Malware Analysis Report

2024-10-10 10:06

Sample ID 240511-yzwrksfc6s
Target 7ebabb8b4bb51cf.exe
SHA256 16771b819b03044356bad5b6d2a6b0f84e7fbd94c336743b58bbe5dc2e2ccbe8
Tags
dcrat umbral evasion execution infostealer rat spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

16771b819b03044356bad5b6d2a6b0f84e7fbd94c336743b58bbe5dc2e2ccbe8

Threat Level: Known bad

The file 7ebabb8b4bb51cf.exe was found to be: Known bad.

Malicious Activity Summary

dcrat umbral evasion execution infostealer rat spyware stealer trojan

DcRat

Umbral

Detect Umbral payload

Process spawned unexpected child process

UAC bypass

DCRat payload

Command and Scripting Interpreter: PowerShell

Drops file in Drivers directory

Reads user/profile data of web browsers

Executes dropped EXE

Checks whether UAC is enabled

Looks up external IP address via web service

Legitimate hosting services abused for malware hosting/C2

Suspicious use of SetThreadContext

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Enumerates system info in registry

Suspicious use of WriteProcessMemory

Creates scheduled task(s)

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Views/modifies file attributes

System policy modification

Uses Volume Shadow Copy service COM API

Suspicious behavior: GetForegroundWindowSpam

Modifies data under HKEY_USERS

Suspicious use of SendNotifyMessage

Detects videocard installed

Suspicious use of AdjustPrivilegeToken

Uses Task Scheduler COM API

Suspicious use of FindShellTrayWindow

Suspicious behavior: EnumeratesProcesses

Runs ping.exe

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-11 20:13

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-11 20:13

Reported

2024-05-11 20:19

Platform

win11-20240426-en

Max time kernel

299s

Max time network

301s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7ebabb8b4bb51cf.exe"

Signatures

DcRat

rat infostealer dcrat

Detect Umbral payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\pris\WmiPrvSE.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\pris\WmiPrvSE.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\pris\WmiPrvSE.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A

Umbral

stealer umbral

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\explorer.exe N/A

Reads user/profile data of web browsers

spyware stealer

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\pris\WmiPrvSE.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\pris\WmiPrvSE.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1052 set thread context of 3172 N/A C:\Users\Admin\AppData\Local\Temp\7ebabb8b4bb51cf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Windows Photo Viewer\en-US\29c1c3cc0f7685 C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Program Files\Windows Photo Viewer\en-US\RCX6B12.tmp C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Program Files\Windows Photo Viewer\en-US\RCX6B13.tmp C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Program Files\Windows Photo Viewer\en-US\unsecapp.exe C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File created C:\Program Files\Windows Photo Viewer\en-US\unsecapp.exe C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\pris\RCX6D18.tmp C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\pris\RCX6D96.tmp C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\pris\WmiPrvSE.exe C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File created C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\pris\WmiPrvSE.exe C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File created C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\pris\24dbde2999530e C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A

