Analysis
-
max time kernel
1741s -
max time network
1734s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
13/01/2023, 10:57
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://www.innosetup.com
Resource
win7-20220812-en
7 signatures
1800 seconds
Behavioral task
behavioral2
Sample
http://www.innosetup.com
Resource
win10v2004-20220812-en
16 signatures
1800 seconds
General
-
Target
http://www.innosetup.com
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 644 ChromeRecovery.exe -
Loads dropped DLL 1 IoCs
pid Process 1040 Process not Found -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7z.exe msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\an.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\ta.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\yo.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\hu.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\si.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\7z.exe msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\kab.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\lv.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\mr.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spc.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\7z.dll msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\ug.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\is.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\ug.txt msiexec.exe File created C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir4412_290269175\_metadata\verified_contents.json elevation_service.exe File opened for modification C:\Program Files\7-Zip\Lang\nl.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\ast.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\ja.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\mr.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\tr.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\da.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\el.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\fa.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\fy.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\en.ttt msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\ro.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\cs.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\io.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\lt.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\pa-in.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\License.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\az.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\ku-ckb.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\pt-br.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\7-zip.chm msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\mk.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\mng2.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\fa.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\de.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\7z.sfx msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\ba.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\fi.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\gu.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\pl.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\sk.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\et.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\id.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\ky.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\ps.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\7z.dll msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\ko.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\ps.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\sv.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\io.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\mn.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-tw.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\gl.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\ne.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\kaa.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-cn.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\co.txt msiexec.exe File opened for modification C:\Program Files\7-Zip\Lang\he.txt msiexec.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Installer\e5a1dca.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\e5a1dca.msi msiexec.exe -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000789d96067ff55f5b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000789d96060000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3f000000ffffffff000000000700010000680900789d9606000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000789d960600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000789d960600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings chrome.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings OpenWith.exe -
Suspicious behavior: EnumeratesProcesses 48 IoCs
pid Process 2008 chrome.exe 2008 chrome.exe 4940 chrome.exe 4940 chrome.exe 4416 chrome.exe 4416 chrome.exe 3180 chrome.exe 3180 chrome.exe 4140 chrome.exe 4140 chrome.exe 3040 chrome.exe 3040 chrome.exe 748 chrome.exe 748 chrome.exe 3140 chrome.exe 3140 chrome.exe 3140 chrome.exe 3140 chrome.exe 764 chrome.exe 764 chrome.exe 64 chrome.exe 64 chrome.exe 3736 chrome.exe 3736 chrome.exe 4524 msiexec.exe 4524 msiexec.exe 4524 msiexec.exe 4524 msiexec.exe 4524 msiexec.exe 4524 msiexec.exe 2144 msiexec.exe 2144 msiexec.exe 2144 msiexec.exe 2144 msiexec.exe 2144 msiexec.exe 2144 msiexec.exe 4524 msiexec.exe 4524 msiexec.exe 4524 msiexec.exe 4524 msiexec.exe 4524 msiexec.exe 4524 msiexec.exe 2144 msiexec.exe 2144 msiexec.exe 2144 msiexec.exe 2144 msiexec.exe 2144 msiexec.exe 2144 msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1580 OpenWith.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 42 IoCs
