Resubmissions
18-11-2022 14:52
221118-r85mhshf55 108-11-2022 14:30
221108-rvcpkscaa3 807-11-2022 15:52
221107-tbh4csefh4 807-11-2022 10:35
221107-mm5m6secgn 106-11-2022 13:08
221106-qdjk5aehgj 905-11-2022 20:23
221105-y589vsbhcj 805-11-2022 16:11
221105-tm8s6aaggj 1005-11-2022 07:34
221105-jd7jmaggal 804-11-2022 20:40
221104-zgabascfgq 8Analysis
-
max time kernel
249s -
max time network
554s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
04-11-2022 14:35
Static task
static1
URLScan task
urlscan1
Malware Config
Extracted
blacknet
v3.6.0 Public
Bot
http://f0483357.xsph.ru/
BN[PHfunXGI-6235724]
-
antivm
true
-
elevate_uac
false
-
install_name
jusched.exe
-
splitter
|BN|
-
start_name
a5b002eacf54590ec8401ff6d3f920ee
-
startup
true
-
usb_spread
true
Extracted
darkcomet
Guest16
gameservice.ddns.net:4320
DC_MUTEX-WBUNVXD
-
InstallPath
AudioDriver\taskhost.exe
-
gencode
EWSsWwgyJrUD
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
AudioDriver
Signatures
-
BlackNET payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\jusched.exe family_blacknet C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\jusched.exe family_blacknet -
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
upx_compresser.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\AudioDriver\\taskhost.exe" upx_compresser.exe -
Executes dropped EXE 11 IoCs
Processes:
svshost.exejusched.exeWinlockerBuilderv5.exeupx_compresser.exeupx_compresser.exesvshost.exetaskhost.exeWinlockerBuilderv5.exeupx_compresser.exetaskhost.exeupx_compresser.exepid process 2260 svshost.exe 3108 jusched.exe 4928 WinlockerBuilderv5.exe 180 upx_compresser.exe 4572 upx_compresser.exe 1396 svshost.exe 3284 taskhost.exe 2808 WinlockerBuilderv5.exe 1544 upx_compresser.exe 4964 taskhost.exe 844 upx_compresser.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\WinlockerBuilderv5.exe upx C:\Users\Admin\AppData\Local\Temp\WinlockerBuilderv5.exe upx behavioral1/memory/4928-155-0x0000000000400000-0x0000000000C89000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\WinlockerBuilderv5.exe upx behavioral1/memory/2808-174-0x0000000000400000-0x0000000000C89000-memory.dmp upx behavioral1/memory/4928-177-0x0000000000400000-0x0000000000C89000-memory.dmp upx behavioral1/memory/2808-179-0x0000000000400000-0x0000000000C89000-memory.dmp upx behavioral1/memory/2808-181-0x0000000000400000-0x0000000000C89000-memory.dmp upx behavioral1/memory/4928-182-0x0000000000400000-0x0000000000C89000-memory.dmp upx -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
svshost.exeupx_compresser.exejusched.exesvshost.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation svshost.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation upx_compresser.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation jusched.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation svshost.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
WinlockerBuilderv5.exeupx_compresser.exejusched.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a5b002eacf54590ec8401ff6d3f920ee = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Microsoft\\MyClient\\jusched.exe" WinlockerBuilderv5.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AudioDriver = "C:\\Users\\Admin\\Documents\\AudioDriver\\taskhost.exe" upx_compresser.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a5b002eacf54590ec8401ff6d3f920ee = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Microsoft\\MyClient\\jusched.exe" jusched.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a5b002eacf54590ec8401ff6d3f920ee = "C:\\Users\\Admin\\Desktop\\WinlockerBuilderv5.exe" WinlockerBuilderv5.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
