp
-
memory/16072-2092-0x0000000000000000-mapping.dmp
-
memory/16140-2102-0x0000000000000000-mapping.dmp
-
memory/16228-2115-0x0000000000000000-mapping.dmp
-
memory/16696-2184-0x0000000000000000-mapping.dmp
-
memory/16708-2185-0x0000000000000000-mapping.dmp
-
memory/16972-2229-0x0000000000000000-mapping.dmp
-
memory/17228-2286-0x0000000000000000-mapping.dmp
-
memory/17228-2341-0x0000000070C60000-0x0000000070CE2000-memory.dmpFilesize
520KB
-
memory/17228-2349-0x0000000000E80000-0x000000000117E000-memory.dmpFilesize
3.0MB
-
memory/17228-2347-0x0000000070BB0000-0x0000000070BD2000-memory.dmpFilesize
136KB
-
memory/17228-2346-0x0000000070B20000-0x0000000070BA2000-memory.dmpFilesize
520KB
-
memory/17228-2344-0x0000000070900000-0x0000000070B1C000-memory.dmpFilesize
2.1MB
-
memory/17228-2450-0x0000000070C60000-0x0000000070CE2000-memory.dmpFilesize
520KB
-
memory/17228-2451-0x0000000070900000-0x0000000070B1C000-memory.dmpFilesize
2.1MB
-
memory/17228-2452-0x0000000070B20000-0x0000000070BA2000-memory.dmpFilesize
520KB
-
memory/17228-2453-0x0000000000E80000-0x000000000117E000-memory.dmpFilesize
3.0MB
-
memory/17644-2372-0x0000000000000000-mapping.dmp
-
memory/17700-2378-0x0000000000000000-mapping.dmp
-
memory/17892-2407-0x0000000000000000-mapping.dmp
-
memory/18236-2468-0x0000000000000000-mapping.dmp
-
memory/18248-2469-0x0000000000000000-mapping.dmp
-
memory/18260-2470-0x0000000000000000-mapping.dmp
-
memory/18276-2472-0x0000000000000000-mapping.dmp
-
memory/18572-2528-0x0000000000000000-mapping.dmp
-
memory/18856-2567-0x0000000000000000-mapping.dmp
-
memory/18924-2575-0x0000000000000000-mapping.dmp
-
memory/18936-2576-0x0000000000000000-mapping.dmp
-
memory/19308-2632-0x0000000000000000-mapping.dmp
-
memory/19392-2640-0x0000000000000000-mapping.dmp
-
memory/19404-2641-0x0000000000000000-mapping.dmp
-
memory/19788-2697-0x0000000000000000-mapping.dmp
-
memory/19836-2705-0x0000000000000000-mapping.dmp
-
memory/19848-2706-0x0000000000000000-mapping.dmp
-
memory/20292-2764-0x0000000000000000-mapping.dmp
-
memory/20596-2832-0x0000000000000000-mapping.dmp
-
memory/20644-2840-0x0000000000000000-mapping.dmp
-
memory/20656-2841-0x0000000000000000-mapping.dmp
-
memory/20944-2897-0x0000000000000000-mapping.dmp
-
memory/20992-2905-0x0000000000000000-mapping.dmp
-
memory/21004-2906-0x0000000000000000-mapping.dmp
-
memory/21276-2962-0x0000000000000000-mapping.dmp
-
memory/21324-2970-0x0000000000000000-mapping.dmp
-
memory/21336-2971-0x0000000000000000-mapping.dmp
-
memory/21644-3027-0x0000000000000000-mapping.dmp
-
memory/102748-555-0x0000000009B10000-0x000000000A00E000-memory.dmpFilesize
5.0MB
-
memory/102748-559-0x0000000008D70000-0x0000000008DD6000-memory.dmpFilesize
408KB
-
memory/102748-839-0x000000000A660000-0x000000000A822000-memory.dmpFilesize
1.8MB
-
memory/102748-826-0x000000000A1B0000-0x000000000A200000-memory.dmpFilesize
320KB
-
memory/102748-572-0x0000000009A10000-0x0000000009A2E000-memory.dmpFilesize
120KB
-
memory/102748-568-0x000000000A010000-0x000000000A0A2000-memory.dmpFilesize
584KB
-
memory/102748-567-0x0000000009990000-0x0000000009A06000-memory.dmpFilesize
472KB
-
memory/102748-840-0x000000000AD60000-0x000000000B28C000-memory.dmpFilesize
5.2MB
-
memory/102748-481-0x000000000055ADD6-mapping.dmp
-
memory/102748-547-0x0000000008A80000-0x0000000008ACB000-memory.dmpFilesize
300KB
-
memory/102748-545-0x0000000008A40000-0x0000000008A7E000-memory.dmpFilesize
248KB
-
memory/102748-542-0x0000000008B00000-0x0000000008C0A000-memory.dmpFilesize
1.0MB
-
memory/102748-541-0x0000000001260000-0x0000000001272000-memory.dmpFilesize
72KB
-
memory/102748-540-0x0000000009000000-0x0000000009606000-memory.dmpFilesize
6.0MB
-
memory/102748-519-0x0000000000540000-0x0000000000560000-memory.dmpFilesize
128KB