pid Process 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe -
Suspicious use of AdjustPrivilegeToken 47 IoCs
description pid Process Token: SeShutdownPrivilege 2144 msiexec.exe Token: SeIncreaseQuotaPrivilege 2144 msiexec.exe Token: SeSecurityPrivilege 4524 msiexec.exe Token: SeCreateTokenPrivilege 2144 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2144 msiexec.exe Token: SeLockMemoryPrivilege 2144 msiexec.exe Token: SeIncreaseQuotaPrivilege 2144 msiexec.exe Token: SeMachineAccountPrivilege 2144 msiexec.exe Token: SeTcbPrivilege 2144 msiexec.exe Token: SeSecurityPrivilege 2144 msiexec.exe Token: SeTakeOwnershipPrivilege 2144 msiexec.exe Token: SeLoadDriverPrivilege 2144 msiexec.exe Token: SeSystemProfilePrivilege 2144 msiexec.exe Token: SeSystemtimePrivilege 2144 msiexec.exe Token: SeProfSingleProcessPrivilege 2144 msiexec.exe Token: SeIncBasePriorityPrivilege 2144 msiexec.exe Token: SeCreatePagefilePrivilege 2144 msiexec.exe Token: SeCreatePermanentPrivilege 2144 msiexec.exe Token: SeBackupPrivilege 2144 msiexec.exe Token: SeRestorePrivilege 2144 msiexec.exe Token: SeShutdownPrivilege 2144 msiexec.exe Token: SeDebugPrivilege 2144 msiexec.exe Token: SeAuditPrivilege 2144 msiexec.exe Token: SeSystemEnvironmentPrivilege 2144 msiexec.exe Token: SeChangeNotifyPrivilege 2144 msiexec.exe Token: SeRemoteShutdownPrivilege 2144 msiexec.exe Token: SeUndockPrivilege 2144 msiexec.exe Token: SeSyncAgentPrivilege 2144 msiexec.exe Token: SeEnableDelegationPrivilege 2144 msiexec.exe Token: SeManageVolumePrivilege 2144 msiexec.exe Token: SeImpersonatePrivilege 2144 msiexec.exe Token: SeCreateGlobalPrivilege 2144 msiexec.exe Token: SeBackupPrivilege 4452 vssvc.exe Token: SeRestorePrivilege 4452 vssvc.exe Token: SeAuditPrivilege 4452 vssvc.exe Token: SeBackupPrivilege 4524 msiexec.exe Token: SeRestorePrivilege 4524 msiexec.exe Token: SeRestorePrivilege 4524 msiexec.exe Token: SeTakeOwnershipPrivilege 4524 msiexec.exe Token: SeBackupPrivilege 3076 srtasks.exe Token: SeRestorePrivilege 3076 srtasks.exe Token: SeSecurityPrivilege 3076 srtasks.exe Token: SeTakeOwnershipPrivilege 3076 srtasks.exe Token: SeBackupPrivilege 3076 srtasks.exe Token: SeRestorePrivilege 3076 srtasks.exe Token: SeSecurityPrivilege 3076 srtasks.exe Token: SeTakeOwnershipPrivilege 3076 srtasks.exe -
Suspicious use of FindShellTrayWindow 42 IoCs
pid Process 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 2144 msiexec.exe 2144 msiexec.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe -
Suspicious use of SetWindowsHookEx 15 IoCs
pid Process 1580 OpenWith.exe 1580 OpenWith.exe 1580 OpenWith.exe 1580 OpenWith.exe 1580 OpenWith.exe 1580 OpenWith.exe 1580 OpenWith.exe 1580 OpenWith.exe 1580 OpenWith.exe 1580 OpenWith.exe 1580 OpenWith.exe 1580 OpenWith.exe 1580 OpenWith.exe 1580 OpenWith.exe 1580 OpenWith.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4940 wrote to memory of 1752 4940 chrome.exe 81 PID 4940 wrote to memory of 1752 4940 chrome.exe 81 PID 4940 wrote to memory of 3672 4940 chrome.exe 84 PID 4940 wrote to memory of 3672 4940 chrome.exe 84 PID 4940 wrote to memory of 3672 4940 chrome.exe 84 PID 4940 wrote to memory of 3672 4940 chrome.exe 84 PID 4940 wrote to memory of 3672 4940 chrome.exe 84 PID 4940 wrote to memory of 3672 4940 chrome.exe 84 PID 4940 wrote to memory of 3672 4940 chrome.exe 84 PID 4940 wrote to memory of 3672 4940 chrome.exe 84 PID 4940 wrote to memory of 3672 4940 chrome.exe 84 PID 4940 wrote to memory of 3672 4940 chrome.exe 84 PID 4940 wrote to memory of 3672 4940 chrome.exe 84 PID 4940 wrote to memory of 3672 4940 chrome.exe 84 PID 4940 wrote to memory of 3672 4940 chrome.exe 84 PID 4940 wrote to memory of 3672 4940 chrome.exe 84 PID 4940 wrote to memory of 3672 4940 chrome.exe 84 PID 4940 wrote to memory of 3672 4940 chrome.exe 84 PID 4940 wrote to memory of 3672 4940 chrome.exe 84 PID 4940 wrote to memory of 3672 4940 chrome.exe 84 PID 4940 wrote to memory of 3672 4940 chrome.exe 84 PID 4940 wrote to memory of 3672 4940 chrome.exe 84 PID 4940 wrote to memory of 3672 4940 chrome.exe 84 PID 4940 wrote to memory of 3672 4940 chrome.exe 84 PID 4940 wrote to memory of 3672 4940 chrome.exe 84 PID 4940 wrote to memory of 3672 4940 chrome.exe 84 PID 4940 wrote to memory of 3672 4940 chrome.exe 84 PID 4940 wrote to memory of 3672 4940 chrome.exe 84 PID 4940 wrote to memory of 3672 4940 chrome.exe 84 PID 4940 wrote to memory of 3672 4940 chrome.exe 84 PID 4940 wrote to memory of 3672 4940 chrome.exe 84 PID 4940 wrote to memory of 3672 4940 chrome.exe 84 PID 4940 wrote to memory of 3672 4940 chrome.exe 84 PID 4940 wrote to memory of 3672 4940 chrome.exe 84 PID 4940 wrote to memory of 3672 4940 chrome.exe 84 PID 4940 wrote to memory of 3672 4940 chrome.exe 84 PID 4940 wrote to memory of 3672 4940 chrome.exe 84 PID 4940 wrote to memory of 3672 4940 chrome.exe 84 PID 4940 wrote to memory of 3672 4940 chrome.exe 84 PID 4940 wrote to memory of 3672 4940 chrome.exe 84 PID 4940 wrote to memory of 3672 4940 chrome.exe 84 PID 4940 wrote to memory of 3672 4940 chrome.exe 84 PID 4940 wrote to memory of 2008 4940 chrome.exe 85 PID 4940 wrote to memory of 2008 4940 chrome.exe 85 PID 4940 wrote to memory of 3520 4940 