upx_compresser.exetaskhost.exeupx_compresser.exedescription pid process target process PID 180 set thread context of 4572 180 upx_compresser.exe upx_compresser.exe PID 3284 set thread context of 4964 3284 taskhost.exe taskhost.exe PID 1544 set thread context of 844 1544 upx_compresser.exe upx_compresser.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies registry class 2 IoCs
Processes:
chrome.exeupx_compresser.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ upx_compresser.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
chrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exeWinlockerBuilderv5.exeWinlockerBuilderv5.exejusched.exepid process 1300 chrome.exe 1300 chrome.exe 4664 chrome.exe 4664 chrome.exe 4572 chrome.exe 4572 chrome.exe 3120 chrome.exe 3120 chrome.exe 4848 chrome.exe 4848 chrome.exe 4384 chrome.exe 4384 chrome.exe 1256 chrome.exe 1256 chrome.exe 2904 chrome.exe 2904 chrome.exe 2904 chrome.exe 2904 chrome.exe 2068 chrome.exe 2068 chrome.exe 764 chrome.exe 764 chrome.exe 844 chrome.exe 844 chrome.exe 4016 chrome.exe 4016 chrome.exe 2200 WinlockerBuilderv5.exe 3612 WinlockerBuilderv5.exe 3612 WinlockerBuilderv5.exe 3612 WinlockerBuilderv5.exe 3612 WinlockerBuilderv5.exe 3612 WinlockerBuilderv5.exe 3612 WinlockerBuilderv5.exe 3612 WinlockerBuilderv5.exe 3612 WinlockerBuilderv5.exe 3612 WinlockerBuilderv5.exe 3612 WinlockerBuilderv5.exe 3612 WinlockerBuilderv5.exe 3612 WinlockerBuilderv5.exe 3612 WinlockerBuilderv5.exe 3612 WinlockerBuilderv5.exe 3612 WinlockerBuilderv5.exe 3612 WinlockerBuilderv5.exe 3612 WinlockerBuilderv5.exe 3612 WinlockerBuilderv5.exe 3612 WinlockerBuilderv5.exe 3612 WinlockerBuilderv5.exe 3108 jusched.exe 3108 jusched.exe 3108 jusched.exe 3108 jusched.exe 3108 jusched.exe 3108 jusched.exe 3108 jusched.exe 3108 jusched.exe 3108 jusched.exe 3108 jusched.exe 3108 jusched.exe 3108 jusched.exe 3108 jusched.exe 3108 jusched.exe 3108 jusched.exe 3108 jusched.exe 3108 jusched.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
Processes:
upx_compresser.exetaskhost.exeupx_compresser.exepid process 180 upx_compresser.exe 3284 taskhost.exe 1544 upx_compresser.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
Processes:
chrome.exepid process 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WinlockerBuilderv5.exeWinlockerBuilderv5.exejusched.exeupx_compresser.exetaskhost.exeupx_compresser.exedescription pid process Token: SeDebugPrivilege 2200 WinlockerBuilderv5.exe Token: SeDebugPrivilege 3612 WinlockerBuilderv5.exe Token: SeDebugPrivilege 3108 jusched.exe Token: SeIncreaseQuotaPrivilege 4572 upx_compresser.exe Token: SeSecurityPrivilege 4572 upx_compresser.exe Token: SeTakeOwnershipPrivilege 4572 upx_compresser.exe Token: SeLoadDriverPrivilege 4572 upx_compresser.exe Token: SeSystemProfilePrivilege 4572 upx_compresser.exe Token: SeSystemtimePrivilege 4572 upx_compresser.exe Token: SeProfSingleProcessPrivilege 4572 upx_compresser.exe Token: SeIncBasePriorityPrivilege 4572 upx_compresser.exe Token: SeCreatePagefilePrivilege 4572 upx_compresser.exe Token: SeBackupPrivilege 4572 upx_compresser.exe Token: SeRestorePrivilege 4572 upx_compresser.exe Token: SeShutdownPrivilege 4572 upx_compresser.exe Token: SeDebugPrivilege 4572 upx_compresser.exe Token: SeSystemEnvironmentPrivilege 4572 upx_compresser.exe Token: SeChangeNotifyPrivilege 4572 upx_compresser.exe Token: SeRemoteShutdownPrivilege 4572 upx_compresser.exe Token: SeUndockPrivilege 4572 upx_compresser.exe Token: SeManageVolumePrivilege 4572 upx_compresser.exe Token: SeImpersonatePrivilege 4572 upx_compresser.exe Token: SeCreateGlobalPrivilege 4572 upx_compresser.exe Token: 33 4572 upx_compresser.exe Token: 34 4572 upx_compresser.exe Token: 35 4572 upx_compresser.exe Token: 36 4572 upx_compresser.exe Token: SeIncreaseQuotaPrivilege 4964 taskhost.exe Token: SeSecurityPrivilege 4964 taskhost.exe Token: SeTakeOwnershipPrivilege 4964 taskhost.exe Token: SeLoadDriverPrivilege 4964 taskhost.exe Token: SeSystemProfilePrivilege 4964 taskhost.exe Token: SeSystemtimePrivilege 4964 taskhost.exe Token: SeProfSingleProcessPrivilege 4964 taskhost.exe Token: SeIncBasePriorityPrivilege 4964 taskhost.exe Token: SeCreatePagefilePrivilege 4964 taskhost.exe Token: SeBackupPrivilege 4964 taskhost.exe Token: SeRestorePrivilege 4964 taskhost.exe Token: SeShutdownPrivilege 4964 taskhost.exe Token: SeDebugPrivilege 4964 taskhost.exe Token: SeSystemEnvironmentPrivilege 4964 taskhost.exe Token: SeChangeNotifyPrivilege 4964 taskhost.exe Token: SeRemoteShutdownPrivilege 4964 taskhost.exe Token: SeUndockPrivilege 4964 taskhost.exe Token: SeManageVolumePrivilege 4964 taskhost.exe Token: SeImpersonatePrivilege 4964 taskhost.exe Token: SeCreateGlobalPrivilege 4964 taskhost.exe Token: 33 4964 taskhost.exe Token: 34 4964 taskhost.exe Token: 35 4964 taskhost.exe Token: 36 4964 taskhost.exe Token: SeIncreaseQuotaPrivilege 844 upx_compresser.exe Token: SeSecurityPrivilege 844 upx_compresser.exe Token: SeTakeOwnershipPrivilege 844 upx_compresser.exe Token: SeLoadDriverPrivilege 844 upx_compresser.exe Token: SeSystemProfilePrivilege 844 upx_compresser.exe Token: SeSystemtimePrivilege 844 upx_compresser.exe Token: SeProfSingleProcessPrivilege 844 upx_compresser.exe Token: SeIncBasePriorityPrivilege 844 upx_compresser.exe Token: SeCreatePagefilePrivilege 844 upx_compresser.exe Token: SeBackupPrivilege 844 upx_compresser.exe Token: SeRestorePrivilege 844 upx_compresser.exe Token: SeShutdownPrivilege 844 upx_compresser.exe Token: SeDebugPrivilege 844 upx_compresser.exe -
Suspicious use of FindShellTrayWindow 47 IoCs
Processes:
chrome.exepid process 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe -
Suspicious use of SendNotifyMessage 34 IoCs
Processes:
chrome.exepid process 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe -
Suspicious use of SetWindowsHookEx 9 IoCs
Processes:
WinlockerBuilderv5.exeWinlockerBuilderv5.exejusched.exeWinlockerBuilderv5.exetaskhost.exeWinlockerBuilderv5.exepid process 3612 WinlockerBuilderv5.exe 2200 WinlockerBuilderv5.exe 3612 WinlockerBuilderv5.exe 2200 WinlockerBuilderv5.exe 3108 jusched.exe 3108 jusched.exe 4928 WinlockerBuilderv5.exe 4964 taskhost.exe 2808 WinlockerBuilderv5.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 4664 wrote to memory of 1436 4664 chrome.exe chrome.exe PID 4664 wrote to memory of 1436 4664 chrome.exe chrome.exe PID 4664 wrote to memory of 1956 4664 chrome.exe chrome.exe PID 4664 wrote to memory of 1956 4664 chrome.exe chrome.exe PID 4664 wrote to memory of 1956 4664 chrome.exe chrome.exe PID 4664 wrote to memory of 1956 4664 chrome.exe chrome.exe PID 4664 wrote to memory of 1956 4664 chrome.exe chrome.exe PID 4664 wrote to memory of 1956 4664 chrome.exe chrome.exe PID 4664 wrote to memory of 1956 4664 chrome.exe chrome.exe PID 4664 wrote to memory of 1956 4664 chrome.exe chrome.exe PID 4664 wrote to memory of 1956 4664 chrome.exe chrome.exe PID 4664 wrote to memory of 1956 4664 chrome.exe chrome.exe PID 4664 wrote to memory of 1956 4664 chrome.exe chrome.exe PID 4664 wrote to memory of 1956 4664 chrome.exe chrome.exe PID 4664 wrote to memory of 1956 4664 chrome.exe chrome.exe