Analysis
- user interaction
yes - max time kernel
1800s - max time network
1803s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
24/10/2026, 22:07
General
- Target VencordInstaller.exe
- Size 11.0MB
- Sample261024-1146fsxtew
- SHA256 1cb4115a99a8b7a0b0371dddb2ac7dde38b9acc23f53a69540319b4b7ca6c2da
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Downloads MZ/PE file 2 IoCs
- Drops file in Drivers directory 2 IoCs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 18 IoCs
- Loads dropped DLL 7 IoCs
- Modifies system executable filetype association 2 TTPs 4 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in Program Files directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Inno Setup is an open-source installation builder for Windows applications. 4 IoCs
Inno Setup installer
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies Control Panel 2 IoCs
- Modifies Internet Explorer settings 1 TTPs 8 IoCs
- Modifies data under HKEY_USERS 7 IoCs
- Modifies registry class 64 IoCs
- Modifies system certificate store 2 TTPs 5 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 9 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 45 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 62 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\VencordInstaller.exe"C:\Users\Admin\AppData\Local\Temp\VencordInstaller.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffb1b54c728,0x7ffb1b54c734,0x7ffb1b54c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1632,i,13714816623766626491,302477407712503781,262144 --field-trial-handle=1764,i,16752454816425400597,12024522057225460644,262144 --variations-seed-version --mojo-platform-channel-handle=1760 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2152,i,6324664678770352828,10133528661014802136,524288 --field-trial-handle=1764,i,16752454816425400597,12024522057225460644,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:112⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2332,i,10333171344371507293,183222639657881827,524288 --field-trial-handle=1764,i,16752454816425400597,12024522057225460644,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,9135790257277000871,12452570391758813385,2097152 --field-trial-handle=1764,i,16752454816425400597,12024522057225460644,262144 --variations-seed-version --mojo-platform-channel-handle=3280 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3288,i,13950850057006225272,10070056867426646716,2097152 --field-trial-handle=1764,i,16752454816425400597,12024522057225460644,262144 --variations-seed-version --mojo-platform-channel-handle=3316 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4572,i,8326877787183884868,12391846070830617660,2097152 --field-trial-handle=1764,i,16752454816425400597,12024522057225460644,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4632,i,5827416588860912521,13184888857091202960,524288 --field-trial-handle=1764,i,16752454816425400597,12024522057225460644,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5384,i,10777887127494952360,5665712840804556952,524288 --field-trial-handle=1764,i,16752454816425400597,12024522057225460644,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5476,i,7112131613707050582,8181918421999670991,2097152 --field-trial-handle=1764,i,16752454816425400597,12024522057225460644,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5488,i,4293657448165344650,17484623946033225323,2097152 --field-trial-handle=1764,i,16752454816425400597,12024522057225460644,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5576,i,6544177317447147606,15403634574090706430,2097152 --field-trial-handle=1764,i,16752454816425400597,12024522057225460644,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5476,i,9569016587959391021,17218874626014240676,524288 --field-trial-handle=1764,i,16752454816425400597,12024522057225460644,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5568,i,3809204707796842588,9028841623669764389,2097152 --field-trial-handle=1764,i,16752454816425400597,12024522057225460644,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6104,i,7297280286298108681,11910051237403355058,2097152 --field-trial-handle=1764,i,16752454816425400597,12024522057225460644,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6220,i,2531999987295637369,7834807480732595654,2097152 --field-trial-handle=1764,i,16752454816425400597,12024522057225460644,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5520,i,1815326526747753497,12597625556492242321,2097152 --field-trial-handle=1764,i,16752454816425400597,12024522057225460644,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5760,i,12992528137146963547,231212646583104241,524288 --field-trial-handle=1764,i,16752454816425400597,12024522057225460644,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6396,i,493323645399020953,3842711111251608574,2097152 --field-trial-handle=1764,i,16752454816425400597,12024522057225460644,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5512,i,4594386231490030588,16357701190211176647,524288 --field-trial-handle=1764,i,16752454816425400597,12024522057225460644,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6024,i,12304361060585252209,11403784601251962393,2097152 --field-trial-handle=1764,i,16752454816425400597,12024522057225460644,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6476,i,7484091635838698326,8744744173437167718,2097152 --field-trial-handle=1764,i,16752454816425400597,12024522057225460644,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6584,i,11165724182200001238,17565796810188208083,2097152 --field-trial-handle=1764,i,16752454816425400597,12024522057225460644,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=3704,i,17082757977288173301,13400639831995663839,2097152 --field-trial-handle=1764,i,16752454816425400597,12024522057225460644,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3300,i,8337375177460947419,1716311548198441182,524288 --field-trial-handle=1764,i,16752454816425400597,12024522057225460644,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=5668,i,4341468952183844286,2581823214097001574,2097152 --field-trial-handle=1764,i,16752454816425400597,12024522057225460644,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5408,i,14189382367596005918,7626271926885436070,524288 --field-trial-handle=1764,i,16752454816425400597,12024522057225460644,262144 --variations-seed-version --mojo-platform-channel-handle=256 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5424,i,2690135574246825751,7833742681739024129,524288 --field-trial-handle=1764,i,16752454816425400597,12024522057225460644,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5384,i,6764283107206570111,9980529185363427455,524288 --field-trial-handle=1764,i,16752454816425400597,12024522057225460644,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=256,i,15449943932955125589,17848618345720219240,2097152 --field-trial-handle=1764,i,16752454816425400597,12024522057225460644,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4512,i,9440084185749678467,4998601168309244283,524288 --field-trial-handle=1764,i,16752454816425400597,12024522057225460644,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=6184,i,4429564366006448549,2734627710599455162,2097152 --field-trial-handle=1764,i,16752454816425400597,12024522057225460644,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=5380,i,2381892855552130066,11579342721726962979,2097152 --field-trial-handle=1764,i,16752454816425400597,12024522057225460644,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=3536,i,14572538086058579016,10470003953404027058,2097152 --field-trial-handle=1764,i,16752454816425400597,12024522057225460644,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=5488,i,17801393162154278649,9791639116312986763,2097152 --field-trial-handle=1764,i,16752454816425400597,12024522057225460644,262144 --variations-seed-version --mojo-platform-channel-handle=3300 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6840,i,15457450731265731021,10724545846399994114,524288 --field-trial-handle=1764,i,16752454816425400597,12024522057225460644,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=5380,i,5362843603932174644,14884008856522162265,2097152 --field-trial-handle=1764,i,16752454816425400597,12024522057225460644,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6036,i,7750167227778876555,7429004410013634026,262144 --field-trial-handle=1764,i,16752454816425400597,12024522057225460644,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4620,i,4567701535533377204,1180920392031408501,524288 --field-trial-handle=1764,i,16752454816425400597,12024522057225460644,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=6920,i,8559726085098538255,12611773080455653155,2097152 --field-trial-handle=1764,i,16752454816425400597,12024522057225460644,262144 --variations-seed-version --mojo-platform-channel-handle=6892 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=6916,i,14277481758125563004,6261057050935846545,2097152 --field-trial-handle=1764,i,16752454816425400597,12024522057225460644,262144 --variations-seed-version --mojo-platform-channel-handle=7060 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=6092,i,13351612962115639367,884736528529062316,2097152 --field-trial-handle=1764,i,16752454816425400597,12024522057225460644,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=5472,i,18269758289476802494,12256371428849078617,2097152 --field-trial-handle=1764,i,16752454816425400597,12024522057225460644,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=6904,i,6821389229042085612,7297127285154319627,2097152 --field-trial-handle=1764,i,16752454816425400597,12024522057225460644,262144 --variations-seed-version --mojo-platform-channel-handle=6912 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7136,i,16293500639816482943,7659850198132745090,524288 --field-trial-handle=1764,i,16752454816425400597,12024522057225460644,262144 --variations-seed-version --mojo-platform-channel-handle=6908 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6964,i,11440019816368628027,10952124495808517511,524288 --field-trial-handle=1764,i,16752454816425400597,12024522057225460644,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=7164,i,11712641211203201754,14712462141291651423,524288 --field-trial-handle=1764,i,16752454816425400597,12024522057225460644,262144 --variations-seed-version --mojo-platform-channel-handle=6952 /prefetch:122⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --metrics-shmem-handle=4516,i,13373992267676114576,1600935963062755383,2097152 --field-trial-handle=1764,i,16752454816425400597,12024522057225460644,262144 --variations-seed-version --mojo-platform-channel-handle=7124 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --metrics-shmem-handle=5964,i,1648880296207791174,8823357959371120761,2097152 --field-trial-handle=1764,i,16752454816425400597,12024522057225460644,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --metrics-shmem-handle=6408,i,2022452219024592283,10147534605104134315,2097152 --field-trial-handle=1764,i,16752454816425400597,12024522057225460644,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --metrics-shmem-handle=6096,i,1918997517807222170,16715230372297444971,2097152 --field-trial-handle=1764,i,16752454816425400597,12024522057225460644,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --metrics-shmem-handle=3536,i,12032544540131123841,1052808769844670971,2097152 --field-trial-handle=1764,i,16752454816425400597,12024522057225460644,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --metrics-shmem-handle=6256,i,3389496729814069800,18205691596250390002,2097152 --field-trial-handle=1764,i,16752454816425400597,12024522057225460644,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --metrics-shmem-handle=7132,i,18333328016286738742,13714837559640565243,2097152 --field-trial-handle=1764,i,16752454816425400597,12024522057225460644,262144 --variations-seed-version --mojo-platform-channel-handle=7024 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --metrics-shmem-handle=5584,i,3171554961330951060,6896912484108251332,2097152 --field-trial-handle=1764,i,16752454816425400597,12024522057225460644,262144 --variations-seed-version --mojo-platform-channel-handle=6916 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --metrics-shmem-handle=3620,i,17367894138595829573,6917247820624585844,2097152 --field-trial-handle=1764,i,16752454816425400597,12024522057225460644,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --metrics-shmem-handle=6328,i,7126488862043767070,10816752375272482039,2097152 --field-trial-handle=1764,i,16752454816425400597,12024522057225460644,262144 --variations-seed-version --mojo-platform-channel-handle=7320 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5912,i,250882798816626040,17634453396959651100,524288 --field-trial-handle=1764,i,16752454816425400597,12024522057225460644,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --metrics-shmem-handle=6812,i,13509131583102788566,15031854436847338056,2097152 --field-trial-handle=1764,i,16752454816425400597,12024522057225460644,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:12⤵