Enumerates physical storage devices

Detects videocard installed

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\wmic.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133599321522692659" C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\pris\WmiPrvSE.exe N/A
N/A N/A C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\pris\WmiPrvSE.exe N/A
N/A N/A C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\pris\WmiPrvSE.exe N/A
N/A N/A C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\pris\WmiPrvSE.exe N/A
N/A N/A C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\pris\WmiPrvSE.exe N/A
N/A N/A C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\pris\WmiPrvSE.exe N/A
N/A N/A C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\pris\WmiPrvSE.exe N/A
N/A N/A C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\pris\WmiPrvSE.exe N/A
N/A N/A C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\pris\WmiPrvSE.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\pris\WmiPrvSE.exe N/A
N/A N/A C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\pris\WmiPrvSE.exe N/A
N/A N/A C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\pris\WmiPrvSE.exe N/A
N/A N/A C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\pris\WmiPrvSE.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\pris\WmiPrvSE.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7ebabb8b4bb51cf.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1052 wrote to memory of 3172 N/A C:\Users\Admin\AppData\Local\Temp\7ebabb8b4bb51cf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1052 wrote to memory of 3172 N/A C:\Users\Admin\AppData\Local\Temp\7ebabb8b4bb51cf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1052 wrote to memory of 3172 N/A C:\Users\Admin\AppData\Local\Temp\7ebabb8b4bb51cf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1052 wrote to memory of 3172 N/A C:\Users\Admin\AppData\Local\Temp\7ebabb8b4bb51cf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1052 wrote to memory of 3172 N/A C:\Users\Admin\AppData\Local\Temp\7ebabb8b4bb51cf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1052 wrote to memory of 3172 N/A C:\Users\Admin\AppData\Local\Temp\7ebabb8b4bb51cf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1052 wrote to memory of 3172 N/A C:\Users\Admin\AppData\Local\Temp\7ebabb8b4bb51cf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1052 wrote to memory of 3172 N/A C:\Users\Admin\AppData\Local\Temp\7ebabb8b4bb51cf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1052 wrote to memory of 3172 N/A C:\Users\Admin\AppData\Local\Temp\7ebabb8b4bb51cf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3172 wrote to memory of 4408 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 3172 wrote to memory of 4408 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 3172 wrote to memory of 4408 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 3172 wrote to memory of 1788 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Local\Temp\explorer.exe
PID 3172 wrote to memory of 1788 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Local\Temp\explorer.exe
PID 4408 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\WScript.exe
PID 4408 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\WScript.exe
PID 4408 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\WScript.exe
PID 1788 wrote to memory of 2300 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\SYSTEM32\attrib.exe
PID 1788 wrote to memory of 2300 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\SYSTEM32\attrib.exe
PID 1788 wrote to memory of 256 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1788 wrote to memory of 256 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1788 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1788 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1788 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1788 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1788 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1788 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1600 wrote to memory of 4744 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1600 wrote to memory of 4744 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1600 wrote to memory of 4744 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 4744 wrote to memory of 2336 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\discord\savesref.exe
PID 4744 wrote to memory of 2336 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\discord\savesref.exe
PID 1788 wrote to memory of 1112 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\Wbem\wmic.exe
PID 1788 wrote to memory of 1112 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\Wbem\wmic.exe
PID 1788 wrote to memory of 4140 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\Wbem\wmic.exe
PID 1788 wrote to memory of 4140 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\Wbem\wmic.exe
PID 1788 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\Wbem\wmic.exe
PID 1788 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\Wbem\wmic.exe
PID 1788 wrote to memory of 1448 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1788 wrote to memory of 1448 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1788 wrote to memory of 4352 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\Wbem\wmic.exe
PID 1788 wrote to memory of 4352 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\Wbem\wmic.exe
PID 1788 wrote to memory of 4072 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\SYSTEM32\cmd.exe
PID 1788 wrote to memory of 4072 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\SYSTEM32\cmd.exe
PID 4072 wrote to memory of 4252 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\PING.EXE
PID 4072 wrote to memory of 4252 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\PING.EXE
PID 2336 wrote to memory of 4620 N/A C:\Users\Admin\AppData\Roaming\discord\savesref.exe C:\Windows\System32\cmd.exe
PID 2336 wrote to memory of 4620 N/A C:\Users\Admin\AppData\Roaming\discord\savesref.exe C:\Windows\System32\cmd.exe
PID 4620 wrote to memory of 4012 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 4620 wrote to memory of 4012 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 4620 wrote to memory of 2220 N/A C:\Windows\System32\cmd.exe C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\pris\WmiPrvSE.exe
PID 4620 wrote to memory of 2220 N/A C:\Windows\System32\cmd.exe C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\pris\WmiPrvSE.exe
PID 3356 wrote to memory of 3768 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3356 wrote to memory of 3768 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3356 wrote to memory of 3200 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3356 wrote to memory of 3200 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3356 wrote to memory of 3200 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3356 wrote to memory of 3200 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3356 wrote to memory of 3200 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3356 wrote to memory of 3200 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3356 wrote to memory of 3200 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3356 wrote to memory of 3200 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3356 wrote to memory of 3200 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3356 wrote to memory of 3200 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\pris\WmiPrvSE.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\pris\WmiPrvSE.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\pris\WmiPrvSE.exe N/A