PID 4664 wrote to memory of 1956 4664 chrome.exe chrome.exe PID 4664 wrote to memory of 1956 4664 chrome.exe chrome.exe PID 4664 wrote to memory of 1956 4664 chrome.exe chrome.exe PID 4664 wrote to memory of 1956 4664 chrome.exe chrome.exe PID 4664 wrote to memory of 1956 4664 chrome.exe chrome.exe PID 4664 wrote to memory of 1956 4664 chrome.exe chrome.exe PID 4664 wrote to memory of 1956 4664 chrome.exe chrome.exe PID 4664 wrote to memory of 1956 4664 chrome.exe chrome.exe PID 4664 wrote to memory of 1956 4664 chrome.exe chrome.exe PID 4664 wrote to memory of 1956 4664 chrome.exe chrome.exe PID 4664 wrote to memory of 1956 4664 chrome.exe chrome.exe PID 4664 wrote to memory of 1956 4664 chrome.exe chrome.exe PID 4664 wrote to memory of 1956 4664 chrome.exe chrome.exe PID 4664 wrote to memory of 1956 4664 chrome.exe chrome.exe PID 4664 wrote to memory of 1956 4664 chrome.exe chrome.exe PID 4664 wrote to memory of 1956 4664 chrome.exe chrome.exe PID 4664 wrote to memory of 1956 4664 chrome.exe chrome.exe PID 4664 wrote to memory of 1956 4664 chrome.exe chrome.exe PID 4664 wrote to memory of 1956 4664 chrome.exe chrome.exe PID 4664 wrote to memory of 1956 4664 chrome.exe chrome.exe PID 4664 wrote to memory of 1956 4664 chrome.exe chrome.exe PID 4664 wrote to memory of 1956 4664 chrome.exe chrome.exe PID 4664 wrote to memory of 1956 4664 chrome.exe chrome.exe PID 4664 wrote to memory of 1956 4664 chrome.exe chrome.exe PID 4664 wrote to memory of 1956 4664 chrome.exe chrome.exe PID 4664 wrote to memory of 1956 4664 chrome.exe chrome.exe PID 4664 wrote to memory of 1956 4664 chrome.exe chrome.exe PID 4664 wrote to memory of 1300 4664 chrome.exe chrome.exe PID 4664 wrote to memory of 1300 4664 chrome.exe chrome.exe PID 4664 wrote to memory of 2180 4664 chrome.exe chrome.exe PID 4664 wrote to memory of 2180 4664 chrome.exe chrome.exe PID 4664 wrote to memory of 2180 4664 chrome.exe chrome.exe PID 4664 wrote to memory of 2180 4664 chrome.exe chrome.exe PID 4664 wrote to memory of 2180 4664 chrome.exe chrome.exe PID 4664 wrote to memory of 2180 4664 chrome.exe chrome.exe PID 4664 wrote to memory of 2180 4664 chrome.exe chrome.exe PID 4664 wrote to memory of 2180 4664 chrome.exe chrome.exe PID 4664 wrote to memory of 2180 4664 chrome.exe chrome.exe PID 4664 wrote to memory of 2180 4664 chrome.exe chrome.exe PID 4664 wrote to memory of 2180 4664 chrome.exe chrome.exe PID 4664 wrote to memory of 2180 4664 chrome.exe chrome.exe PID 4664 wrote to memory of 2180 4664 chrome.exe chrome.exe PID 4664 wrote to memory of 2180 4664 chrome.exe chrome.exe PID 4664 wrote to memory of 2180 4664 chrome.exe chrome.exe PID 4664 wrote to memory of 2180 4664 chrome.exe chrome.exe PID 4664 wrote to memory of 2180 4664 chrome.exe chrome.exe PID 4664 wrote to memory of 2180 4664 chrome.exe chrome.exe PID 4664 wrote to memory of 2180 4664 chrome.exe chrome.exe PID 4664 wrote to memory of 2180 4664 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://github.com1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbd7124f50,0x7ffbd7124f60,0x7ffbd7124f702⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1644 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1884 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2236 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2956 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2940 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4244 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4332 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4376 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4968 