Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
02/08/2023, 15:09
Behavioral task
behavioral1
Sample
rpservicesofwiINV-234183.pdf
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
rpservicesofwiINV-234183.pdf
Resource
win10v2004-20230703-en
General
-
Target
rpservicesofwiINV-234183.pdf
-
Size
22KB
-
MD5
7a25266f773351d9f95c0bcb348a5273
-
SHA1
5bbea993d1e0025c07ee6f3b5b8f9c5fbbf26015
-
SHA256
add8f5e2fb48285f61f489bab0ed52a850ab9487e83e0bc0ce9af5457fe16e75
-
SHA512
e12fa8449c5f41b56b3d76b9495f16146fed5a0ed5f3de5fcacb52b51276bc08e547a4ded03f11242a819d6388fabde005be2324603c21c4e660f4c501099060
-
SSDEEP
384:6wbWYZiyuhl5Nn8tdaMD8U1nQNguuN0YnAHm6ZgV2/FqEnRnTyquaGCzhp6sr:5bWYZiyuHnQuQAM2/FvnAquKht
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLsTime\url1 = a37514bf53c5d901 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLsTime\url3 = 0000000000000000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe Key created \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{F0C7E36D-3146-11EE-AF72-7290DE67E8EA} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs\url2 = "https://www.facebook.com/" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLsTime\url2 = 0000000000000000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "6" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Software\Microsoft\Internet Explorer\TypedURLs iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs\url1 = "https://abovzero.com/.error/already.html?parameter=We%27re%20sorry,%20but%20this%20webpage%20is%20only%20compatible%20with%20Google%20Chrome%20or%20Mozilla%20Firefox%20browsers.%20It%20appears%20that%20you%20are%20currently%20using%20Microsoft%20Edge,%20which%20is%20not%20supported.%20To%20access%20this%20webpage,%20please%20use%20Google%20Chrome%20or%20Mozilla%20Firefox%20instead.%20These%20browsers%20can%20be%20downloaded%20for%20free%20from%20their%20respective%20websites.%20Thank%20you%20for%20your%20understanding." iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs\url5 = "https://login.live.com/" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLsTime\url6 = 0000000000000000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs\url4 = "https://signin.ebay.com/ws/ebayisapi.dll" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs\url6 = "https://twitter.com/" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Software\Microsoft\Internet Explorer\TypedURLsTime iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLsTime\url4 = 0000000000000000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs\url3 = "https://login.aliexpress.com/" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLsTime\url5 = 0000000000000000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Software\Microsoft\Internet Explorer\IESettingSync iexplore.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings firefox.exe -
Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 4708 msedge.exe 4708 msedge.exe 5036 msedge.exe 5036 msedge.exe 2860 AcroRd32.exe 2860 AcroRd32.exe 2860 AcroRd32.exe 2860 AcroRd32.exe 2860 AcroRd32.exe 2860 AcroRd32.exe 2860 AcroRd32.exe 2860 AcroRd32.exe 2860 AcroRd32.exe 2860 AcroRd32.exe 2860 AcroRd32.exe 2860 AcroRd32.exe 2860 AcroRd32.exe 2860 AcroRd32.exe 2860 AcroRd32.exe 2860 AcroRd32.exe 2860 AcroRd32.exe 2860 AcroRd32.exe 2860 AcroRd32.exe 2860 AcroRd32.exe 2120 identity_helper.exe 2120 identity_helper.exe 7028 msedge.exe 7028 msedge.exe 7028 msedge.exe 7028 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs
pid Process 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 5636 firefox.exe Token: SeDebugPrivilege 5636 firefox.exe -
Suspicious use of FindShellTrayWindow 31 IoCs
pid Process 2860 AcroRd32.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5636 firefox.exe 5636 firefox.exe 5636 firefox.exe 5636 firefox.exe 6372 iexplore.exe -
Suspicious use of SendNotifyMessage 27 IoCs
pid Process 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5636 firefox.exe 5636 firefox.exe 5636 firefox.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 2860 AcroRd32.exe 2860 AcroRd32.exe 2860 AcroRd32.exe 2860 AcroRd32.exe 2860 AcroRd32.exe 2860 AcroRd32.exe 5636 firefox.exe 6372 iexplore.exe 6372 iexplore.exe 6428 IEXPLORE.EXE 6428 IEXPLORE.EXE 6428 IEXPLORE.EXE 6428 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2860 wrote to memory of 3624 2860 AcroRd32.exe 92 PID 2860 wrote to memory of 3624 2860 AcroRd32.exe 92 PID 2860 wrote to memory of 3624 2860 AcroRd32.exe 92 PID 3624 wrote to memory of 392 3624 RdrCEF.exe 94 PID 3624 wrote to memory of 392 3624 RdrCEF.exe 94 PID 3624 wrote to memory of 392 3624 RdrCEF.exe 94 PID 3624 wrote to memory of 392 3624 RdrCEF.exe 94 PID 3624 wrote to memory of 392 3624 RdrCEF.exe 94 PID 3624 wrote to memory of 392 3624 RdrCEF.exe 94 PID 3624 wrote to memory of 392 3624 RdrCEF.exe 94 PID 3624 wrote to memory of 392 3624 RdrCEF.exe 94 PID 3624 wrote to memory of 392 3624 RdrCEF.exe 94 PID 3624 wrote to memory of 392 3624 RdrCEF.exe 94 PID 3624 wrote to memory of 392 3624 RdrCEF.exe 94 PID 3624 wrote to memory of 392 3624 RdrCEF.exe 94 PID 3624 wrote to memory of 392 3624 RdrCEF.exe 94 PID 3624 wrote to memory of 392 3624 RdrCEF.exe 94 PID 3624 wrote to memory of 392 3624 RdrCEF.exe 94 PID 3624 wrote to memory of 392 3624 RdrCEF.exe 94 PID 3624 wrote to memory of 392 3624 RdrCEF.exe 94 PID 3624 wrote to memory of 392 3624 RdrCEF.exe 94 PID 3624 wrote to memory of 392 3624 RdrCEF.exe 94 PID 3624 wrote to memory of 392 3624 RdrCEF.exe 94 PID 3624 wrote to memory of 392 3624 RdrCEF.exe 94 PID 3624 wrote to memory of 392 3624 RdrCEF.exe 94 PID 3624 wrote to memory of 392 3624 RdrCEF.exe 94 PID 3624 wrote to memory of 392 3624 RdrCEF.exe 94 PID 3624 wrote to memory of 392 3624 RdrCEF.exe 94 PID 3624 wrote to memory of 392 3624 RdrCEF.exe 94 PID 3624 wrote to memory of 392 3624 RdrCEF.exe 94 PID 3624 wrote to memory of 392 3624 RdrCEF.exe 94 PID 3624 wrote to memory of 392 3624 RdrCEF.exe 94 PID 3624 wrote to memory of 392 3624 RdrCEF.exe 94 PID 3624 wrote to memory of 392 3624 RdrCEF.exe 94 PID 3624 wrote to memory of 392 3624 RdrCEF.exe 94 PID 3624 wrote to memory of 392 3624 RdrCEF.exe 94 PID 3624 wrote to memory of 392 3624 RdrCEF.exe 94 PID 3624 wrote to memory of 392 3624 RdrCEF.exe 94 PID 3624 wrote to memory of 392 3624 RdrCEF.exe 94 PID 3624 wrote to memory of 392 3624 RdrCEF.exe 94 PID 3624 wrote to memory of 392 3624 RdrCEF.exe 94 PID 3624 wrote to memory of 392 3624 RdrCEF.exe 94 PID 3624 wrote to memory of 392 3624 RdrCEF.exe 94 PID 3624 wrote to memory of 392 3624 RdrCEF.exe 94 PID 3624 wrote to memory of 2512 3624 RdrCEF.exe 95 PID 3624 wrote to memory of 2512 3624 RdrCEF.exe 95 PID 3624 wrote to memory of 2512 3624 RdrCEF.exe 95 PID 3624 wrote to memory of 2512 3624 RdrCEF.exe 95 PID 3624 wrote to memory of 2512 3624 RdrCEF.exe 95 PID 3624 wrote to memory of 2512 3624 RdrCEF.exe 95 PID 3624 wrote to memory of 2512 3624 RdrCEF.exe 95 PID 3624 wrote to memory of 2512 3624 RdrCEF.exe 95 PID 3624 wrote to memory of 2512 3624 RdrCEF.exe 95 PID 3624 wrote to