chrome.exe 86 PID 4940 wrote to memory of 3520 4940 chrome.exe 86 PID 4940 wrote to memory of 3520 4940 chrome.exe 86 PID 4940 wrote to memory of 3520 4940 chrome.exe 86 PID 4940 wrote to memory of 3520 4940 chrome.exe 86 PID 4940 wrote to memory of 3520 4940 chrome.exe 86 PID 4940 wrote to memory of 3520 4940 chrome.exe 86 PID 4940 wrote to memory of 3520 4940 chrome.exe 86 PID 4940 wrote to memory of 3520 4940 chrome.exe 86 PID 4940 wrote to memory of 3520 4940 chrome.exe 86 PID 4940 wrote to memory of 3520 4940 chrome.exe 86 PID 4940 wrote to memory of 3520 4940 chrome.exe 86 PID 4940 wrote to memory of 3520 4940 chrome.exe 86 PID 4940 wrote to memory of 3520 4940 chrome.exe 86 PID 4940 wrote to memory of 3520 4940 chrome.exe 86 PID 4940 wrote to memory of 3520 4940 chrome.exe 86 PID 4940 wrote to memory of 3520 4940 chrome.exe 86 PID 4940 wrote to memory of 3520 4940 chrome.exe 86 PID 4940 wrote to memory of 3520 4940 chrome.exe 86 PID 4940 wrote to memory of 3520 4940 chrome.exe 86
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" http://www.innosetup.com1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8f47e4f50,0x7ff8f47e4f60,0x7ff8f47e4f702⤵PID:1752
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1684 /prefetch:22⤵PID:3672
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1976 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2008
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2280 /prefetch:82⤵PID:3520
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2976 /prefetch:12⤵PID:488
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2984 /prefetch:12⤵PID:4308
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4312 /prefetch:82⤵PID:4120
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:12⤵PID:1976
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4972 /prefetch:82⤵PID:3148
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5092 /prefetch:82⤵PID:588
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5352 /prefetch:82⤵PID:4660
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4956 /prefetch:82⤵PID:2656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:12⤵PID:4856
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5308 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3180
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:12⤵PID:1212
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:12⤵PID:4308
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5000 /prefetch:82⤵PID:3256
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5740 /prefetch:82⤵PID:628
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5720 /prefetch:82⤵PID:1832
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5804 /prefetch:82⤵PID:1724
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5792 /prefetch:82⤵PID:2360
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5780 /prefetch:82⤵PID:4176
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5768 /prefetch:82⤵PID:4968
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5796 /prefetch:82⤵PID:4488
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6020 /prefetch:82⤵PID:3236
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5952 /prefetch:82⤵PID:4004
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5980 /prefetch:82⤵PID:4676
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5276 /prefetch:82⤵PID:2636
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5888 /prefetch:82⤵PID:2992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5956 /prefetch:82⤵PID:4740
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5936 /prefetch:82⤵PID:4764
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5248 /prefetch:82⤵PID:1036
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5536 /prefetch:82⤵PID:3532
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6128 /prefetch:82⤵PID:3576
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6296 /prefetch:82⤵PID:4352
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5996 /prefetch:82⤵PID:2276
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6176 /prefetch:82⤵PID:2916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6372 /prefetch:82⤵PID:1004
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5324 /prefetch:82⤵PID:4116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6360 /prefetch:12⤵PID:812
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1560 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4140
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2788 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3040
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2736 /prefetch:12⤵PID:4168
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:12⤵PID:3416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:12⤵PID:3128
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6284 /prefetch:12⤵PID:4532
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6324 /prefetch:12⤵PID:3988
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2788 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:748
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1144 /prefetch:12⤵PID:2764
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6592 /prefetch:12⤵PID:2128
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2608 /prefetch:12⤵PID:4612
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6672 /prefetch:82⤵PID:2992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5804 /prefetch:82⤵PID:4560
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4276 /prefetch:12⤵PID:220
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7112 /prefetch:12⤵PID:4428