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5036 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4536 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4356 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4872 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2476 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5112 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2500 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=980 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4488 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5200 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4616 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4612 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5468 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4376 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5376 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5452 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5272 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4424 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5604 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4384 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5368 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2968 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4500 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4388 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5620 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3196 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5140 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5916 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=212 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4588 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4636 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4312 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5800 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6032 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4464 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5308 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2524 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3568 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=936 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6196 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6340 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6640 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6500 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6484 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2352 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6624 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6648 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7016 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6768 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7500 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7644 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7776 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7944 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7920 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7916 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=77 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8316 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=78 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3076 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=79 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=80 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2416 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6088 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,6359853343253229404,11719142689160263192,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7144 /prefetch:82⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Desktop\WinlockerBuilderv5.exe"C:\Users\Admin\Desktop\WinlockerBuilderv5.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\svshost.exe"C:\Users\Admin\AppData\Local\Temp\svshost.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\WinlockerBuilderv5.exe"C:\Users\Admin\AppData\Local\Temp\WinlockerBuilderv5.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\upx_compresser.exe"C:\Users\Admin\AppData\Local\Temp\upx_compresser.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\upx_compresser.exe"C:\Users\Admin\AppData\Local\Temp\upx_compresser.exe"4⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\AudioDriver\taskhost.exe"C:\Users\Admin\Documents\AudioDriver\taskhost.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\Documents\AudioDriver\taskhost.exe"C:\Users\Admin\Documents\AudioDriver\taskhost.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\jusched.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\jusched.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\svshost.exe"C:\Users\Admin\AppData\Local\Temp\svshost.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\WinlockerBuilderv5.exe"C:\Users\Admin\AppData\Local\Temp\WinlockerBuilderv5.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\upx_compresser.exe"C:\Users\Admin\AppData\Local\Temp\upx_compresser.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\upx_compresser.exe"C:\Users\Admin\AppData\Local\Temp\upx_compresser.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Desktop\WinlockerBuilderv5.exe"C:\Users\Admin\Desktop\WinlockerBuilderv5.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffbd7124f50,0x7ffbd7124f60,0x7ffbd7124f702⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x38c 0x4941⤵
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\460d157832e64348a417073304033466 /t 928 /p 46641⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\WinlockerBuilderv5.exe.logFilesize
774B
MD51b2f0c7407b8bbbaaf86739abe069e81
SHA1372380724c49f74a66176054790917f31134ec63
SHA2563dd2fd61d338cf98cb575bd6efe579a67debb9e3b4535fd6c2dba57a120ffbfd
SHA512ea3343f655b6ab1181174db403590199049340f3bf2fb51e44f6be8949102d83952d1e7c69d92066573187e56199827abd3c90defab86b05072b0896ab458ae9
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\CachesMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\jusched.exeFilesize
11.0MB
MD55891817266ffedc10d4a84a3bd483239
SHA1b59d365a91b50ec55ccc1c1b2a70cbf858382aa3
SHA25651c45fb238881bd25fd7435d8b8e44eee9cc56887a56a7e5f5bdef8ec8392465
SHA512517c5d785f069ce566c1d89fcc998968a5cdfc6d85bcc7e42cc2e720b4be9b543065cc1c7967635948595fdbb4af3fc7714c8b90aa6035953bca40cba7272c23
-
C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\jusched.exeFilesize
11.0MB
MD55891817266ffedc10d4a84a3bd483239
SHA1b59d365a91b50ec55ccc1c1b2a70cbf858382aa3
SHA25651c45fb238881bd25fd7435d8b8e44eee9cc56887a56a7e5f5bdef8ec8392465
SHA512517c5d785f069ce566c1d89fcc998968a5cdfc6d85bcc7e42cc2e720b4be9b543065cc1c7967635948595fdbb4af3fc7714c8b90aa6035953bca40cba7272c23
-
C:\Users\Admin\AppData\Local\Temp\WinlockerBuilderv5.exeFilesize
3.0MB
MD50df533cb9a581de63e3522954a681603
SHA1be46afa245289e0d9a84bd1fd1faea8d8c96da5e
SHA256e3570b276e526f6fb6a289da32583b36cfbd98ec2f59d09c0243fbd0fc0805a3
SHA512c973e3a8476879dad79f8b37f476d379b90f27cf64ecd359256df94fb811d69226dc50d1e8168d34787cc2d6abf407d8097e37cd60155650dad007a68263661e