memory of 2512 3624 RdrCEF.exe 95 PID 3624 wrote to memory of 2512 3624 RdrCEF.exe 95 PID 3624 wrote to memory of 2512 3624 RdrCEF.exe 95 PID 3624 wrote to memory of 2512 3624 RdrCEF.exe 95 PID 3624 wrote to memory of 2512 3624 RdrCEF.exe 95 PID 3624 wrote to memory of 2512 3624 RdrCEF.exe 95 PID 3624 wrote to memory of 2512 3624 RdrCEF.exe 95 PID 3624 wrote to memory of 2512 3624 RdrCEF.exe 95 PID 3624 wrote to memory of 2512 3624 RdrCEF.exe 95 PID 3624 wrote to memory of 2512 3624 RdrCEF.exe 95 PID 3624 wrote to memory of 2512 3624 RdrCEF.exe 95
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\rpservicesofwiINV-234183.pdf"1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=B8858AFF5BE2A456512D29A267660D62 --mojo-platform-channel-handle=1756 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:392
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=16EB057780CEF6C00DB1B78912F960A5 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=16EB057780CEF6C00DB1B78912F960A5 --renderer-client-id=2 --mojo-platform-channel-handle=1768 --allow-no-sandbox-job /prefetch:13⤵PID:2512
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=208D4B78930E761F77EF00B5B107AD94 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=208D4B78930E761F77EF00B5B107AD94 --renderer-client-id=4 --mojo-platform-channel-handle=2184 --allow-no-sandbox-job /prefetch:13⤵PID:732
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=8CE1D2F79A04EE0A10A819455D7F8D78 --mojo-platform-channel-handle=2564 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:2140
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=35B288688E54FBFE391BDF85DD698F78 --mojo-platform-channel-handle=1880 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:2824
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=BED9A9371305AC315B864232DC58C224 --mojo-platform-channel-handle=2620 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3300
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://adclick.g.doubleclick.net/pcs/click?xai=AKAOjstFA55hCSrFSTBDNko3225YAz6GkouTQlHjExWXRbT5OPMnSlE8Wh4LAVp-D7jWRr-LcKW0w-HH1g8lCVAK_eU-5azfUXfjqfTiHFOFWV9I8m2ZaGczGlov1iY8kMSnelCX-AHG6VYBmpcZJapT1XbdlOM3B9u9whYqpkxEpFLbkzwDao00-DL8JyS7UIxIApb_JHANRmtKLSuRcM8IWqFaP0cOc8n8jTedmwHc8oAw2MV2tRUaAnN3eaxaESpc8fovDeWslJ0A3duo5g46YzCYxQ8A56RI5MGcQw4TZj6TeWuj6jRjAe7g0X18--IBmztC1sUi6XuHkB1Ew-z_h9bv1XK-s_9L6zeDfQPtMsI3hOqp8T8545VdgCoElxs&sig=Cg0ArKJSzEpZ_YMvCKWCEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&adurl=http://173.249.58.32/rpservicesofwiINV-234183/val2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5036 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa902746f8,0x7ffa90274708,0x7ffa902747183⤵PID:5088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,15929463517749417061,16878334465620711665,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:23⤵PID:2420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,15929463517749417061,16878334465620711665,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2640 /prefetch:83⤵PID:2596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,15929463517749417061,16878334465620711665,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:4708
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15929463517749417061,16878334465620711665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:13⤵PID:3880
