Analysis

  • max time kernel
    1799s
  • max time network
    1775s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    14-04-2021 04:58

General

  • Target

    https://keygenit.com/d/bf34293e4810r805s51r.html

  • Sample

    210414-1lem739p8j

Malware Config

Extracted

Family

raccoon

Botnet

a6bfe7e504db71e25642b830fd9b2c4366cf882a

Attributes
  • url4cnc

    https://telete.in/j90dadarobin

rc4.plain
rc4.plain

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Executes dropped EXE 25 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 16 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Drops Chrome extension 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 3 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 7 IoCs
  • Kills process with taskkill 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 13 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Runs ping.exe 1 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 14 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s SENS
    1⤵
      PID:1396
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
      1⤵
        PID:1872
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" https://keygenit.com/d/bf34293e4810r805s51r.html
        1⤵
        • Enumerates system info in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:740
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xd0,0xd4,0xd8,0xac,0xdc,0x7ffd26ee4f50,0x7ffd26ee4f60,0x7ffd26ee4f70
          2⤵
            PID:1236
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1644,1346076561774072189,12518210113193540452,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1656 /prefetch:2
            2⤵
              PID:3356
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1644,1346076561774072189,12518210113193540452,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1716 /prefetch:8
              2⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:1728
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1644,1346076561774072189,12518210113193540452,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2252 /prefetch:8
              2⤵
                PID:2956
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,1346076561774072189,12518210113193540452,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2828 /prefetch:1
                2⤵
                  PID:3140
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,1346076561774072189,12518210113193540452,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2836 /prefetch:1
                  2⤵
                    PID:3488
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,1346076561774072189,12518210113193540452,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
                    2⤵
                      PID:2840
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,1346076561774072189,12518210113193540452,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
                      2⤵
                        PID:1424
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,1346076561774072189,12518210113193540452,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3500 /prefetch:1
                        2⤵
                          PID:1184
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,1346076561774072189,12518210113193540452,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3532 /prefetch:1
                          2⤵
                            PID:4048
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,1346076561774072189,12518210113193540452,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4772 /prefetch:8
                            2⤵
                              PID:4280
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1644,1346076561774072189,12518210113193540452,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5204 /prefetch:8
                              2⤵
                                PID:4532
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1644,1346076561774072189,12518210113193540452,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5240 /prefetch:8
                                2⤵
                                  PID:4584
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1644,1346076561774072189,12518210113193540452,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3512 /prefetch:8
                                  2⤵
                                    PID:4636
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1644,1346076561774072189,12518210113193540452,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5480 /prefetch:8
                                    2⤵
                                      PID:4672
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1644,1346076561774072189,12518210113193540452,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5584 /prefetch:8
                                      2⤵
                                        PID:4708
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1644,1346076561774072189,12518210113193540452,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3512 /prefetch:8
                                        2⤵
                                          PID:4720
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1644,1346076561774072189,12518210113193540452,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5320 /prefetch:8
                                          2⤵
                                            PID:4780
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1644,1346076561774072189,12518210113193540452,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5728 /prefetch:8
                                            2⤵
                                              PID:4816
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1644,1346076561774072189,12518210113193540452,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3520 /prefetch:8
                                              2⤵
                                                PID:4852
                                              • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe
                                                "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --channel --force-configure-user-settings
                                                2⤵
                                                  PID:4888
                                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe
                                                    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff6eed0a890,0x7ff6eed0a8a0,0x7ff6eed0a8b0
                                                    3⤵
                                                      PID:4920
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,1346076561774072189,12518210113193540452,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5504 /prefetch:8
                                                    2⤵
                                                      PID:4972
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,1346076561774072189,12518210113193540452,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5572 /prefetch:8
                                                      2⤵
                                                        PID:4984
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,1346076561774072189,12518210113193540452,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5944 /prefetch:8
                                                        2⤵
                                                          PID:5032
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,1346076561774072189,12518210113193540452,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5956 /prefetch:8
                                                          2⤵
                                                            PID:5092
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,1346076561774072189,12518210113193540452,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5552 /prefetch:8
                                                            2⤵
                                                              PID:4996
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1644,1346076561774072189,12518210113193540452,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5248 /prefetch:8
                                                              2⤵
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:4184
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1644,1346076561774072189,12518210113193540452,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5264 /prefetch:8
                                                              2⤵
                                                                PID:4248
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1644,1346076561774072189,12518210113193540452,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5488 /prefetch:8
                                                                2⤵
                                                                  PID:4332
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1644,1346076561774072189,12518210113193540452,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5492 /prefetch:8
                                                                  2⤵
                                                                    PID:4480
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1644,1346076561774072189,12518210113193540452,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6320 /prefetch:8
                                                                    2⤵
                                                                      PID:4540
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,1346076561774072189,12518210113193540452,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6756 /prefetch:8
                                                                      2⤵
                                                                        PID:4600
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1644,1346076561774072189,12518210113193540452,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6464 /prefetch:8
                                                                        2⤵
                                                                          PID:2276
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,1346076561774072189,12518210113193540452,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7488 /prefetch:8
                                                                          2⤵
                                                                            PID:4616
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,1346076561774072189,12518210113193540452,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7508 /prefetch:8
                                                                            2⤵
                                                                              PID:4620
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,1346076561774072189,12518210113193540452,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7520 /prefetch:8
                                                                              2⤵
                                                                                PID:4648
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,1346076561774072189,12518210113193540452,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7528 /prefetch:8
                                                                                2⤵
                                                                                  PID:4696
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,1346076561774072189,12518210113193540452,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7536 /prefetch:8
                                                                                  2⤵
                                                                                    PID:4756
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,1346076561774072189,12518210113193540452,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6548 /prefetch:8
                                                                                    2⤵
                                                                                      PID:4792
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,1346076561774072189,12518210113193540452,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7180 /prefetch:8
                                                                                      2⤵
                                                                                        PID:4844
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1644,1346076561774072189,12518210113193540452,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7304 /prefetch:8