-
C:\Users\Admin\AppData\Local\Temp\WinlockerBuilderv5.exeFilesize
3.0MB
MD50df533cb9a581de63e3522954a681603
SHA1be46afa245289e0d9a84bd1fd1faea8d8c96da5e
SHA256e3570b276e526f6fb6a289da32583b36cfbd98ec2f59d09c0243fbd0fc0805a3
SHA512c973e3a8476879dad79f8b37f476d379b90f27cf64ecd359256df94fb811d69226dc50d1e8168d34787cc2d6abf407d8097e37cd60155650dad007a68263661e
-
C:\Users\Admin\AppData\Local\Temp\WinlockerBuilderv5.exeFilesize
3.0MB
MD50df533cb9a581de63e3522954a681603
SHA1be46afa245289e0d9a84bd1fd1faea8d8c96da5e
SHA256e3570b276e526f6fb6a289da32583b36cfbd98ec2f59d09c0243fbd0fc0805a3
SHA512c973e3a8476879dad79f8b37f476d379b90f27cf64ecd359256df94fb811d69226dc50d1e8168d34787cc2d6abf407d8097e37cd60155650dad007a68263661e
-
C:\Users\Admin\AppData\Local\Temp\svshost.exeFilesize
4.0MB
MD52df0daacf8be5126ddbaa7ba9a83be58
SHA10889fcd78f5bf71ca04280fe97b7507b6b114ba3
SHA2560936e508e142466b6d83e49b27513be2207822f91ac2d038023a86d6ccd29b2a
SHA5120348f7511803198d5d81b10bac08b9e9e79bfd1d193c9a72b1bf3883bd49d18ec21a998e4a056206fac539c73843b31c10437838eb38746bd062e682f2df120e
-
C:\Users\Admin\AppData\Local\Temp\svshost.exeFilesize
4.0MB
MD52df0daacf8be5126ddbaa7ba9a83be58
SHA10889fcd78f5bf71ca04280fe97b7507b6b114ba3
SHA2560936e508e142466b6d83e49b27513be2207822f91ac2d038023a86d6ccd29b2a
SHA5120348f7511803198d5d81b10bac08b9e9e79bfd1d193c9a72b1bf3883bd49d18ec21a998e4a056206fac539c73843b31c10437838eb38746bd062e682f2df120e
-
C:\Users\Admin\AppData\Local\Temp\svshost.exeFilesize
4.0MB
MD52df0daacf8be5126ddbaa7ba9a83be58
SHA10889fcd78f5bf71ca04280fe97b7507b6b114ba3
SHA2560936e508e142466b6d83e49b27513be2207822f91ac2d038023a86d6ccd29b2a
SHA5120348f7511803198d5d81b10bac08b9e9e79bfd1d193c9a72b1bf3883bd49d18ec21a998e4a056206fac539c73843b31c10437838eb38746bd062e682f2df120e
-
C:\Users\Admin\AppData\Local\Temp\svshost.exeFilesize
4.0MB
MD52df0daacf8be5126ddbaa7ba9a83be58
SHA10889fcd78f5bf71ca04280fe97b7507b6b114ba3
SHA2560936e508e142466b6d83e49b27513be2207822f91ac2d038023a86d6ccd29b2a
SHA5120348f7511803198d5d81b10bac08b9e9e79bfd1d193c9a72b1bf3883bd49d18ec21a998e4a056206fac539c73843b31c10437838eb38746bd062e682f2df120e
-
C:\Users\Admin\AppData\Local\Temp\upx_compresser.exeFilesize
1.1MB
MD50d833c6509f350e0a15492597df2bda6
SHA11f77b7eb4410f6e1c0e0f7b971a3c98b3f0a5f9f
SHA256d280fdf95c57cba365c15fc9c6371ada79734480812497c2244246cfdac52ca7
SHA5129e7ec8f4a756a2546c64850e0ca390788b9817984c1a91af55ffddfd3a010d7629478c2665c03a8a15d46377d66223f6937ac9d8d3d6bda5f9a1ee549ef16118
-
C:\Users\Admin\AppData\Local\Temp\upx_compresser.exeFilesize
1.1MB
MD50d833c6509f350e0a15492597df2bda6
SHA11f77b7eb4410f6e1c0e0f7b971a3c98b3f0a5f9f
SHA256d280fdf95c57cba365c15fc9c6371ada79734480812497c2244246cfdac52ca7
SHA5129e7ec8f4a756a2546c64850e0ca390788b9817984c1a91af55ffddfd3a010d7629478c2665c03a8a15d46377d66223f6937ac9d8d3d6bda5f9a1ee549ef16118
-
C:\Users\Admin\AppData\Local\Temp\upx_compresser.exeFilesize
1.1MB
MD50d833c6509f350e0a15492597df2bda6
SHA11f77b7eb4410f6e1c0e0f7b971a3c98b3f0a5f9f
SHA256d280fdf95c57cba365c15fc9c6371ada79734480812497c2244246cfdac52ca7
SHA5129e7ec8f4a756a2546c64850e0ca390788b9817984c1a91af55ffddfd3a010d7629478c2665c03a8a15d46377d66223f6937ac9d8d3d6bda5f9a1ee549ef16118
-
C:\Users\Admin\AppData\Local\Temp\upx_compresser.exeFilesize
1.1MB
MD50d833c6509f350e0a15492597df2bda6
SHA11f77b7eb4410f6e1c0e0f7b971a3c98b3f0a5f9f
SHA256d280fdf95c57cba365c15fc9c6371ada79734480812497c2244246cfdac52ca7
SHA5129e7ec8f4a756a2546c64850e0ca390788b9817984c1a91af55ffddfd3a010d7629478c2665c03a8a15d46377d66223f6937ac9d8d3d6bda5f9a1ee549ef16118
-
C:\Users\Admin\AppData\Local\Temp\upx_compresser.exeFilesize