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15929463517749417061,16878334465620711665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:13⤵PID:4088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,15929463517749417061,16878334465620711665,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4468 /prefetch:83⤵PID:4448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,15929463517749417061,16878334465620711665,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4468 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:2120
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15929463517749417061,16878334465620711665,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:13⤵PID:3840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15929463517749417061,16878334465620711665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:13⤵PID:2820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15929463517749417061,16878334465620711665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:13⤵PID:5264
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15929463517749417061,16878334465620711665,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:13⤵PID:5272
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15929463517749417061,16878334465620711665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3916 /prefetch:13⤵PID:2056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15929463517749417061,16878334465620711665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:13⤵PID:5488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15929463517749417061,16878334465620711665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3908 /prefetch:13⤵PID:5672
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15929463517749417061,16878334465620711665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3564 /prefetch:13⤵PID:6116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15929463517749417061,16878334465620711665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:13⤵PID:548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2116,15929463517749417061,16878334465620711665,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4472 /prefetch:83⤵PID:5500
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15929463517749417061,16878334465620711665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:13⤵PID:4584
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,15929463517749417061,16878334465620711665,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5780 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:7028
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2944
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵PID:1552
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5636 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5636.0.1986049656\384716269" -parentBuildID 20221007134813 -prefsHandle 1904 -prefMapHandle 1896 -prefsLen 20938 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8d345901-5d09-459c-8049-c7020294f2da} 5636 "\\.\pipe\gecko-crash-server-pipe.5636" 1976 2466b0d8e58 gpu3⤵PID:5868
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5636.1.149091450\123449579" -parentBuildID 20221007134813 -prefsHandle 2356 -prefMapHandle 2352 -prefsLen 20974 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {57a01f73-6315-41f3-a14e-433d79a11cc1} 5636 "\\.\pipe\gecko-crash-server-pipe.5636" 2376 2465e972558 socket3⤵PID:1052
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5636.2.1569813512\179125429" -childID 1 -isForBrowser -prefsHandle 2960 -prefMapHandle 3060 -prefsLen 21077 -prefMapSize 232675 -jsInitHandle 1408 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8a5b3f49-a72b-445b-b8dd-f3c33e27464c} 5636 "\\.\pipe\gecko-crash-server-pipe.5636" 3184 2466f2b7558 tab3⤵PID:4428
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5636.3.1356888854\18474843" -childID 2 -isForBrowser -prefsHandle 3828 -prefMapHandle 3824 -prefsLen 26437 -prefMapSize 232675 -jsInitHandle 1408 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {37d3e555-1745-444c-a901-14336a589fa3} 5636 "\\.\pipe\gecko-crash-server-pipe.5636" 3848 2465e968d58 tab3⤵PID:6044
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5636.4.1318144200\1770917545" -childID 3 -isForBrowser -prefsHandle 4412 -prefMapHandle 4408 -prefsLen 26496 -prefMapSize 232675 -jsInitHandle 1408 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fdf262b1-594b-4dd5-a636-0afda1060006} 5636 "\\.\pipe\gecko-crash-server-pipe.5636" 4368 2467096e858 tab3⤵PID:3176
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5636.6.881084814\1451558444" -childID 5 -isForBrowser -prefsHandle 5244 -prefMapHandle 5248 -prefsLen 26656 -prefMapSize 232675 -jsInitHandle 1408 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {27ba2327-26f9-4715-8244-91b1196e79e3} 5636 "\\.\pipe\gecko-crash-server-pipe.5636" 5232 246717b4958 tab3⤵PID:912
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5636.7.2050356656\1790042326" -childID 6 -isForBrowser -prefsHandle 5512 -prefMapHandle 5508 -prefsLen 26656 -prefMapSize 232675 -jsInitHandle 1408 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0003b081-c6f3-453f-9f46-77b1095b75ee} 5636 "\\.\pipe\gecko-crash-server-pipe.5636" 5520 246717b5558 tab3⤵PID:3316
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5636.5.2111906253\903183050" -childID 4 -isForBrowser -prefsHandle 2896 -prefMapHandle 2888 -prefsLen 26656 -prefMapSize 232675 -jsInitHandle 1408 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {35a7839f-817a-4fcc-90ba-415f44997b93} 5636 "\\.\pipe\gecko-crash-server-pipe.5636" 1724 2465e965358 tab3⤵PID:1384
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5636.8.1362969129\780023123" -childID 7 -isForBrowser -prefsHandle 4944 -prefMapHandle 4820 -prefsLen 27096 -prefMapSize 232675 -jsInitHandle 1408 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a885b97f-7186-4381-aedc-3ae6e2579b3f} 5636 "\\.\pipe\gecko-crash-server-pipe.5636" 2820 2466f22c458 tab3⤵PID:4984
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:6372 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6372 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:6428
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵PID:6744
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x120,0x124,0x128,0xf8,0xfc,0x7ffa98009758,0x7ffa98009768,0x7ffa980097782⤵PID:6756
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1808 --field-trial-handle=2040,i,14534782759524254849,1096602057422446004,131072 /prefetch:22⤵PID:6920
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1992 --field-trial-handle=2040,i,14534782759524254849,1096602057422446004,131072 /prefetch:82⤵PID:5216
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2280 --field-trial-handle=2040,i,14534782759524254849,1096602057422446004,131072 /prefetch:82⤵PID:6944
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3264 --field-trial-handle=2040,i,14534782759524254849,1096602057422446004,131072 /prefetch:12⤵PID:4636
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3288 --field-trial-handle=2040,i,14534782759524254849,1096602057422446004,131072 /prefetch:12⤵PID:7032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4600 --field-trial-handle=2040,i,14534782759524254849,1096602057422446004,131072 /prefetch:12⤵PID:6276
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4856 --field-trial-handle=2040,i,14534782759524254849,1096602057422446004,131072 /prefetch:82⤵PID:5196
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4840 --field-trial-handle=2040,i,14534782759524254849,1096602057422446004,131072 /prefetch:82⤵PID:4864
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:7152
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
56KB
MD5752a1f26b18748311b691c7d8fc20633
SHA1c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA256111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
SHA512a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
-
Filesize
56KB
MD5752a1f26b18748311b691c7d8fc20633
SHA1c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA256111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
SHA512a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
-
Filesize
64KB
MD5230de24f3c3d609463ddd2f9a3817f48
SHA1c0eaec32e8622b8664dd220679f5dcc22cff52aa
SHA256ea9da4fbcf1cd71b3087396e0108505c4f2984885797720283fce3780adbbf4b
SHA512c640f0f255d5cb10b8e7ef789ce02cae925b43c9bbae1314b6077902130c29a5cea2755d7ee336dd1d000227d3dc718d2a9c15039ccce2dfe3b52914c3b2c7b3
-
Filesize
89KB
MD5d5ae2f7eea6b1a37ce07f55a14eb8ce5
SHA1ee2cb855365b7a27eeb97adeeb175bcfe26daba2
SHA2562f7e3684d988bf5729810a474a8e5c61fd2c9cb22c15821ca92e497958871ccf
SHA51275e0c14238be848ac6120c254ffb4b975cf35cc4f1345102db48176af7e7c2b697574cd9ff4c669672d9b5b09396fb50ee62edaa8259bd4b6133d91ba15e251a
-
Filesize
152B
MD5fc99b0086d7714fd471ed4acc862ccc0
SHA139a3c43c97f778d67413a023d66e8e930d0e2314
SHA25645ef01f81605bfd96126d5520c5aa0304c7fa7d5fdb3e4d5b2dd2bf84e2afd96
SHA512c308fa3eda9235d67a506a5f058fefb9a769ec01d7b0d4f5a2397892cc4f8155301c55c1fac23bebacdd087ab3f47f1eacc9ff88eff4115a7d67aa7b1d6581a8
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
314B
MD51443ad8745fc0cb04cbff4e7ed2bc8b0
SHA189927193cc3f0c059514b911f3422ca5d887a248
SHA256783c51827cd7319cd02fa3918b357b43a4bf9a8bc0fc614f05d47b95810d7d3c
SHA51263a9c018cfebeeacf0d8fc39e7f3a3408c23f83e79a13ae4cc3a34bf4956783c99d808698e3faf8bffd02ba80557f27a15d15a7c759ce2f3f5ab7b64bdcfed92
-
Filesize
5KB
MD52d4d5ab128ec9e764cc6f783a54b315c
SHA11d31f86f682d93391628d38eed373785b8a02495
SHA25689de073071064ac86c8b9998c15508897e9cc2be333b82462ef13309b18480cb
SHA512efbd89df1a9446413574ea1ffc4ba65cc4b8de756e5e48c0a5e8123654f7f360912d5d3c46a2a734d2e061aacfbe3a77a2b286e04a262aee59559df7636f2415
-
Filesize
6KB
MD5b7ec5a019896aa828576aaa18d74fb8c
SHA19825342c2373efc9e8a0b63a4d60269c9310ca1a
SHA256b3e3dbe83c264a8f556a5aec9500bf50e392e14c4a4460ceed930f0282038e8f
SHA51224e30b2e176c448aa07db168d12c3aabdb913c37eb40579e8b346071058b68814e0b1707bb8fc1c54b10f4d1462ac87678b7e5f1b0113295c19608853bbaac74
-
Filesize
5KB
MD550974b1fb156575b626d02933c07abf8
SHA12c9a5ce252f1a220c0f511ba41c6d41548140093
SHA256a8d6560a7e7ae36b6a504d1f490bcb6e40d9e18a2409f9991d0d1ea755e1fc3a
SHA512be1cf2be6910bb8d4668270d5e21508f02b875221d7225ff51932c68f5a2d60711aeebbf8a32b83ca1ef1ab8677d33c7cf78ca84ae26ce0092ac1054079ce5f9
-
Filesize
5KB
MD5dea00a785c57941035ef5acd66071302
SHA18a6ed8aebc703f8f089ef6cc69c973207020041e
SHA2564efe4d0b4c0b38765d133edf33d4bfb961e9a0e340662973154dde2f40ca60a9
SHA5129e4666f6870b48fbb547f1dd488d1664bd5715abd074d4079efd9200454da33e4c700300b14ce7abae7f7d1f941358e9733fa5a717aa66c707f880d4f4976277
-
Filesize
6KB
MD518fb2abd8618f0f0fa854fb9e469f97d
SHA1db6966133e04f2d4ba638bb993c342432de27dc3