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\7ebabb8b4bb51cf.exe

"C:\Users\Admin\AppData\Local\Temp\7ebabb8b4bb51cf.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\svchost.exe

"C:\Users\Admin\AppData\Local\Temp\svchost.exe"

C:\Users\Admin\AppData\Local\Temp\explorer.exe

"C:\Users\Admin\AppData\Local\Temp\explorer.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\discord\KVGHJrchTtXZ1.vbe"

C:\Windows\SYSTEM32\attrib.exe

"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\explorer.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\explorer.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\discord\91XI5GEPShJXCgG0eVHRJ.bat" "

C:\Users\Admin\AppData\Roaming\discord\savesref.exe

"C:\Users\Admin\AppData\Roaming\discord\savesref.exe"

C:\Windows\System32\Wbem\wmic.exe

"wmic.exe" os get Caption

C:\Windows\System32\Wbem\wmic.exe

"wmic.exe" computersystem get totalphysicalmemory

C:\Windows\System32\Wbem\wmic.exe

"wmic.exe" csproduct get uuid

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Photo Viewer\en-US\unsecapp.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\en-US\unsecapp.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Photo Viewer\en-US\unsecapp.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\pris\WmiPrvSE.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\pris\WmiPrvSE.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\pris\WmiPrvSE.exe'" /rl HIGHEST /f

C:\Windows\System32\Wbem\wmic.exe

"wmic" path win32_VideoController get name

C:\Windows\SYSTEM32\cmd.exe

"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\explorer.exe" && pause

C:\Windows\system32\PING.EXE

ping localhost

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0EpYUV7rVf.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\pris\WmiPrvSE.exe

"C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\pris\WmiPrvSE.exe"

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffdb888ab58,0x7ffdb888ab68,0x7ffdb888ab78

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1608 --field-trial-handle=1800,i,7780612314402273076,8940181584291854832,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1800,i,7780612314402273076,8940181584291854832,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2192 --field-trial-handle=1800,i,7780612314402273076,8940181584291854832,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3016 --field-trial-handle=1800,i,7780612314402273076,8940181584291854832,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2848 --field-trial-handle=1800,i,7780612314402273076,8940181584291854832,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4196 --field-trial-handle=1800,i,7780612314402273076,8940181584291854832,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4372 --field-trial-handle=1800,i,7780612314402273076,8940181584291854832,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4516 --field-trial-handle=1800,i,7780612314402273076,8940181584291854832,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3008 --field-trial-handle=1800,i,7780612314402273076,8940181584291854832,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4764 --field-trial-handle=1800,i,7780612314402273076,8940181584291854832,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4388 --field-trial-handle=1800,i,7780612314402273076,8940181584291854832,131072 /prefetch:8