-
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\DvnX.zip"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --metrics-shmem-handle=5616,i,13886315546482183013,4436577812784468910,2097152 --field-trial-handle=1764,i,16752454816425400597,12024522057225460644,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --metrics-shmem-handle=7440,i,4291867808164467315,5430317827571194047,2097152 --field-trial-handle=1764,i,16752454816425400597,12024522057225460644,262144 --variations-seed-version --mojo-platform-channel-handle=7520 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --metrics-shmem-handle=7284,i,3946615367852326576,2986171189725162315,2097152 --field-trial-handle=1764,i,16752454816425400597,12024522057225460644,262144 --variations-seed-version --mojo-platform-channel-handle=6912 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3704,i,8232204691226065926,1956801198354386527,524288 --field-trial-handle=1764,i,16752454816425400597,12024522057225460644,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:142⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7708,i,11177956431461216926,9539491070981046920,524288 --field-trial-handle=1764,i,16752454816425400597,12024522057225460644,262144 --variations-seed-version --mojo-platform-channel-handle=7400 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --metrics-shmem-handle=7336,i,11418200682928013872,14870599008449288968,2097152 --field-trial-handle=1764,i,16752454816425400597,12024522057225460644,262144 --variations-seed-version --mojo-platform-channel-handle=7272 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --metrics-shmem-handle=7416,i,16772805312355467246,14868481790906864754,2097152 --field-trial-handle=1764,i,16752454816425400597,12024522057225460644,262144 --variations-seed-version --mojo-platform-channel-handle=7404 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --metrics-shmem-handle=6664,i,10099692301489012551,7770209417575010564,2097152 --field-trial-handle=1764,i,16752454816425400597,12024522057225460644,262144 --variations-seed-version --mojo-platform-channel-handle=7632 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --metrics-shmem-handle=7248,i,10136358840865702526,2706704382319914095,2097152 --field-trial-handle=1764,i,16752454816425400597,12024522057225460644,262144 --variations-seed-version --mojo-platform-channel-handle=7264 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5772,i,12628901069956339028,1657816086662011791,524288 --field-trial-handle=1764,i,16752454816425400597,12024522057225460644,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:142⤵
-
-
C:\Users\Admin\Downloads\uninstalltool_setup.exe"C:\Users\Admin\Downloads\uninstalltool_setup.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-8Z1R6XOJ30.tmp\uninstalltool_setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-8Z1R6XOJ30.tmp\uninstalltool_setup.tmp" /SL5="$C0352,5462460,895488,C:\Users\Admin\Downloads\uninstalltool_setup.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\Uninstall Tool\UTShellExt.dll"4⤵
- Loads dropped DLL
- Modifies system executable filetype association
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\Uninstall Tool\UTShellExt_x86.dll"4⤵
- Loads dropped DLL
- Modifies system executable filetype association
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Program Files\Uninstall Tool\PinToTaskbar.exe"C:\Program Files\Uninstall Tool\PinToTaskbar.exe" /pin UninstallTool.exe4⤵
- Executes dropped EXE
-
-
C:\Program Files\Uninstall Tool\UninstallTool.exe"C:\Program Files\Uninstall Tool\UninstallTool.exe" /install_service_silent4⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Uninstall Tool\UninstallTool.exe"C:\Program Files\Uninstall Tool\UninstallTool.exe" /init4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Uninstall Tool\UninstallTool.exe"C:\Program Files\Uninstall Tool\UninstallTool.exe" /add_control_panel_icon4⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Uninstall Tool\UninstallTool.exe"C:\Program Files\Uninstall Tool\UninstallTool.exe" /skip_uac4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Uninstall Tool\UninstallTool.exe"C:\Program Files\Uninstall Tool\UninstallTool.exe" /msix_register4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "try { Add-AppxPackage -Path 'C:\Program Files\Uninstall Tool\UTShellExt2.msix' -ExternalLocation 'C:\Program Files\Uninstall Tool\' -ErrorAction Stop; Write-Host 'MSIX install OK'; exit 0 } catch { Write-Host 'MSIX install FAILED'; $_ | Out-File -FilePath 'C:\Program Files\Uninstall Tool\UTShellExt2_install_error.log' -Encoding utf8; exit 1 }"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Program Files\Uninstall Tool\UninstallTool.exe"C:\Program Files\Uninstall Tool\UninstallTool.exe"4⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Uninstall Tool\UninstallToolHelper.exe"C:\Program Files\Uninstall Tool\UninstallToolHelper.exe" /pid:65045⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Loads dropped DLL
