Resubmissions
03/02/2023, 22:04
230203-1y75bsbd55 8Analysis
-
max time kernel
91s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
03/02/2023, 22:04
Behavioral task
behavioral1
Sample
VMProtect.exe
Resource
win7-20220812-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
VMProtect.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
VMProtect.exe
-
Size
20.7MB
-
MD5
aec99b769f8b6f3123a2e1093924b8d9
-
SHA1
161e809ece4b66c98b2814598c890878e00a935d
-
SHA256
b65cf8d20570251862e6ca7df92f29c7ab0fd2a1154d623628bc9b6cefd29afe
-
SHA512
4fd7e154195e4549b62c64f5d8114161ad6fd682c4945491d203a8db47661fcb3c12e2f2f712962b7496f467ab1bfa5a5ac3e9fb72503ba7407b420e0c2d74b6
-
SSDEEP
393216:jqj5sYHvvibHwAh1ml1IdnMiAbdqdEhhNj4zeTyktSr2IX7YU9D5Q5d/n:js5RHvvibHwsMl1ULMdXhHEzse2S7YUo
Score
8/10
Malware Config
Signatures
-
Downloads MZ/PE file
-
resource yara_rule behavioral2/memory/4464-134-0x00007FF7C09D0000-0x00007FF7C4491000-memory.dmp upx behavioral2/memory/4464-138-0x00007FF7C09D0000-0x00007FF7C4491000-memory.dmp upx behavioral2/memory/3756-140-0x00007FF7C09D0000-0x00007FF7C4491000-memory.dmp upx behavioral2/memory/3756-139-0x00007FF7C09D0000-0x00007FF7C4491000-memory.dmp upx behavioral2/memory/3756-144-0x00007FF7C09D0000-0x00007FF7C4491000-memory.dmp upx behavioral2/memory/3756-146-0x00007FF7C09D0000-0x00007FF7C4491000-memory.dmp upx -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 4464 VMProtect.exe 3756 VMProtect.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies registry class 39 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" VMProtect.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell VMProtect.exe Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4e0031000000000043569ab8100054656d7000003a0009000400efbe6b558a6c43569ab82e0000009ce10100000001000000000000000000000000000000e5e52301540065006d007000000014000000 VMProtect.exe Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff VMProtect.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" VMProtect.exe Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 VMProtect.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg VMProtect.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" VMProtect.exe Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 VMProtect.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 VMProtect.exe Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff VMProtect.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 VMProtect.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1" VMProtect.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell VMProtect.exe Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff VMProtect.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags VMProtect.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" VMProtect.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" VMProtect.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" VMProtect.exe Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 820074001c004346534616003100000000006b558a6c120041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbe6b558a6c4356a2b82e00000088e101000000010000000000000000000000000000000ad414004100700070004400610074006100000042000000 VMProtect.exe Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 50003100000000006b55e06e10004c6f63616c003c0009000400efbe6b558a6c4356a2b82e0000009be1010000000100000000000000000000000000000081f181004c006f00630061006c00000014000000 VMProtect.exe Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 VMProtect.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ VMProtect.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} VMProtect.exe Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff VMProtect.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 VMProtect.exe Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff VMProtect.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" VMProtect.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings VMProtect.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU VMProtect.exe Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots VMProtect.exe Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff VMProtect.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 VMProtect.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" VMProtect.exe Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000 VMProtect.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 VMProtect.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ VMProtect.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" VMProtect.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" VMProtect.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4464 VMProtect.exe 3756 VMProtect.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 4464 VMProtect.exe 4464 VMProtect.exe 3756 VMProtect.exe 3756 VMProtect.exe 4272 chrome.exe 4272 chrome.exe 5000 chrome.exe 5000 chrome.exe 5472 chrome.exe 5472 chrome.exe 5568 chrome.exe 5568 chrome.exe 5428 chrome.exe 5428 chrome.exe 5676 chrome.exe 5676 chrome.exe 5252 chrome.exe 5252 chrome.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 4464 VMProtect.exe 3756 VMProtect.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe 5000 chrome.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4464 VMProtect.exe 4464 VMProtect.exe 3756 VMProtect.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4464 wrote to memory of 3756 4464 VMProtect.exe 87 PID 4464 wrote to memory of 3756 4464 VMProtect.exe 87 PID 5000 wrote to memory of 996 5000 chrome.exe 102 PID 5000 wrote to memory of 996 5000 chrome.exe 102 PID 5000 wrote to memory of 3596 5000 chrome.exe 103 PID 5000 wrote to memory of 3596 5000 chrome.exe 103 PID 5000 wrote to memory of 3596 5000 chrome.exe 103 PID 5000 wrote to memory of 3596 5000 chrome.exe 103 PID 5000 wrote to memory of 3596 5000 chrome.exe 103 PID 5000 wrote to memory of 3596 5000 chrome.exe 103 PID 5000 wrote to memory of 3596 5000 chrome.exe 103 PID 5000 wrote to memory of 3596 5000 chrome.exe 103 PID 5000 wrote to memory of 3596 5000 chrome.exe 103 PID 5000 wrote to memory of 3596 5000 chrome.exe 103 PID 5000 wrote to memory of 3596 5000 chrome.exe 103 PID 5000 wrote to memory of 3596 5000 chrome.exe 103 PID 5000 wrote to memory of 3596 5000 chrome.exe 103 PID 5000 wrote to memory of 3596 5000 chrome.exe 103 PID 5000 wrote to memory of 3596 5000 chrome.exe 103 PID 5000 wrote to memory of 3596 5000 chrome.exe 103 PID 5000 wrote to memory of 3596 5000 chrome.exe 103 PID 5000 wrote to memory of 3596 5000 chrome.exe 103 PID 5000 wrote to memory of 3596 5000 chrome.exe 103 PID 5000 wrote to memory of 3596 5000 chrome.exe 103 PID 5000 wrote to memory of 3596 5000 chrome.exe 103 PID 5000 wrote to memory of 3596 5000 chrome.exe 103 PID 5000 wrote to memory of 3596 5000 chrome.exe 103 PID 5000 wrote to memory of 3596 5000 chrome.exe 103 PID 5000 wrote to memory of 3596 5000 chrome.exe 103 PID 5000 wrote to memory of 3596 5000 chrome.exe 103 PID 5000 wrote to memory of 3596 5000 chrome.exe 103 PID 5000 wrote to memory of 3596 5000 chrome.exe 103 PID 5000 wrote to memory of 3596 5000 chrome.exe 103 PID 5000 wrote to memory of 3596 5000 chrome.exe 103 PID 5000 wrote to memory of 3596 5000 chrome.exe 103 PID 5000 wrote to memory of 3596 5000 chrome.exe 103 PID 5000 wrote to memory of 3596 5000 chrome.exe 103 PID 5000 wrote to memory of 3596 5000 chrome.exe 103 PID 5000 wrote to memory of 3596 5000 chrome.exe 103 PID 5000 wrote to memory of 3596 5000 chrome.exe 103 PID 5000 wrote to memory of 3596 5000 chrome.exe 103 PID 5000 wrote to memory of 3596 5000 chrome.exe 103 PID 5000 wrote to memory of 3596 5000 chrome.exe 103 PID 5000 wrote to memory of 3596 5000 chrome.exe 103 PID 5000 wrote to memory of 4272 5000 chrome.exe 104 PID 5000 wrote to memory of 4272 5000 chrome.exe 104 PID 5000 wrote to memory of 1264 5000 chrome.exe 105 PID 5000 wrote to memory of 1264 5000 chrome.exe 105 PID 5000 wrote to memory of 1264 5000 chrome.exe 105 PID 5000 wrote to memory of 1264 5000 chrome.exe 105 PID 5000 wrote to memory of 1264 5000 chrome.exe 105 PID 5000 wrote to memory of 1264 5000 chrome.exe 105 PID 5000 wrote to memory of 1264 5000 chrome.exe 105 PID 5000 wrote to memory of 1264 5000 chrome.exe 105 PID 5000 wrote to memory of 1264 5000 chrome.exe 105 PID 5000 wrote to memory of 1264 5000 chrome.exe 105 PID 5000 wrote to memory of 1264 5000 chrome.exe 105 PID 5000 wrote to memory of 1264 5000 chrome.exe 105 PID 5000 wrote to memory of 1264 5000 chrome.exe 105 PID 5000 wrote to memory of 1264 5000 chrome.exe 105 PID 5000 wrote to memory of 1264 5000 chrome.exe 105 PID 5000 wrote to memory of 1264 5000 chrome.exe 105 PID 5000 wrote to memory of 1264 5000 chrome.exe 105 PID 5000 wrote to memory of 1264 5000 chrome.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\VMProtect.exe"C:\Users\Admin\AppData\Local\Temp\VMProtect.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\VMProtect.exeC:\Users\Admin\AppData\Local\Temp\VMProtect.exe --help C:/Users/Admin/AppData/Local/Temp/Help/en.qhc2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3756
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe7bf94f50,0x7ffe7bf94f60,0x7ffe7bf94f702⤵PID:996
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1628,6868358532167220399,5537697136788321491,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1636 /prefetch:22⤵PID:3596
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1628,6868358532167220399,5537697136788321491,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2004 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4272
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1628,6868358532167220399,5537697136788321491,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2248 /prefetch:82⤵PID:1264
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,6868358532167220399,5537697136788321491,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2940 /prefetch:12⤵PID:5148
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,6868358532167220399,5537697136788321491,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3140 /prefetch:12⤵PID:5156
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,6868358532167220399,5537697136788321491,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3848 /prefetch:12⤵PID:5280
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,6868358532167220399,5537697136788321491,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4512 /prefetch:82⤵PID:5352
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,6868358532167220399,5537697136788321491,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4632 /prefetch:82⤵PID:5360
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,6868358532167220399,5537697136788321491,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4776 /prefetch:82⤵PID:5392
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1628,6868358532167220399,5537697136788321491,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4960 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1628,6868358532167220399,5537697136788321491,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5056 /prefetch:82⤵PID:5532
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1628,6868358532167220399,5537697136788321491,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4780 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,6868358532167220399,5537697136788321491,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5296 /prefetch:82⤵PID:5576
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1628,6868358532167220399,5537697136788321491,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4612 /prefetch:82⤵PID:5640
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,6868358532167220399,5537697136788321491,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5052 /prefetch:82⤵PID:5676
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,6868358532167220399,5537697136788321491,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:12⤵PID:5708
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,6868358532167220399,5537697136788321491,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:12⤵PID:5784
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,6868358532167220399,5537697136788321491,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:12⤵PID:5848
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,6868358532167220399,5537697136788321491,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2980 /prefetch:12⤵PID:5864
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,6868358532167220399,5537697136788321491,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:12⤵PID:5916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1628,6868358532167220399,5537697136788321491,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5384 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5428
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1628,6868358532167220399,5537697136788321491,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3316 /prefetch:82⤵PID:4116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1628,6868358532167220399,5537697136788321491,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3288 /prefetch:82⤵PID:3360
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1628,6868358532167220399,5537697136788321491,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3232 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5676
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1628,6868358532167220399,5537697136788321491,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5252
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2784