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2604 /prefetch:82⤵PID:3980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6588 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3140
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:12⤵PID:4260
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1436 /prefetch:12⤵PID:2264
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4428 /prefetch:12⤵PID:2992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:12⤵PID:748
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:12⤵PID:3376
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3364 /prefetch:82⤵PID:3768
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:12⤵PID:2332
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:12⤵PID:2308
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6208 /prefetch:12⤵PID:1088
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=68 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6916 /prefetch:12⤵PID:3516
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=70 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7104 /prefetch:12⤵PID:3144
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7140 /prefetch:12⤵PID:2096
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=71 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3776 /prefetch:12⤵PID:220
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=72 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:12⤵PID:4880
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=73 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6236 /prefetch:12⤵PID:1852
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=74 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4460 /prefetch:12⤵PID:3996
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=75 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7012 /prefetch:12⤵PID:4424
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=76 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6800 /prefetch:12⤵PID:4116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6444 /prefetch:82⤵PID:2364
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7132 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:764
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=79 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:12⤵PID:3588
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=80 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7148 /prefetch:12⤵PID:2224
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=81 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6796 /prefetch:12⤵PID:4764
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=82 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6284 /prefetch:12⤵PID:2576
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=83 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:12⤵PID:2272
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4652 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:64
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=85 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6384 /prefetch:12⤵PID:4092
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=86 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6932 /prefetch:12⤵PID:384
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5880 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=88 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2744 /prefetch:12⤵PID:3976
-
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\7z2201-x64.msi"2⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2144
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7016 /prefetch:82⤵PID:3416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5608 /prefetch:82⤵PID:2272
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1244 /prefetch:82⤵PID:4168
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3268 /prefetch:82⤵PID:220
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5444 /prefetch:82⤵PID:396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6892 /prefetch:82⤵PID:224
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5056 /prefetch:82⤵PID:4124
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3572 /prefetch:82⤵PID:2644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6764 /prefetch:82⤵PID:2436
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5128 /prefetch:82⤵PID:764
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6908 /prefetch:82⤵PID:1900
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5096 /prefetch:82⤵PID:3864
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,11974602559017540117,9307963709611640301,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4440 /prefetch:82⤵PID:1504
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:484
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"1⤵
- Drops file in Program Files directory
PID:4412 -
C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir4412_290269175\ChromeRecovery.exe"C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir4412_290269175\ChromeRecovery.exe" --appguid={8A69D345-D564-463c-AFF1-A69D9E530F96} --browser-version=89.0.4389.114 --sessionid={4562bdf1-7542-4f69-8ae4-24c1bfc9746b} --system2⤵
- Executes dropped EXE
PID:644
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3440
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4524 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:3076
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1580 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\7z2201-x64.msi2⤵PID:2580
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4452