C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\pris\WmiPrvSE.exe

C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\pris\WmiPrvSE.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 artemis.community udp
GB 216.58.201.99:443 gstatic.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 162.159.135.232:443 discord.com tcp
RU 141.8.195.33:80 a0982032.xsph.ru tcp
RU 141.8.195.33:80 a0982032.xsph.ru tcp
RU 141.8.195.33:80 a0982032.xsph.ru tcp
RU 141.8.195.33:80 a0982032.xsph.ru tcp
RU 141.8.195.33:80 a0982032.xsph.ru tcp
RU 141.8.195.33:80 a0982032.xsph.ru tcp
RU 141.8.195.33:80 a0982032.xsph.ru tcp
GB 142.250.178.4:443 www.google.com udp
GB 142.250.178.4:443 www.google.com tcp
US 8.8.8.8:53 42.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 4.178.250.142.in-addr.arpa udp
RU 141.8.195.33:80 a0982032.xsph.ru tcp
GB 142.250.187.206:443 play.google.com tcp
N/A 224.0.0.251:5353 udp
GB 172.217.16.238:443 clients2.google.com udp
GB 172.217.16.238:443 clients2.google.com tcp
RU 141.8.195.33:80 a0982032.xsph.ru tcp
RU 141.8.195.33:80 a0982032.xsph.ru tcp
RU 141.8.195.33:80 a0982032.xsph.ru tcp
RU 141.8.195.33:80 a0982032.xsph.ru tcp
RU 141.8.195.33:80 a0982032.xsph.ru tcp
RU 141.8.195.33:80 a0982032.xsph.ru tcp
RU 141.8.195.33:80 a0982032.xsph.ru tcp
RU 141.8.195.33:80 a0982032.xsph.ru tcp
RU 141.8.195.33:80 a0982032.xsph.ru tcp
RU 141.8.195.33:80 a0982032.xsph.ru tcp
RU 141.8.195.33:80 a0982032.xsph.ru tcp
RU 141.8.195.33:80 a0982032.xsph.ru tcp
RU 141.8.195.33:80 a0982032.xsph.ru tcp
RU 141.8.195.33:80 a0982032.xsph.ru tcp
RU 141.8.195.33:80 a0982032.xsph.ru tcp
RU 141.8.195.33:80 a0982032.xsph.ru tcp
RU 141.8.195.33:80 a0982032.xsph.ru tcp
RU 141.8.195.33:80 a0982032.xsph.ru tcp
RU 141.8.195.33:80 a0982032.xsph.ru tcp
RU 141.8.195.33:80 a0982032.xsph.ru tcp
RU 141.8.195.33:80 a0982032.xsph.ru tcp
RU 141.8.195.33:80 a0982032.xsph.ru tcp
RU 141.8.195.33:80 a0982032.xsph.ru tcp
RU 141.8.195.33:80 a0982032.xsph.ru tcp
RU 141.8.195.33:80 a0982032.xsph.ru tcp

Files

memory/1052-0-0x0000000074F3E000-0x0000000074F3F000-memory.dmp

memory/1052-1-0x0000000000EA0000-0x00000000016CA000-memory.dmp

memory/1052-2-0x0000000074F30000-0x00000000756E1000-memory.dmp

memory/1052-3-0x00000000062D0000-0x00000000062E0000-memory.dmp

memory/1052-4-0x0000000007CB0000-0x0000000007CB8000-memory.dmp

memory/3172-5-0x0000000000400000-0x000000000060E000-memory.dmp

memory/1052-7-0x0000000074F30000-0x00000000756E1000-memory.dmp

memory/3172-8-0x0000000074F30000-0x00000000756E1000-memory.dmp

memory/3172-9-0x0000000005940000-0x00000000059DC000-memory.dmp

memory/3172-12-0x0000000074F30000-0x00000000756E1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\svchost.exe

MD5 45008c4cc3fc25a5d5184742ae2fe72b
SHA1 f5e7b3110df6917df0e07a822c313c52eec335fd
SHA256 09d240d54a5458bcc9362ea0f06e23a345b69e196e127462d5f33e8a475ccd57
SHA512 3059e4e59cb103f08fd13f776bf65d41b4cfec7a7f6610a2c945e134d4b913185f64bdf357bbc3c52e26da77f9e04a19c121611ad11fb40bf486aade1751e335

C:\Users\Admin\AppData\Local\Temp\explorer.exe

MD5 5a006cd74e0225a15746bee6928d62f1
SHA1 a17dabdb634d9667c3590436998252148a5fab92
SHA256 0350fdb32852f781665e056a04f318e94c746612f7b4e3cd430d808c894aae4c
SHA512 59d6b467cf48cf1aafaf13e1acfdd6ae4806403f0bc92e759590b04da4ecd719488300ecd412d92931e7b65daf0ab2229d7a165b31595334676b40942bb30f81

memory/1788-31-0x000002C0A4990000-0x000002C0A49D0000-memory.dmp

memory/3172-38-0x0000000074F30000-0x00000000756E1000-memory.dmp

C:\Users\Admin\AppData\Roaming\discord\KVGHJrchTtXZ1.vbe

MD5 cdb5dc99d1017d58fdbfce66f048da76
SHA1 e1903f365d81996da9810b9f0dc40bc65b3324c7
SHA256 bd9e0e5f3e6379d03907896d71843cc2dbfef7e209cc0896b4755fa0422a3b43
SHA512 72e3e2f3b5f385c402faf7ac89690a99806f648f90e85f46b01db66284f247c10dbe03e612e41c46775cd29fecaeede2fd26bc8dc2e22e252f9f1ce9b801f88d