                                                                                        2⤵
                                                                                          PID:4800
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1644,1346076561774072189,12518210113193540452,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6700 /prefetch:8
                                                                                          2⤵
                                                                                            PID:4928
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,1346076561774072189,12518210113193540452,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6876 /prefetch:8
                                                                                            2⤵
                                                                                              PID:4968
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1644,1346076561774072189,12518210113193540452,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7016 /prefetch:8
                                                                                              2⤵
                                                                                                PID:4992
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1644,1346076561774072189,12518210113193540452,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8196 /prefetch:8
                                                                                                2⤵
                                                                                                  PID:5100
                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1644,1346076561774072189,12518210113193540452,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6712 /prefetch:8
                                                                                                  2⤵
                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                  PID:4320
                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,1346076561774072189,12518210113193540452,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5852 /prefetch:8
                                                                                                  2⤵
                                                                                                    PID:3752
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,1346076561774072189,12518210113193540452,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6208 /prefetch:8
                                                                                                    2⤵
                                                                                                      PID:4544
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,1346076561774072189,12518210113193540452,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6824 /prefetch:8
                                                                                                      2⤵
                                                                                                        PID:4604
                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,1346076561774072189,12518210113193540452,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6836 /prefetch:8
                                                                                                        2⤵
                                                                                                          PID:4916
                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,1346076561774072189,12518210113193540452,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7932 /prefetch:1
                                                                                                          2⤵
                                                                                                            PID:4640
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,1346076561774072189,12518210113193540452,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7836 /prefetch:1
                                                                                                            2⤵
                                                                                                              PID:5068
                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1644,1346076561774072189,12518210113193540452,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7808 /prefetch:8
                                                                                                              2⤵
                                                                                                                PID:5048
                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,1346076561774072189,12518210113193540452,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:1
                                                                                                                2⤵
                                                                                                                  PID:2240
                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1644,1346076561774072189,12518210113193540452,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3472 /prefetch:8
                                                                                                                  2⤵
                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                  PID:4956
                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1644,1346076561774072189,12518210113193540452,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7012 /prefetch:8
                                                                                                                  2⤵
                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                  PID:3740
                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1644,1346076561774072189,12518210113193540452,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4120 /prefetch:8
                                                                                                                  2⤵
                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                  PID:4508
                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1644,1346076561774072189,12518210113193540452,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3484 /prefetch:8
                                                                                                                  2⤵
                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                  PID:4832
                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,1346076561774072189,12518210113193540452,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=168 /prefetch:8
                                                                                                                  2⤵
                                                                                                                    PID:4872
                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1644,1346076561774072189,12518210113193540452,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7948 /prefetch:8
                                                                                                                    2⤵
                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                    PID:4652
                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1644,1346076561774072189,12518210113193540452,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2164 /prefetch:8
                                                                                                                    2⤵
                                                                                                                      PID:4144
                                                                                                                  • c:\windows\system32\svchost.exe
                                                                                                                    c:\windows\system32\svchost.exe -k netsvcs -s WpnService
                                                                                                                    1⤵
                                                                                                                      PID:2804
                                                                                                                    • c:\windows\system32\svchost.exe
                                                                                                                      c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
                                                                                                                      1⤵
                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                      PID:2788
                                                                                                                    • c:\windows\system32\svchost.exe
                                                                                                                      c:\windows\system32\svchost.exe -k netsvcs -s Browser
                                                                                                                      1⤵
                                                                                                                        PID:2712
                                                                                                                      • c:\windows\system32\svchost.exe
                                                                                                                        c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
                                                                                                                        1⤵
                                                                                                                          PID:2588
                                                                                                                        • c:\windows\system32\svchost.exe
                                                                                                                          c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
                                                                                                                          1⤵
                                                                                                                            PID:2536
                                                                                                                          • c:\windows\system32\svchost.exe
                                                                                                                            c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                                                                                                                            1⤵
                                                                                                                              PID:1264
                                                                                                                            • c:\windows\system32\svchost.exe
                                                                                                                              c:\windows\system32\svchost.exe -k netsvcs -s Themes
                                                                                                                              1⤵
                                                                                                                                PID:1196
                                                                                                                              • c:\windows\system32\svchost.exe
                                                                                                                                c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                                                                                                                                1⤵
                                                                                                                                  PID:1076
                                                                                                                                • c:\windows\system32\svchost.exe