SHA2564cd530e5251424b519edb3f915dbd2dd167f212246884b752811f45a9ac18632
SHA512d3a8ef522fabfe746e318e0923f5dc2fd8a46652ab248428ccb337e9df127033d682e0a76daecb48646cb96ab4aab12a145041a7d665294e86327e44b7850076
-
Filesize
24KB
MD596f00bbd6a174879c58220f95f0115f5
SHA1d3d7f82b0bf27daf1b3903bfe050c2d05422050f
SHA256644442e740a8c0bb20f712f6f84f5bf4a81bb29d4e9446b2832ca65618961107
SHA512e7c5e90eb85aee7b81b9c163f618ad3789a48b256040f6f00eee7fce52c60e1ff491bf0538b9c846fb115b73163710e46a45ce056e3b41ca59d88c421502ccea
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
12KB
MD553d6fa5b57938a5daf7afbb0b34d7be8
SHA1325f9ca0bd5803d5d8a70cc3270d72b2c0ef3c3d
SHA2563fcc5971a48703b5882a6c4ceef4d0b55e61ec223511e08363acbf49625633cd
SHA512b6a4952f9cee4f5227ab4c86dc1d20470ab53ccc5245014f3f7c7b1816ef809235806c31f3fab17b202f1d43c6cb25af46fac84ad13b30dfa78142124410e8c0
-
Filesize
12KB
MD54678cdb5f073dded5a9a382d999693a7
SHA1d013f05fab2163f4121841431d402d8dbd7ec9ef
SHA2563ad06842c6c176ee2437ca8399d2b40c8545ba81bfd057e7f1e3e28f4a12748b
SHA5126fbe4a499c9edee753b08bacaf4aafbb50d31cc4ad5e0a04e368e1f626c3715f61c6494849c95535697ab18f612b67aae63e0ce771d6a2401647d6ac0de8a39c
-
Filesize
13KB
MD55a7ddb5c83ccff7061f7a9e4e55db5d8
SHA146a8a42d0cd629b8414f66187c586900457e3f1d
SHA256d406494b6198b16dcbf3e6e6abbb576ad3e59e855383574e7c38ace7d27cca0d
SHA51243b79dbbff6dd74fc4de86168afd1b2a1bf04b7102476c361b0f6a51adad2f6c3b52fdbede7c1da9874bf44164a40feb850f11fbcee12ceef6fc2bf649b17f84
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\activity-stream.discovery_stream.json.tmp
Filesize151KB
MD5c057d760a5330866c8932bd4af8b19b4
SHA1bd34b3795fa1646aaccc2b4907753fccecfe979a
SHA256ccedb10b925f6009f0768254b45150bca42a457f957ccffb8902c9b5547d86e7
SHA5124c2abf2ba4accb51af323585c4da7bc63165536de0fde986b7bee2122037cb1a2b89795efa69f79201908bc4b43fa7e8ef271ded8de546cbf06acd3a5cdb3db4
-
Filesize
6KB
MD54549a69360088f18e1fa6dfe4e5eea42
SHA1fcbbbda3709957716de49b9d95239fbc577d30be
SHA25608745161b36032a2c6ccd057ff14ac603b35c22460a6af22022a8a5060a2da8f
SHA5122b1222b4d257e0173a307ec6fc6271bb2883b0787615bf73045f1766628324cc97ea7464c008590b9747a758ae833c636df0d954218f21d7c3c3ccbf810262ce
-
Filesize
6KB
MD55bd72dec13a4dcee966b857af6027972
SHA13441a29b4eb8d4ab5d113a07297a61f4428da719
SHA256962505f68e03c2a39c6f5884335e530b590b4b80159f84e1b9e4c35f62f38a74
SHA512708f4ae43f38a2648f611d10c8beacc4f6441bb12d780fbeef7b5b4952e128384ff78c9b7b850dfa1cefa90b2ae1fa075985866dd608db9ceca560cc78c538ea
-
Filesize
6KB
MD5efb25076829b4bdf73c91b54bc893ccc
SHA1e9b5fe44b16779ef6a7325a3f282175c200699ff
SHA2561d91e507e79f1b7ba723aee87fd30c60f90de0adee94e4d0eb14fd0c920516ab
SHA5122584397f7fc1ac6aa38ae0e0d08b32c37c0e528203da3ada2b27cbcb55fc0890a04749693a049ef160101ea1b5e0b70192ba8cac8dfbf07437cbf84027ded85b
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\sessionstore-backups\recovery.jsonlz4
Filesize1KB
MD5ac96aec7e942ff4170b2e2ee80b595c9
SHA17dc81d33f27e7d64b4021dda4ac07822d4e9b88c
SHA2566636f8892cb555537571b4d47b161f452ad5d5a91f60f85a59d97e32ba048c7c
SHA512b5611ad3d6beec237f86f320aef979e50df5f19459824e5d488b2dbaf060145241e702ca7dbba4c221c66afb82761f82f67f640470ae002b7f656649fd3e68d6
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\sessionstore-backups\recovery.jsonlz4
Filesize1KB
MD55bd76b09fc34e578050a03bf027724e1
SHA165810df2c020a7ca275344094321e0118144af78
SHA2569d0d5d6d46304778341d33562beac53bb9edd3db0edfcfa33446cee57bed03b1
SHA5126c6abf98708c8d0f608b144dccde6f458b193b8834934f27db9f2b1128e27bc081f4d48c042cb9684b3676d5bd27b8233660a3e97904ba4812cf7aced3f7835a