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0yum2fb5.pad.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/256-49-0x000001C9F6290000-0x000001C9F62B2000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 627073ee3ca9676911bee35548eff2b8
SHA1 4c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA256 85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
SHA512 3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 2e8eb51096d6f6781456fef7df731d97
SHA1 ec2aaf851a618fb43c3d040a13a71997c25bda43
SHA256 96bfd9dd5883329927fe8c08b8956355a1a6ceb30ceeb5d4252b346df32bc864
SHA512 0a73dc9a49f92d9dd556c2ca2e36761890b3538f355ee1f013e7cf648d8c4d065f28046cd4a167db3dea304d1fbcbcea68d11ce6e12a3f20f8b6c018a60422d2

memory/1788-65-0x000002C0BF1B0000-0x000002C0BF226000-memory.dmp

memory/1788-66-0x000002C0BF230000-0x000002C0BF280000-memory.dmp

memory/1788-67-0x000002C0A6680000-0x000002C0A669E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 d80c90c20d0f5c8f07229716f2beffef
SHA1 42dcd92a3a1059e5e559e1cd110ec98a3ac45e3e
SHA256 5ba478485882ee7c7aa928af8c98e7754e876887e00a0c69520d20bd4926e7f6
SHA512 d6a4b14a52154db7c5af19e60910774d61704e7a6243ba5f73e11f7b692ea75840730e04eaccb59387021edf57506e0c2999e4237e8d921a01053eb4a3274ecf

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 7332074ae2b01262736b6fbd9e100dac
SHA1 22f992165065107cc9417fa4117240d84414a13c
SHA256 baea84fda6c1f13090b8cbd91c920848946f10ce155ef31a1df4cd453ee7e4aa
SHA512 4ae6f0e012c31ac1fc2ff4a8877ce2b4667c45b6e651de798318a39a2b6fd39a6f72dffa8b0b89b7a045a27d724d195656faa25a9fec79b22f37ddebb5d22da2

memory/1788-101-0x000002C0A66D0000-0x000002C0A66DA000-memory.dmp

memory/1788-102-0x000002C0A6830000-0x000002C0A6842000-memory.dmp

C:\Users\Admin\AppData\Roaming\discord\91XI5GEPShJXCgG0eVHRJ.bat

MD5 84814a18997996f8a95ba8e868396e90
SHA1 30b79b2158d922433ba25117fb79f8720470fb44
SHA256 92c8ccb6b3a9abc0798ad760255c47356c3750a74b11e38590876c68927f3797
SHA512 b1b820e12c49fe4993229222a218a769e5d6913f303d382baaff735f3b24a5b068adcfb344397004dd9d7aa637c4e9baedf2e3ca3dfb3f56e86c8c8f8cf9cf7e

C:\Users\Admin\AppData\Roaming\discord\savesref.exe

MD5 0a32536cc1d5e2a35d7d289b4ff0e76b
SHA1 98736b0b5a6f3709f81365c9e6477819074c3170
SHA256 8d31ae46e123de0d23937d664298428e37b45a7a135a95d73f5887779ee48710
SHA512 b2d5d91eb7ecfc6eb295c63ecba5c3ceb4b4a865fc9a9f90bd1e82bff4bc39905baf9ab2962580ee708761632e5499694f3f823aa2f139bce809398262eb3b73

memory/2336-109-0x00000000003F0000-0x000000000057C000-memory.dmp

memory/2336-110-0x0000000002930000-0x000000000294C000-memory.dmp

memory/2336-111-0x0000000000E00000-0x0000000000E10000-memory.dmp

memory/2336-113-0x00000000027C0000-0x00000000027D0000-memory.dmp

memory/2336-112-0x0000000002950000-0x0000000002966000-memory.dmp

memory/2336-115-0x0000000002980000-0x0000000002988000-memory.dmp

memory/2336-114-0x0000000002970000-0x000000000297A000-memory.dmp

memory/2336-116-0x0000000002990000-0x000000000299C000-memory.dmp

memory/2336-119-0x00000000029C0000-0x00000000029CC000-memory.dmp

memory/2336-118-0x00000000029B0000-0x00000000029B8000-memory.dmp

memory/2336-117-0x00000000029A0000-0x00000000029A8000-memory.dmp

memory/2336-120-0x000000001B400000-0x000000001B40A000-memory.dmp

memory/2336-121-0x000000001B410000-0x000000001B41C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 10254f48b63b60ae6245903153592e48
SHA1 2c300d1c60c50e8896705022bc402c423681f40a
SHA256 b3778ffb5260878714023fd1abc70c4e850b5397c2b32a3975b1ff28bfd96c69
SHA512 6a7e7844c47a07bc8fd0b59267f0d1bac460f672ada93131edd65ca2eb33159de9f6291a1acde745f32991b364e9ceac697f2dfcf1a2696b51a9120dd7af77d4

C:\Program Files\Windows Photo Viewer\en-US\RCX6B13.tmp

MD5 bf164fec3cd078761a70462be31050fb
SHA1 48ebbb45426cbe2056e5f0bca1bd03e06ddfa5a2
SHA256 1d547dd97ae48345cae40c0a76258b3efa12dd8e9ea689f3d022e482584aa173
SHA512 fc4dbc0aa8d172b2b6c706e778acf5e49a5fc4c1c1fa763bd01a6d4332f1731ae5a87bfb500027067c3bb1b7508326c81b0462c08667b2b7a68bdc1ec38e748b

C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\pris\WmiPrvSE.exe

MD5 a0029298ab72def8735e0fdd28f253c2
SHA1 dcec475e4f1813c7ed3f41bb032b639addf7f76c
SHA256 5e32bed8b7e2b4439f4dc1d11e57e1628796debb216da90ac86cfbabb804c37c
SHA512 d987afcd3aedde30dd3bf687817403345d939807f537914af12e6db6e86ca66f7d167d8b87b7418db5a99ff14fd6bae26f3fee5929471cf1ca48c47cd47e4ad0

memory/1788-182-0x000002C0BF340000-0x000002C0BF4F3000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\0EpYUV7rVf.bat

MD5 b9e976067931abdb98a9969997dcf9d9
SHA1 87e14822209b81ae3814134ba0235e671f35b7dd
SHA256 667248f554c1f3ebef3c31c80b940ca2c551b1c0a80ee9e224879547dad6a51f
SHA512 a8468073ecbc2e9b80ec188c4389e0c6008505b2828e1fa573e393197411dc9ed984f6d1f632376336b1ae02b885bd4dbbfc1d61f8cab41831dc209dc566fc46

memory/2220-193-0x0000000000570000-0x00000000006FC000-memory.dmp

memory/2220-195-0x000000001C480000-0x000000001C489000-memory.dmp

memory/2220-196-0x000000001C680000-0x000000001C68D000-memory.dmp

memory/2220-194-0x000000001C620000-0x000000001C666000-memory.dmp

memory/2220-198-0x000000001C8C0000-0x000000001C8CB000-memory.dmp

memory/2220-197-0x000000001C6A0000-0x000000001C6BE000-memory.dmp

C:\Windows\system32\drivers\etc\hosts

MD5 4028457913f9d08b06137643fe3e01bc
SHA1 a5cb3f12beaea8194a2d3d83a62bdb8d558f5f14
SHA256 289d433902418aaf62e7b96b215ece04fcbcef2457daf90f46837a4d5090da58
SHA512 c8e1eef90618341bbde885fd126ece2b1911ca99d20d82f62985869ba457553b4c2bf1e841fd06dacbf27275b3b0940e5a794e1b1db0fd56440a96592362c28b

\??\pipe\crashpad_3356_RFGIBFFVKWVATIMC

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ce75ad7d-ec65-4ca9-a727-3426046c551c.tmp

MD5 37cdaa4de7205a54fa59b268e15a74b6
SHA1 5b450c723b6441abd62496748f666d3980455d2c
SHA256 e9d8a96e439a71f16344090b3b77e95b6b69e14fac1c2590c4d594266c9aa70f
SHA512 863044fad81ec70449745d2d024087fbf28775dda137f844e9e3a55985627940bf957083408f1b1c16997478d987ae463b92b03e2297b846f4a0d7f1c0ed58c0

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 b4bbe29292b2d135b1d24b7d1ca3250f
SHA1 2ee62bed440012af8e088e181caf8425c70356d2
SHA256 ee552f9d7646c8f6e9ad8623e125e8d073055280a453b969a22ae1f023b5c846
SHA512 f19628990e887098c22521873b9d02fbfb23ea69b27c62c1fb72376116d5f46743a32a9a8512713b6591901454a37a6aa9cf6388a21f4f6e6ae038a7cb7ef78f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 ebb07ccd5e413acc153af8096430eefd
SHA1 40c2146d9fc2cd4bf3db5815018ee12992cfc1ab
SHA256 be6947235018372395e4c14d686cfc4db10d0eadf051043aa2304fbda62fa54c
SHA512 ea8e60edf29f54a1993c73ab229bcc9162ab2cce287b3aa28993d0b30195fa293f5d94a24032fa0167b2b0d6ddc452a29aec1326cd9c3389166fef2eba1b6f74

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

MD5 92a396cbe9d88bf84907d36e27eab43e
SHA1 38dcbe7cbc214c3e7988ca43cede5185d7c03781
SHA256 6d2b84060388ef320aca8dc1c00d34298d593690661fb144c4681bfe15da5dd2
SHA512 0058e98c923eba88757e932828c729cfec6c68c3ab95c726982594f30fc409a163006259bf3bab31712936fd31554c04385ce3ccfb134ec1338cadfb0fd5d948

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 28acc555fe545484718981e299c93219
SHA1 f8539b69481a33f6263df16e1ef1d49b52db8dee
SHA256 1ae59d5e284344cfbf9662ec3a2f4ca0b632b3eab6dbece175f32a99f8644479
SHA512 d71735eb191e044291dd3d79ac3c6d86d1f205be4fbf46a2597b88d302b30f9d7d00e81ed8d0bbbef388b5051e875b11782db123514f3cef4d739a854856d906

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 64611990b96c87fb031c16adcee9575f
SHA1 b60eb6c23aef95192d3da96fc072ed7625700423
SHA256 558aec2d23423e4b683ad299a33cde84c73629f870ef9f6257d8edfd09c59bce
SHA512 836bee29c0381912431b7e8e1dca0e03b57c9f97cfa346ff7dabdee114c869e798f4700470a1c87f15ca531873d08cf38ae1330ffd97101d42417b2f2e0822d8

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

C:\Users\Admin\AppData\Local\Temp\fexS58Maux

MD5 42c395b8db48b6ce3d34c301d1eba9d5
SHA1 b7cfa3de344814bec105391663c0df4a74310996
SHA256 5644546ecefc6786c7be5b1a89e935e640963ccd34b130f21baab9370cb9055d
SHA512 7b9214db96e9bec8745b4161a41c4c0520cdda9950f0cd3f12c7744227a25d639d07c0dd68b552cf1e032181c2e4f8297747f27bad6c7447b0f415a86bd82845

C:\Users\Admin\AppData\Local\Temp\ZTyhZ00Qsy

MD5 8f5942354d3809f865f9767eddf51314
SHA1 20be11c0d42fc0cef53931ea9152b55082d1a11e
SHA256 776ecf8411b1b0167bea724409ac9d3f8479973df223ecc6e60e3302b3b2b8ea
SHA512 fde8dfae8a862cf106b0cb55e02d73e4e4c0527c744c20886681245c8160287f722612a6de9d0046ed1156b1771229c8950b9ac036b39c988d75aa20b7bac218