                                                                                                                                  c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                                                                                                                                  1⤵
                                                                                                                                    PID:408
                                                                                                                                  • c:\windows\system32\svchost.exe
                                                                                                                                    c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                                                                                                                                    1⤵
                                                                                                                                      PID:68
                                                                                                                                    • \??\c:\windows\system32\svchost.exe
                                                                                                                                      c:\windows\system32\svchost.exe -k netsvcs -s BITS
                                                                                                                                      1⤵
                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                      PID:392
                                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                                        C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                        2⤵
                                                                                                                                        • Drops file in System32 directory
                                                                                                                                        • Checks processor information in registry
                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                        • Modifies registry class
                                                                                                                                        PID:5052
                                                                                                                                    • C:\Windows\System32\rundll32.exe
                                                                                                                                      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                                                      1⤵
                                                                                                                                        PID:4932
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Temp2_Rife_Generator_3_keygen_by_F4CG.zip\Rife_Generator_3_keygen_by_F4CG.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Temp2_Rife_Generator_3_keygen_by_F4CG.zip\Rife_Generator_3_keygen_by_F4CG.exe"
                                                                                                                                        1⤵
                                                                                                                                          PID:2300
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "
                                                                                                                                            2⤵
                                                                                                                                              PID:4228
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
                                                                                                                                                keygen-pr.exe -p83fsase3Ge
                                                                                                                                                3⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:4384
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"
                                                                                                                                                  4⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                  PID:4300
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.dat
                                                                                                                                                    5⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    PID:2164
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
                                                                                                                                                keygen-step-1.exe
                                                                                                                                                3⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:1424
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exe
                                                                                                                                                keygen-step-2.exe
                                                                                                                                                3⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Modifies system certificate store
                                                                                                                                                PID:684
                                                                                                                                                • C:\Users\Admin\AppData\Roaming\808B.tmp.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\808B.tmp.exe"
                                                                                                                                                  4⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:4480
                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 804
                                                                                                                                                    5⤵
                                                                                                                                                    • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                    • Program crash
                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                    PID:5788
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exe" >> NUL
                                                                                                                                                  4⤵
                                                                                                                                                    PID:1088
                                                                                                                                                    • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                      ping 127.0.0.1
                                                                                                                                                      5⤵
                                                                                                                                                      • Runs ping.exe
                                                                                                                                                      PID:424
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe
                                                                                                                                                  keygen-step-3.exe
                                                                                                                                                  3⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:4116
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"
                                                                                                                                                    4⤵
                                                                                                                                                      PID:2276
                                                                                                                                                      • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                        ping 1.1.1.1 -n 1 -w 3000
                                                                                                                                                        5⤵
                                                                                                                                                        • Runs ping.exe
                                                                                                                                                        PID:1656
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe
                                                                                                                                                    keygen-step-4.exe
                                                                                                                                                    3⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Checks computer location settings
                                                                                                                                                    PID:4140
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"
                                                                                                                                                      4⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                      PID:4304
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\IJEU805655\setups.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\IJEU805655\setups.exe" ll
                                                                                                                                                        5⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        PID:5096
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-9JIHA.tmp\setups.tmp
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\is-9JIHA.tmp\setups.tmp" /SL5="$402C4,726852,244736,C:\Users\Admin\AppData\Local\Temp\IJEU805655\setups.exe" ll
                                                                                                                                                          6⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Checks computer location settings
                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                          PID:5088
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\RarSFX2\Full Version.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\RarSFX2\Full Version.exe"
                                                                                                                                                      4⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                      PID:4848
                                                                                                                                                      • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                        "C:\Windows\System32\WScript.exe" "C:\Program Files\unins0000.vbs"
                                                                                                                                                        5⤵
                                                                                                                                                          PID:4168
                                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                            "C:\Windows\System32\rundll32.exe" "C:\Program Files\unins0000.dll",install
                                                                                                                                                            6⤵
                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                            • Modifies registry class
                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                            PID:2860
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe"
                                                                                                                                                        4⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Drops Chrome extension
                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                        PID:4576
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          cmd.exe /c taskkill /f /im chrome.exe
                                                                                                                                                          5⤵
                                                                                                                                                            PID:4992
                                                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                              taskkill /f /im chrome.exe
                                                                                                                                                              6⤵
                                                                                                                                                              • Kills process with taskkill
                                                                                                                                                              PID:5152
                                                                                                                                                          • C:\Windows\SysWOW64\xcopy.exe
                                                                                                                                                            xcopy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data" "C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\" /s /e /y
                                                                                                                                                            5⤵
                                                                                                                                                            • Enumerates system info in registry
                                                                                                                                                            PID:5496
                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --window-position=-50000,-50000 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" https://www.facebook.com/ https://www.facebook.com/pages/ https://secure.facebook.com/ads/manager/account_settings/account_billing/
                                                                                                                                                            5⤵
                                                                                                                                                            • Enumerates system info in registry
                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                                                                            PID:5640
                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xd4,0xd8,0xdc,0xb0,0xe0,0x7ffd14644f50,0x7ffd14644f60,0x7ffd14644f70
                                                                                                                                                              6⤵
                                                                                                                                                                PID:5660
                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1620,13834797273966465816,12539874550381369634,131072 --lang=en-US --service-sandbox-type=network --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=1680 /prefetch:8
                                                                                                                                                                6⤵
                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                PID:5828
                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1620,13834797273966465816,12539874550381369634,131072 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1632 /prefetch:2
                                                                                                                                                                6⤵
                                                                                                                                                                  PID:5820
                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1620,13834797273966465816,12539874550381369634,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=2304 /prefetch:8
                                                                                                                                                                  6⤵
                                                                                                                                                                    PID:5880
                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,13834797273966465816,12539874550381369634,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2856 /prefetch:1
                                                                                                                                                                    6⤵
                                                                                                                                                                      PID:5992
                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,13834797273966465816,12539874550381369634,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2824 /prefetch:1
                                                                                                                                                                      6⤵
                                                                                                                                                                        PID:5984
                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,13834797273966465816,12539874550381369634,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
                                                                                                                                                                        6⤵
                                                                                                                                                                          PID:6076
                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,13834797273966465816,12539874550381369634,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
                                                                                                                                                                          6⤵
                                                                                                                                                                            PID:6092
                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,13834797273966465816,12539874550381369634,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3672 /prefetch:1
                                                                                                                                                                            6⤵
                                                                                                                                                                              PID:3244
                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,13834797273966465816,12539874550381369634,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3920 /prefetch:1
                                                                                                                                                                              6⤵
                                                                                                                                                                                PID:5156
                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,13834797273966465816,12539874550381369634,131072 --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=5800 /prefetch:8
                                                                                                                                                                                6⤵
                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                PID:5512
                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,13834797273966465816,12539874550381369634,131072 --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=5652 /prefetch:8
                                                                                                                                                                                6⤵
                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                PID:4056
                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,13834797273966465816,12539874550381369634,131072 --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=5660 /prefetch:8
                                                                                                                                                                                6⤵
                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                PID:3856
                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,13834797273966465816,12539874550381369634,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=4304 /prefetch:8
                                                                                                                                                                                6⤵
                                                                                                                                                                                  PID:4420
                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,13834797273966465816,12539874550381369634,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=2132 /prefetch:8
                                                                                                                                                                                  6⤵
                                                                                                                                                                                    PID:4152
                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,13834797273966465816,12539874550381369634,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=4324 /prefetch:8
                                                                                                                                                                                    6⤵
                                                                                                                                                                                      PID:3200
                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,13834797273966465816,12539874550381369634,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=1704 /prefetch:8
                                                                                                                                                                                      6⤵
                                                                                                                                                                                        PID:4360
                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1620,13834797273966465816,12539874550381369634,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6028 /prefetch:2
                                                                                                                                                                                        6⤵
                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                        PID:5008
                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,13834797273966465816,12539874550381369634,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=6128 /prefetch:8
                                                                                                                                                                                        6⤵
                                                                                                                                                                                          PID:3176
                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,13834797273966465816,12539874550381369634,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=4084 /prefetch:8
                                                                                                                                                                                          6⤵
                                                                                                                                                                                            PID:4008
                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,13834797273966465816,12539874550381369634,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=1564 /prefetch:8
                                                                                                                                                                                            6⤵
                                                                                                                                                                                              PID:4244
                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,13834797273966465816,12539874550381369634,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=6124 /prefetch:8
                                                                                                                                                                                              6⤵
                                                                                                                                                                                                PID:4392
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\SwReporter\89.258.200\software_reporter_tool.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\SwReporter\89.258.200\software_reporter_tool.exe" --engine=2 --scan-locations=1,2,3,4,5,6,7,8,10 --disabled-locations=9,11 --session-id=kCYCG6s8rRU6PoDFiCeXISKxQ03S111cvtODFcBT --registry-suffix=ESET --srt-field-trial-group-name=NewCleanerUIExperiment
                                                                                                                                                                                                6⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                PID:5104
                                                                                                                                                                                                • \??\c:\users\admin\appdata\local\temp\cghjgasaaz99\swreporter\89.258.200\software_reporter_tool.exe
                                                                                                                                                                                                  c:\users\admin\appdata\local\temp\cghjgasaaz99\swreporter\89.258.200\software_reporter_tool.exe --crash-handler "--database=c:\users\admin\appdata\local\Google\Software Reporter Tool" --url=https://clients2.google.com/cr/report --annotation=plat=Win32 --annotation=prod=ChromeFoil --annotation=ver=89.258.200 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff75e4eac28,0x7ff75e4eac38,0x7ff75e4eac48
                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  PID:4048
                                                                                                                                                                                                • \??\c:\users\admin\appdata\local\temp\cghjgasaaz99\swreporter\89.258.200\software_reporter_tool.exe
                                                                                                                                                                                                  "c:\users\admin\appdata\local\temp\cghjgasaaz99\swreporter\89.258.200\software_reporter_tool.exe" --use-crash-handler-with-id="\\.\pipe\crashpad_5104_IZQFVONFZLKRYLNC" --sandboxed-process-id=2 --init-done-notifier=704 --sandbox-mojo-pipe-token=5295874450779475269 --mojo-platform-channel-handle=680 --engine=2
                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                                  PID:5188
                                                                                                                                                                                                • \??\c:\users\admin\appdata\local\temp\cghjgasaaz99\swreporter\89.258.200\software_reporter_tool.exe
                                                                                                                                                                                                  "c:\users\admin\appdata\local\temp\cghjgasaaz99\swreporter\89.258.200\software_reporter_tool.exe" --use-crash-handler-with-id="\\.\pipe\crashpad_5104_IZQFVONFZLKRYLNC" --sandboxed-process-id=3 --init-done-notifier=912 --sandbox-mojo-pipe-token=16250432824137122512 --mojo-platform-channel-handle=908
                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  PID:4456
                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,13834797273966465816,12539874550381369634,131072 --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=1844 /prefetch:8
                                                                                                                                                                                                6⤵
                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                PID:4280
                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,13834797273966465816,12539874550381369634,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=728 /prefetch:8
                                                                                                                                                                                                6⤵
                                                                                                                                                                                                  PID:3684
                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,13834797273966465816,12539874550381369634,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=4812 /prefetch:8
                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                    PID:4576
                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,13834797273966465816,12539874550381369634,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=732 /prefetch:8
                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                      PID:5276
                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,13834797273966465816,12539874550381369634,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=6028 /prefetch:8
                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                        PID:5008
                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,13834797273966465816,12539874550381369634,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=736 /prefetch:8
                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                          PID:384
                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,13834797273966465816,12539874550381369634,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=5636 /prefetch:8
                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                            PID:4708
                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,13834797273966465816,12539874550381369634,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=2348 /prefetch:8
                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                              PID:4292
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"
                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          PID:5188
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe" >> NUL
                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                              PID:2208
                                                                                                                                                                                                              • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                                                                                ping 127.0.0.1
                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                • Runs ping.exe
                                                                                                                                                                                                                PID:2304
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX2\md2_2efs.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\RarSFX2\md2_2efs.exe"
                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Checks whether UAC is enabled
                                                                                                                                                                                                            PID:1756
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX2\BTRSetp.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\RarSFX2\BTRSetp.exe"
                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            PID:1652
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX2\gcttt.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\RarSFX2\gcttt.exe"
                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                            PID:5424
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              PID:4472
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                              PID:2988
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              PID:200
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              PID:4768
                                                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                      • Modifies Internet Explorer settings
                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                      PID:3936
                                                                                                                                                                                                    • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                      C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                      • Modifies Internet Explorer settings
                                                                                                                                                                                                      PID:2372
                                                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                      • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                      PID:1416
                                                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                      • Modifies Internet Explorer settings
                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                      PID:5200
                                                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                      PID:4212
                                                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                      PID:5548
                                                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                      PID:1964
                                                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                        PID:5344
                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                        PID:4388
                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                        PID:4788
                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                        PID:4556
                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                        PID:1488

                                                                                                                                                                                                      Network

                                                                                                                                                                                                      MITRE ATT&CK Matrix ATT&CK v6

                                                                                                                                                                                                      Persistence

                                                                                                                                                                                                      Registry Run Keys / Startup Folder

                                                                                                                                                                                                      1
                                                                                                                                                                                                      T1060

                                                                                                                                                                                                      Defense Evasion

                                                                                                                                                                                                      Modify Registry

                                                                                                                                                                                                      3
                                                                                                                                                                                                      T1112

                                                                                                                                                                                                      Install Root Certificate

                                                                                                                                                                                                      1
                                                                                                                                                                                                      T1130

                                                                                                                                                                                                      Credential Access

                                                                                                                                                                                                      Credentials in Files

                                                                                                                                                                                                      3
                                                                                                                                                                                                      T1081

                                                                                                                                                                                                      Discovery

                                                                                                                                                                                                      Query Registry

                                                                                                                                                                                                      4
                                                                                                                                                                                                      T1012

                                                                                                                                                                                                      System Information Discovery

                                                                                                                                                                                                      5
                                                                                                                                                                                                      T1082

                                                                                                                                                                                                      Remote System Discovery

                                                                                                                                                                                                      1
                                                                                                                                                                                                      T1018

                                                                                                                                                                                                      Collection

                                                                                                                                                                                                      Data from Local System

                                                                                                                                                                                                      3
                                                                                                                                                                                                      T1005

                                                                                                                                                                                                      Command and Control

                                                                                                                                                                                                      Web Service

                                                                                                                                                                                                      1
                                                                                                                                                                                                      T1102

                                                                                                                                                                                                      Replay Monitor

                                                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                                                      Downloads

                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
                                                                                                                                                                                                        MD5

                                                                                                                                                                                                        34275905b4f22e9c6ef1ec956ab88a6d

                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                        53256e1a6848a5c78d6d27a74ac6bb590228b17c

                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                        c6aae705d9cda873489411212aaf501ce7e15ccad2525611a2442eff8173a90e

                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                        50e55549aa95a50943e7b85cf3e3e54552a43183d6f656598db6e3d1e8069fc0402139fd84c2b56e8eb5b21c14d6f47564f144140d4c0151e2042d2d8ec95e39

                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat
                                                                                                                                                                                                        MD5

                                                                                                                                                                                                        a12e7acce9c54e8f477830c938cd5bb7

                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                        482ac6ae9ea9ab1673e1444269bba2ef7a86794c

                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                        b5433a43058d8b81958e13064f7d5485b787d6812513600c27b913dc5c3b3bd0

                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                        5198b9b7f7ab17a0173a5eed18f3b1906ab3fc64da62cfb765ff43539acdcf3a0eafeefe6184f51f1fbebaacdb0bdf422572b4b3ba70de0b116c779f5e1b7174

                                                                                                                                                                                                      • \??\pipe\crashpad_740_CFFCINKVMRCIIADG
                                                                                                                                                                                                        MD5

                                                                                                                                                                                                        d41d8cd98f00b204e9800998ecf8427e

                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                                                                                                                                      • memory/68-260-0x0000017005380000-0x00000170053E7000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        412KB

                                                                                                                                                                                                      • memory/392-254-0x000001DAACAF0000-0x000001DAACB34000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        272KB

                                                                                                                                                                                                      • memory/392-255-0x000001DAACBB0000-0x000001DAACC17000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        412KB

                                                                                                                                                                                                      • memory/408-269-0x0000018F43360000-0x0000018F433C7000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        412KB

                                                                                                                                                                                                      • memory/1076-267-0x0000022814D90000-0x0000022814DF7000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        412KB

                                                                                                                                                                                                      • memory/1184-155-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/1196-275-0x000001FE35360000-0x000001FE353C7000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        412KB

                                                                                                                                                                                                      • memory/1236-116-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/1264-277-0x0000026461080000-0x00000264610E7000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        412KB

                                                                                                                                                                                                      • memory/1396-271-0x000001D711C00000-0x000001D711C67000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        412KB

                                                                                                                                                                                                      • memory/1424-149-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/1652-286-0x000000001C6E0000-0x000000001C6E2000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        8KB

                                                                                                                                                                                                      • memory/1728-122-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/1872-273-0x0000028A62380000-0x0000028A623E7000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        412KB

                                                                                                                                                                                                      • memory/2164-247-0x0000000000400000-0x0000000000983000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        5.5MB

                                                                                                                                                                                                      • memory/2240-234-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/2276-213-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/2536-265-0x0000028630940000-0x00000286309A7000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        412KB

                                                                                                                                                                                                      • memory/2588-263-0x0000020B57E10000-0x0000020B57E77000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        412KB

                                                                                                                                                                                                      • memory/2712-257-0x0000021272F00000-0x0000021272F67000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        412KB

                                                                                                                                                                                                      • memory/2788-279-0x0000017B65840000-0x0000017B658A7000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        412KB

                                                                                                                                                                                                      • memory/2804-281-0x000001BA8A640000-0x000001BA8A6A7000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        412KB

                                                                                                                                                                                                      • memory/2840-146-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/2860-253-0x0000000000C10000-0x0000000000C66000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        344KB

                                                                                                                                                                                                      • memory/2860-252-0x0000000000AB0000-0x0000000000AEA000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        232KB

                                                                                                                                                                                                      • memory/2956-129-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/3140-135-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/3356-123-0x00007FFD2FC50000-0x00007FFD2FC51000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        4KB

                                                                                                                                                                                                      • memory/3356-121-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/3488-138-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/3740-236-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/3752-227-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4048-163-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4144-241-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4184-207-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4228-242-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4248-208-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4280-178-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4300-283-0x0000000000990000-0x0000000000991000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        4KB

                                                                                                                                                                                                      • memory/4300-246-0x0000000002740000-0x00000000028DC000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        1.6MB

                                                                                                                                                                                                      • memory/4300-282-0x00000000028E0000-0x00000000029CF000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        956KB

                                                                                                                                                                                                      • memory/4300-284-0x0000000000980000-0x000000000099B000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        108KB

                                                                                                                                                                                                      • memory/4304-245-0x000000001C880000-0x000000001C882000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        8KB

                                                                                                                                                                                                      • memory/4320-226-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4332-209-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4384-244-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4480-250-0x0000000002670000-0x0000000002701000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        580KB

                                                                                                                                                                                                      • memory/4480-210-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4480-251-0x0000000000400000-0x0000000000A51000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        6.3MB

                                                                                                                                                                                                      • memory/4508-237-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4532-184-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4540-211-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4544-228-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4584-189-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4600-212-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4604-229-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4616-214-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4620-215-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4636-193-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4640-231-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4648-216-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4652-240-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4672-194-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4696-217-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4708-195-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4720-196-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4756-218-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4780-197-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4792-219-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4800-221-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4816-198-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4832-238-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4844-220-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4852-199-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4872-239-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4888-200-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4916-230-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4920-201-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4928-222-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4956-235-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4968-223-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4972-202-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4984-203-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4992-224-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4996-204-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/5032-205-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/5048-233-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/5052-261-0x000001DD97050000-0x000001DD970B7000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        412KB

                                                                                                                                                                                                      • memory/5052-285-0x000001DD98A60000-0x000001DD98B66000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        1.0MB

                                                                                                                                                                                                      • memory/5068-232-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/5088-249-0x00000000001F0000-0x00000000001F1000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        4KB

                                                                                                                                                                                                      • memory/5092-206-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/5096-248-0x0000000000400000-0x0000000000443000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        268KB

                                                                                                                                                                                                      • memory/5100-225-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/5188-295-0x000001BA25C30000-0x000001BA25C70000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        256KB

                                                                                                                                                                                                      • memory/5188-298-0x000001BA25BF0000-0x000001BA25C30000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        256KB

                                                                                                                                                                                                      • memory/5188-290-0x000001BA25BB0000-0x000001BA25BF0000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        256KB

                                                                                                                                                                                                      • memory/5188-291-0x000001BA25BB0000-0x000001BA25BF0000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        256KB

                                                                                                                                                                                                      • memory/5188-292-0x000001BA25BB0000-0x000001BA25BF0000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        256KB

                                                                                                                                                                                                      • memory/5188-293-0x000001BA25BB0000-0x000001BA25BF0000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        256KB

                                                                                                                                                                                                      • memory/5188-294-0x000001BA25BF0000-0x000001BA25C30000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        256KB

                                                                                                                                                                                                      • memory/5188-287-0x000001BA25BB0000-0x000001BA25BF0000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        256KB

                                                                                                                                                                                                      • memory/5188-288-0x000001BA25BB0000-0x000001BA25BF0000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        256KB

                                                                                                                                                                                                      • memory/5188-297-0x000001BA25BB0000-0x000001BA25BF0000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        256KB

                                                                                                                                                                                                      • memory/5188-296-0x000001BA27B60000-0x000001BA27BA0000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        256KB

                                                                                                                                                                                                      • memory/5188-289-0x000001BA25BB0000-0x000001BA25BF0000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        256KB

                                                                                                                                                                                                      • memory/5188-300-0x000001BA25BF0000-0x000001BA25C30000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        256KB

                                                                                                                                                                                                      • memory/5188-299-0x000001BA25BB0000-0x000001BA25BF0000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        256KB

                                                                                                                                                                                                      • memory/5188-301-0x000001BA25BB0000-0x000001BA25BF0000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        256KB

                                                                                                                                                                                                      • memory/5188-303-0x000001BA25BB0000-0x000001BA25BF0000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        256KB

                                                                                                                                                                                                      • memory/5188-302-0x000001BA25BB0000-0x000001BA25BF0000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        256KB

                                                                                                                                                                                                      • memory/5188-304-0x000001BA25BB0000-0x000001BA25BF0000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        256KB

                                                                                                                                                                                                      • memory/5188-305-0x000001BA25BB0000-0x000001BA25BF0000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        256KB

                                                                                                                                                                                                      • memory/5188-306-0x000001BA25BB0000-0x000001BA25BF0000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        256KB

                                                                                                                                                                                                      • memory/5188-307-0x000001BA25BB0000-0x000001BA25BF0000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        256KB