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\7z2605-x64.exe"C:\Users\Admin\Downloads\7z2605-x64.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
-
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /43⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\uninstalltool_portable.zip"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
-
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\uninstalltool_portable.zip"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
-
-
C:\Users\Admin\Downloads\New folder\UninstallToolPortable.exe"C:\Users\Admin\Downloads\New folder\UninstallToolPortable.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\Downloads\New folder\UninstallTool_x64.dat"C:\Users\Admin\Downloads\New folder\UninstallTool_x64.dat"4⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Modifies Control Panel
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\New folder\UninstallToolHelper.exe"C:\Users\Admin\Downloads\New folder\UninstallToolHelper.exe" /pid:34405⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
-
C:\Windows\System32\SLUI.exe"C:\Windows\System32\SLUI.exe" RuleId=379cccfb-d4e0-48fe-b0f2-0136097be147;Action=CleanupState;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=6c4de1b8-24bb-4c17-9a77-7b939414c298;Trigger=TimerEvent1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Defense Evasion
Modify Registry
4Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
7z.dll
7z.exe
7zFM.exe
7zG.exe
Uninstall.exe
PinToTaskbar.exe
is-0X24GUK7XX.tmp
Arabic.xml
Armenian.xml
Azerbaijani.xml
Belarusian.xml
Bulgarian.xml
Chinese_Simplified.xml
Chinese_Traditional.xml
Croatian.xml
Czech.xml
Danish.xml
Dutch.xml
English.xml
Estonian.xml
French.xml
Georgian.xml
German.xml
Greek.xml
Hebrew.xml
Hindi.xml
Hungarian.xml
Indonesian.xml
Italian.xml
Japanese.xml
Korean.xml
Latvian.xml
Lithuanian.xml
Norwegian.xml
Persian.xml
Polish.xml
Portuguese.xml
Portuguese_Brazilian.xml
Romanian.xml
Russian.xml
Serbian_Cyrillic.xml
Serbian_Latin.xml
Slovak.xml
Slovenian.xml
Spanish.xml
Swedish.xml
Turkish.xml
Ukrainian.xml
Vietnamese.xml
7-Zip File Manager.lnk
7-Zip Help.lnk
1a3fc73d-996c-4b91-b7be-85d456daf8eb.tmp
218c2372-494e-4ff7-8aec-04061d2ee8b1.tmp
327f9fcf-8ac7-4df8-ae34-11d7327fb3a6.tmp
38385d5d-0d34-408f-88dc-e44224c4cbcd.tmp
393c3a5a-272e-4d3d-940a-15c78798f538.tmp
46984716-61ec-4d00-82fa-61ce5ab395e9.tmp
4c8b233f-4578-4491-b591-e98ea00b2d76.tmp
509786a7-43f2-4109-817b-7a697a2ba963.tmp
54378caa-cbfd-4548-9428-9d5b1285c2d0.tmp
7a8f206d-36fd-4b5b-ab44-67d20b686513.tmp
01e766ab-f64f-4c60-ac45-775f267767a8.tmp
061fd7e8-8285-4f52-8b2d-281d4433b0b6.tmp
118a9874-f4ad-4b8b-92be-cf123f27d0f0.tmp
131043cc-4861-449f-9038-d5ad63684b37.tmp
1a91300a-a927-4f91-a969-a1ee06c82e2a.tmp
27825795-1d8e-48b2-9c3b-68d966988b57.tmp
2c2e0584-b3d4-4d1d-9162-598a1cf4158e.tmp
30a8c004-df0b-4780-a1f8-53aa5dd8c30a.tmp
690f19e2-009a-4db9-a604-3bb7ee7d9e03.tmp
7a4dee37-1d20-4ad7-a363-b7aeed78979f.tmp
87de332c-1a53-469d-9185-cd7bd5f8d96a.tmp
8cec009e-7ed3-46bb-8d7a-cf72c434f8a5.tmp
f_000004
f_000007
f_000008
f_00000a
f_00000b
f_000018
f_00002a
f_00002b
f_00002c
f_00002d
f_00002e
f_00002f
f_000030
f_000031
f_000032
f_000033
f_000034
f_000035
f_00003e
f_000044
f_000045
f_000046
f_000047
f_000048
f_000049
f_00004a
f_00005c
f_00005e
f_00006b
f_000072
f_00008e
f_0000a3
f_0000a5
c1d675da7f35b766_0
temp-index
temp-index
temp-index
temp-index
temp-index
the-real-index
messages.json
craw_background.js
CURRENT
MANIFEST-000001
000003.log
000014.ldb
000015.log
000017.ldb
LOG
LOG
MANIFEST-000001
MANIFEST-000001
0042d0cb-3dc5-421a-8c2e-660ea71b21fe.tmp
2d4ce524-8497-4633-beb3-0653309c916b.tmp
5f7f1b97-5d6d-49c6-b9b3-51bae12fed0d.tmp
8c5f6f27-9604-4ff8-a6f3-7b2c6697a7c8.tmp
Network Persistent State
a9698ff0-715c-4d68-86b1-6d44a9abe92d.tmp
adc559f5-f7c0-442a-a8e1-02b55ef220a2.tmp
dc903a9a-56b1-4347-aa29-f6ddf8d58cf4.tmp
deac7cf2-6edf-499f-b3f8-73947f77db3d.tmp
e67583a1-e8de-47bb-baf5-1f6f97e3bce5.tmp
f3c8a3a5-e05d-4d77-b03b-241d57196e9a.tmp
f4c1021e-4988-4973-8976-808de73ef32b.tmp
ff2ca8aa-a588-4158-8a6d-6c09171acf15.tmp
temp-index
the-real-index
index
temp-index
temp-index
temp-index
the-real-index
index.txt
index.txt.tmp
index.txt.tmp
index.txt.tmp
index.txt.tmp
index.txt.tmp
index.txt.tmp
index.txt.tmp
index.txt.tmp
temp-index
temp-index
469cc8e13bba8344_0
883f0a98df8aed79_0
temp-index
temp-index
the-real-index
data_0
data_1
data_2
data_3
512.png
512.png
512.png
a964cc1e-8800-4e88-9c2c-44f0f8e01948.tmp
0
c4a64a2b-70d5-4ebc-bf23-49b284505689.tmp
d48a26f2-b27e-492d-a6d6-66052658d9a7.tmp
e3be8cb5-ea1c-40d1-a47c-a9763767e0db.tmp
e4274edb-1189-4d1c-9a1f-e8919c96ce0b.tmp
f1946fed-b039-447c-b5ea-05419b88b79c.tmp
b1de2816-0a90-41a9-9a7a-e96d36122d9b.tmp
bcb63a57-fbaa-4379-9e1d-ecc57dbff092.tmp
cb2e43e1-1d47-47f4-8c02-8e5008784862.tmp
iconcache_idx.db
iconcache_idx.db
prep_Activatable Class_Hermes_perf.cache
prep_Activatable Class_Hermes_perf.cache
microsoftwindows.client[1].xml
microsoftwindows.client[1].xml
RemoveService.cmd
UninstallToolHelper.exe
UninstallToolPortable.exe
UninstallTool_x64.dat
UninstallTool_x86.dat
CisUtMonitor.sys
__PSScriptPolicyTest_zlqqfjum.4j1.psm1
b67ea44e-4d2f-49ee-9ced-a0c624dba16f.tmp
messages.json
preferences.xml
preferences.xml
preferences.xml
Uninstall Tool.lnk
default.exc
f01b4d95cf55d32a.automaticDestinations-ms
f01b4d95cf55d32a.automaticDestinations-ms
5d696d521de238c3.customDestinations-ms
98ZB8M6U6KWZ75H3DM4Z.temp
IGNTEJE5EZZG7OSIWS2O.temp
OW32XAHDVN7AR1ERGU7S.temp
8ea888b9-5734-4f61-9eb4-97f1f99ba7e0.tmp
Unconfirmed 302504.crdownload
uninstalltool_portable.zip
uninstalltool_portable.zip.crdownload
memory/1164-2245-0x0000000000400000-0x0000000000474000-memory.dmp
memory/1164-3976-0x0000000000400000-0x0000000000474000-memory.dmp
memory/1164-2274-0x0000000000400000-0x0000000000474000-memory.dmp
memory/4000-4190-0x000001A2FA0B0000-0x000001A2FA2B4000-memory.dmp
memory/4000-4194-0x000001A2F98C0000-0x000001A2F98C6000-memory.dmp
memory/4000-4185-0x000001A2F9830000-0x000001A2F9852000-memory.dmp
memory/4000-4189-0x000001A2F9B90000-0x000001A2F9C42000-memory.dmp
memory/4000-4188-0x000001A2F98C0000-0x000001A2F98DE000-memory.dmp
memory/4000-4196-0x000001A2F9900000-0x000001A2F9908000-memory.dmp
memory/4000-4197-0x000001A2F9940000-0x000001A2F9966000-memory.dmp
memory/4000-4195-0x000001A2F98D0000-0x000001A2F98DA000-memory.dmp
memory/4000-4193-0x000001A2F98B0000-0x000001A2F98B8000-memory.dmp
memory/4000-4192-0x000001A2F9ED0000-0x000001A2F9EFA000-memory.dmp
memory/4000-4191-0x000001A2F98E0000-0x000001A2F98FA000-memory.dmp
memory/4528-0-0x00007FF771830000-0x00007FF774BCE000-memory.dmp
memory/4896-535-0x000001E293F90000-0x000001E294090000-memory.dmp
memory/4896-569-0x000001E294410000-0x000001E294430000-memory.dmp
memory/4896-522-0x000001E2801E0000-0x000001E2802E0000-memory.dmp
memory/4896-554-0x000001E283D90000-0x000001E283DB0000-memory.dmp
memory/4896-1336-0x000001E296ED0000-0x000001E296FD0000-memory.dmp
memory/4896-1888-0x000001E283180000-0x000001E283280000-memory.dmp
memory/4896-534-0x000001E283A30000-0x000001E283A50000-memory.dmp
memory/5240-4221-0x0000000000B00000-0x0000000000BEA000-memory.dmp
memory/5240-3927-0x0000000000B00000-0x0000000000BEA000-memory.dmp
memory/5240-3958-0x0000000000B00000-0x0000000000BEA000-memory.dmp
memory/5240-4223-0x0000000000B00000-0x0000000000BEA000-memory.dmp
memory/6196-4222-0x0000000000400000-0x0000000000474000-memory.dmp
memory/6324-4220-0x0000000000280000-0x00000000006D2000-memory.dmp
memory/6324-3979-0x0000000000280000-0x00000000006D2000-memory.dmp
memory/6324-3959-0x0000000000280000-0x00000000006D2000-memory.dmp
memory/6512-2143-0x0000025D60FE0000-0x0000025D60FE1000-memory.dmp
memory/6512-2144-0x0000025D60FE0000-0x0000025D60FE1000-memory.dmp
memory/6512-2141-0x0000025D60FE0000-0x0000025D60FE1000-memory.dmp
memory/6512-2142-0x0000025D60FE0000-0x0000025D60FE1000-memory.dmp
memory/6512-2146-0x0000025D60FE0000-0x0000025D60FE1000-memory.dmp
memory/6512-2145-0x0000025D60FE0000-0x0000025D60FE1000-memory.dmp
memory/6512-2137-0x0000025D60FE0000-0x0000025D60FE1000-memory.dmp
memory/6512-2135-0x0000025D60FE0000-0x0000025D60FE1000-memory.dmp