1.1MB
MD50d833c6509f350e0a15492597df2bda6
SHA11f77b7eb4410f6e1c0e0f7b971a3c98b3f0a5f9f
SHA256d280fdf95c57cba365c15fc9c6371ada79734480812497c2244246cfdac52ca7
SHA5129e7ec8f4a756a2546c64850e0ca390788b9817984c1a91af55ffddfd3a010d7629478c2665c03a8a15d46377d66223f6937ac9d8d3d6bda5f9a1ee549ef16118
-
C:\Users\Admin\Documents\AudioDriver\taskhost.exeFilesize
1.1MB
MD50d833c6509f350e0a15492597df2bda6
SHA11f77b7eb4410f6e1c0e0f7b971a3c98b3f0a5f9f
SHA256d280fdf95c57cba365c15fc9c6371ada79734480812497c2244246cfdac52ca7
SHA5129e7ec8f4a756a2546c64850e0ca390788b9817984c1a91af55ffddfd3a010d7629478c2665c03a8a15d46377d66223f6937ac9d8d3d6bda5f9a1ee549ef16118
-
C:\Users\Admin\Documents\AudioDriver\taskhost.exeFilesize
1.1MB
MD50d833c6509f350e0a15492597df2bda6
SHA11f77b7eb4410f6e1c0e0f7b971a3c98b3f0a5f9f
SHA256d280fdf95c57cba365c15fc9c6371ada79734480812497c2244246cfdac52ca7
SHA5129e7ec8f4a756a2546c64850e0ca390788b9817984c1a91af55ffddfd3a010d7629478c2665c03a8a15d46377d66223f6937ac9d8d3d6bda5f9a1ee549ef16118
-
C:\Users\Admin\Documents\AudioDriver\taskhost.exeFilesize
1.1MB
MD50d833c6509f350e0a15492597df2bda6
SHA11f77b7eb4410f6e1c0e0f7b971a3c98b3f0a5f9f
SHA256d280fdf95c57cba365c15fc9c6371ada79734480812497c2244246cfdac52ca7
SHA5129e7ec8f4a756a2546c64850e0ca390788b9817984c1a91af55ffddfd3a010d7629478c2665c03a8a15d46377d66223f6937ac9d8d3d6bda5f9a1ee549ef16118
-
\??\pipe\crashpad_4664_LUDOMHWTRDMQNEXKMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/180-158-0x00000000021C0000-0x00000000021C9000-memory.dmpFilesize
36KB
-
memory/180-151-0x0000000000000000-mapping.dmp
-
memory/844-176-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/844-172-0x0000000000000000-mapping.dmp
-
memory/1396-160-0x0000000000000000-mapping.dmp
-
memory/1544-168-0x0000000000000000-mapping.dmp
-
memory/2200-135-0x00007FFBD09C0000-0x00007FFBD13F6000-memory.dmpFilesize
10.2MB
-
memory/2200-136-0x0000000001ABA000-0x0000000001ABF000-memory.dmpFilesize
20KB
-
memory/2200-138-0x0000000001ABA000-0x0000000001ABF000-memory.dmpFilesize
20KB
-
memory/2260-139-0x0000000000000000-mapping.dmp
-
memory/2808-174-0x0000000000400000-0x0000000000C89000-memory.dmpFilesize
8.5MB
-
memory/2808-166-0x0000000000000000-mapping.dmp
-
memory/2808-179-0x0000000000400000-0x0000000000C89000-memory.dmpFilesize
8.5MB
-
memory/2808-181-0x0000000000400000-0x0000000000C89000-memory.dmpFilesize
8.5MB
-
memory/3108-178-0x0000000001B7A000-0x0000000001B7F000-memory.dmpFilesize
20KB
-
memory/3108-142-0x0000000000000000-mapping.dmp
-
memory/3108-145-0x00007FFBD09C0000-0x00007FFBD13F6000-memory.dmpFilesize
10.2MB
-
memory/3108-154-0x0000000001B7A000-0x0000000001B7F000-memory.dmpFilesize
20KB
-
memory/3108-183-0x0000000001B7A000-0x0000000001B7F000-memory.dmpFilesize
20KB
-
memory/3284-163-0x0000000000000000-mapping.dmp
-
memory/3612-134-0x00007FFBD09C0000-0x00007FFBD13F6000-memory.dmpFilesize
10.2MB
-
memory/3612-137-0x0000000001C3A000-0x0000000001C3F000-memory.dmpFilesize
20KB
-
memory/3612-147-0x0000000001C3A000-0x0000000001C3F000-memory.dmpFilesize
20KB
-
memory/4572-156-0x0000000000000000-mapping.dmp
-
memory/4572-159-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/4928-155-0x0000000000400000-0x0000000000C89000-memory.dmpFilesize
8.5MB
-
memory/4928-177-0x0000000000400000-0x0000000000C89000-memory.dmpFilesize
8.5MB
-
memory/4928-148-0x0000000000000000-mapping.dmp
-
memory/4928-182-0x0000000000400000-0x0000000000C89000-memory.dmpFilesize
8.5MB
-
memory/4964-169-0x0000000000000000-mapping.dmp
-
memory/4964-175-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/4964-180-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB