Analysis

  • max time kernel
    1800s
  • max time network
    1782s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    14-04-2021 13:34

General

  • Target

    https://keygenit.com/d/c2d3ae9fd710s1673qp1.html

  • Sample

    210414-4ns1r6e34e

Malware Config

Extracted

Family

raccoon

Botnet

a6bfe7e504db71e25642b830fd9b2c4366cf882a

Attributes
  • url4cnc

    https://telete.in/j90dadarobin

rc4.plain
rc4.plain

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • Executes dropped EXE 25 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 16 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Drops Chrome extension 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 3 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Enumerates system info in registry 2 TTPs 7 IoCs
  • Kills process with taskkill 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 14 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Runs ping.exe 1 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 58 IoCs
  • Suspicious behavior: MapViewOfSection 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 14 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Schedule
    1⤵
      PID:928
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s SENS
      1⤵
        PID:1352
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" https://keygenit.com/d/c2d3ae9fd710s1673qp1.html
        1⤵
        • Enumerates system info in registry
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:4040
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc8,0xcc,0xd0,0xa4,0xd4,0x7fffcec34f50,0x7fffcec34f60,0x7fffcec34f70
          2⤵
            PID:3208
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1372,4154000639900177857,12174933316762196580,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1592 /prefetch:2
            2⤵
              PID:204
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1372,4154000639900177857,12174933316762196580,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1672 /prefetch:8
              2⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:2088
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1372,4154000639900177857,12174933316762196580,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2180 /prefetch:8
              2⤵
                PID:2300
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1372,4154000639900177857,12174933316762196580,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2828 /prefetch:1
                2⤵
                  PID:3848
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1372,4154000639900177857,12174933316762196580,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2848 /prefetch:1
                  2⤵
                    PID:3748
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1372,4154000639900177857,12174933316762196580,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
                    2⤵
                      PID:3824
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1372,4154000639900177857,12174933316762196580,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
                      2⤵
                        PID:2604
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1372,4154000639900177857,12174933316762196580,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3640 /prefetch:1
                        2⤵
                          PID:2496
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1372,4154000639900177857,12174933316762196580,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3668 /prefetch:1
                          2⤵
                            PID:3312
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1372,4154000639900177857,12174933316762196580,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4816 /prefetch:8
                            2⤵
                              PID:4332
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1372,4154000639900177857,12174933316762196580,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4924 /prefetch:8
                              2⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:4676
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1372,4154000639900177857,12174933316762196580,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6124 /prefetch:8
                              2⤵
                                PID:4752
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1372,4154000639900177857,12174933316762196580,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6252 /prefetch:8
                                2⤵
                                  PID:4804
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1372,4154000639900177857,12174933316762196580,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6108 /prefetch:8
                                  2⤵
                                    PID:4856
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1372,4154000639900177857,12174933316762196580,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6556 /prefetch:8
                                    2⤵
                                      PID:4920
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1372,4154000639900177857,12174933316762196580,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6544 /prefetch:8
                                      2⤵
                                        PID:4956
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1372,4154000639900177857,12174933316762196580,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6660 /prefetch:8
                                        2⤵
                                          PID:4968
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1372,4154000639900177857,12174933316762196580,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6844 /prefetch:8
                                          2⤵
                                            PID:5028
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1372,4154000639900177857,12174933316762196580,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6364 /prefetch:8
                                            2⤵
                                              PID:5040
                                            • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe
                                              "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --channel --force-configure-user-settings
                                              2⤵
                                                PID:5076
                                                • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe
                                                  "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff7d447a890,0x7ff7d447a8a0,0x7ff7d447a8b0
                                                  3⤵
                                                    PID:4224
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1372,4154000639900177857,12174933316762196580,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6616 /prefetch:8
                                                  2⤵
                                                    PID:5084
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1372,4154000639900177857,12174933316762196580,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5952 /prefetch:8
                                                    2⤵
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:4408
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1372,4154000639900177857,12174933316762196580,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5324 /prefetch:8
                                                    2⤵
                                                      PID:4412
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1372,4154000639900177857,12174933316762196580,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6588 /prefetch:8
                                                      2⤵
                                                        PID:4524
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1372,4154000639900177857,12174933316762196580,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6048 /prefetch:8
                                                        2⤵
                                                          PID:4580
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1372,4154000639900177857,12174933316762196580,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6044 /prefetch:8
                                                          2⤵
                                                            PID:4688
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1372,4154000639900177857,12174933316762196580,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5792 /prefetch:8
                                                            2⤵
                                                              PID:4772
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1372,4154000639900177857,12174933316762196580,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5164 /prefetch:8
                                                              2⤵
                                                                PID:4832
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1372,4154000639900177857,12174933316762196580,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5760 /prefetch:8
                                                                2⤵
                                                                  PID:4924
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1372,4154000639900177857,12174933316762196580,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5772 /prefetch:8
                                                                  2⤵
                                                                    PID:588
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1372,4154000639900177857,12174933316762196580,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5784 /prefetch:8
                                                                    2⤵
                                                                      PID:3928
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1372,4154000639900177857,12174933316762196580,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5664 /prefetch:8
                                                                      2⤵
                                                                        PID:4796
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1372,4154000639900177857,12174933316762196580,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6224 /prefetch:8
                                                                        2⤵
                                                                          PID:5036
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1372,4154000639900177857,12174933316762196580,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3656 /prefetch:8
                                                                          2⤵
                                                                            PID:1328
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1372,4154000639900177857,12174933316762196580,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6616 /prefetch:8
                                                                            2⤵
                                                                              PID:5100
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1372,4154000639900177857,12174933316762196580,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6844 /prefetch:8
                                                                              2⤵
                                                                                PID:5012
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1372,4154000639900177857,12174933316762196580,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7200 /prefetch:8
                                                                                2⤵
                                                                                  PID:4352
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1372,4154000639900177857,12174933316762196580,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7336 /prefetch:8
                                                                                  2⤵
                                                                                    PID:3304
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1372,4154000639900177857,12174933316762196580,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7080 /prefetch:8
                                                                                    2⤵
                                                                                      PID:4800
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1372,4154000639900177857,12174933316762196580,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7604 /prefetch:8
                                                                                      2⤵
                                                                                        PID:4940
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1372,4154000639900177857,12174933316762196580,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7616 /prefetch:8
                                                                                        2⤵
                                                                                          PID:5024
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1372,4154000639900177857,12174933316762196580,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7456 /prefetch:8
                                                                                          2⤵
                                                                                            PID:4576
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1372,4154000639900177857,12174933316762196580,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7876 /prefetch:8
                                                                                            2⤵
                                                                                              PID:4652
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1372,4154000639900177857,12174933316762196580,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8128 /prefetch:8
                                                                                              2⤵
                                                                                                PID:4968
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1372,4154000639900177857,12174933316762196580,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8140 /prefetch:8
                                                                                                2⤵
                                                                                                  PID:3216
                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1372,4154000639900177857,12174933316762196580,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8264 /prefetch:8
                                                                                                  2⤵
                                                                                                    PID:5068
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1372,4154000639900177857,12174933316762196580,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8256 /prefetch:8
                                                                                                    2⤵
                                                                                                      PID:4988
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1372,4154000639900177857,12174933316762196580,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8416 /prefetch:8
                                                                                                      2⤵
                                                                                                        PID:4128
                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1372,4154000639900177857,12174933316762196580,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5880 /prefetch:8
                                                                                                        2⤵
                                                                                                          PID:5176
                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1372,4154000639900177857,12174933316762196580,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5440 /prefetch:8
                                                                                                          2⤵
                                                                                                            PID:5212
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1372,4154000639900177857,12174933316762196580,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7736 /prefetch:1
                                                                                                            2⤵
                                                                                                              PID:5252
                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1372,4154000639900177857,12174933316762196580,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:1
                                                                                                              2⤵
                                                                                                                PID:5312
                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1372,4154000639900177857,12174933316762196580,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3812 /prefetch:8
                                                                                                                2⤵
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                PID:5376
                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1372,4154000639900177857,12174933316762196580,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9148 /prefetch:1
                                                                                                                2⤵
                                                                                                                  PID:5424
                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1372,4154000639900177857,12174933316762196580,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:8
                                                                                                                  2⤵
                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                  PID:5588
                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1372,4154000639900177857,12174933316762196580,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1436 /prefetch:8
                                                                                                                  2⤵
                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                  PID:5632
                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1372,4154000639900177857,12174933316762196580,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2064 /prefetch:8
                                                                                                                  2⤵
                                                                                                                    PID:5676
                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1372,4154000639900177857,12174933316762196580,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8808 /prefetch:8
                                                                                                                    2⤵
                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                    PID:5716
                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1372,4154000639900177857,12174933316762196580,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3560 /prefetch:8
                                                                                                                    2⤵
                                                                                                                      PID:5888
                                                                                                                  • c:\windows\system32\svchost.exe
                                                                                                                    c:\windows\system32\svchost.exe -k netsvcs -s Browser
                                                                                                                    1⤵
                                                                                                                      PID:2864
                                                                                                                    • c:\windows\system32\svchost.exe
                                                                                                                      c:\windows\system32\svchost.exe -k netsvcs -s WpnService
                                                                                                                      1⤵
                                                                                                                        PID:2644
                                                                                                                      • c:\windows\system32\svchost.exe
                                                                                                                        c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
                                                                                                                        1⤵
                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                        PID:2616
                                                                                                                      • c:\windows\system32\svchost.exe
                                                                                                                        c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
                                                                                                                        1⤵
                                                                                                                          PID:2472
                                                                                                                        • c:\windows\system32\svchost.exe
                                                                                                                          c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
                                                                                                                          1⤵
                                                                                                                            PID:2456
                                                                                                                          • c:\windows\system32\svchost.exe
                                                                                                                            c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
                                                                                                                            1⤵
                                                                                                                              PID:1852
                                                                                                                            • c:\windows\system32\svchost.exe
                                                                                                                              c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                                                                                                                              1⤵
                                                                                                                                PID:1276
                                                                                                                              • c:\windows\system32\svchost.exe
                                                                                                                                c:\windows\system32\svchost.exe -k netsvcs -s Themes
                                                                                                                                1⤵
                                                                                                                                  PID:1228
                                                                                                                                • c:\windows\system32\svchost.exe
                                                                                                                                  c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                                                                                                                                  1⤵
                                                                                                                                    PID:1104
                                                                                                                                  • c:\windows\system32\svchost.exe
                                                                                                                                    c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                                                                                                                                    1⤵
                                                                                                                                      PID:352
                                                                                                                                    • \??\c:\windows\system32\svchost.exe
                                                                                                                                      c:\windows\system32\svchost.exe -k netsvcs -s BITS
                                                                                                                                      1⤵
                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                      PID:4004
                                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                                        C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                        2⤵
                                                                                                                                        • Drops file in System32 directory
                                                                                                                                        • Checks processor information in registry
                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                        • Modifies registry class
                                                                                                                                        PID:5404
                                                                                                                                    • C:\Windows\System32\rundll32.exe
                                                                                                                                      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                                                      1⤵
                                                                                                                                        PID:5560
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Temp2_Tipard.Ts.Converter.7.1.56.keymaker.by.FUTURiTY.zip\Tipard.Ts.Converter.7.1.56.keymaker.by.FUTURiTY.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Temp2_Tipard.Ts.Converter.7.1.56.keymaker.by.FUTURiTY.zip\Tipard.Ts.Converter.7.1.56.keymaker.by.FUTURiTY.exe"
                                                                                                                                        1⤵
                                                                                                                                          PID:5808
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "
                                                                                                                                            2⤵
                                                                                                                                              PID:5948
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
                                                                                                                                                keygen-pr.exe -p83fsase3Ge
                                                                                                                                                3⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:6004
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"
                                                                                                                                                  4⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                  PID:4916
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.dat
                                                                                                                                                    5⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    PID:3304
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
                                                                                                                                                keygen-step-1.exe
                                                                                                                                                3⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:6020
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exe
                                                                                                                                                keygen-step-2.exe
                                                                                                                                                3⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Modifies system certificate store
                                                                                                                                                PID:6052
                                                                                                                                                • C:\Users\Admin\AppData\Roaming\5881.tmp.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\5881.tmp.exe"
                                                                                                                                                  4⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                  PID:5172
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Roaming\5881.tmp.exe"
                                                                                                                                                    5⤵
                                                                                                                                                      PID:5552
                                                                                                                                                      • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                        timeout /T 10 /NOBREAK
                                                                                                                                                        6⤵
                                                                                                                                                        • Delays execution with timeout.exe
                                                                                                                                                        PID:2544
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exe" >> NUL
                                                                                                                                                    4⤵
                                                                                                                                                      PID:4296
                                                                                                                                                      • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                        ping 127.0.0.1
                                                                                                                                                        5⤵
                                                                                                                                                        • Runs ping.exe
                                                                                                                                                        PID:5304
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe
                                                                                                                                                    keygen-step-3.exe
                                                                                                                                                    3⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    PID:6064
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"
                                                                                                                                                      4⤵
                                                                                                                                                        PID:4452
                                                                                                                                                        • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                          ping 1.1.1.1 -n 1 -w 3000
                                                                                                                                                          5⤵
                                                                                                                                                          • Runs ping.exe
                                                                                                                                                          PID:5144
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe
                                                                                                                                                      keygen-step-4.exe
                                                                                                                                                      3⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Checks computer location settings
                                                                                                                                                      PID:6124
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"
                                                                                                                                                        4⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                        PID:5072
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\84V7WBBQXR\setups.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\84V7WBBQXR\setups.exe" ll
                                                                                                                                                          5⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          PID:4776
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-UJO3S.tmp\setups.tmp
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-UJO3S.tmp\setups.tmp" /SL5="$60276,726852,244736,C:\Users\Admin\AppData\Local\Temp\84V7WBBQXR\setups.exe" ll
                                                                                                                                                            6⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Checks computer location settings
                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                            PID:5152
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\RarSFX2\Full Version.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\RarSFX2\Full Version.exe"
                                                                                                                                                        4⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                        PID:4884
                                                                                                                                                        • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                          "C:\Windows\System32\WScript.exe" "C:\Program Files\unins0000.vbs"
                                                                                                                                                          5⤵
                                                                                                                                                            PID:4152
                                                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                              "C:\Windows\System32\rundll32.exe" "C:\Program Files\unins0000.dll",install
                                                                                                                                                              6⤵
                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                              • Modifies registry class
                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                              PID:4320
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe"
                                                                                                                                                          4⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Drops Chrome extension
                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                          PID:2032
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            cmd.exe /c taskkill /f /im chrome.exe
                                                                                                                                                            5⤵
                                                                                                                                                              PID:760
                                                                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                taskkill /f /im chrome.exe
                                                                                                                                                                6⤵
                                                                                                                                                                • Kills process with taskkill
                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                PID:4572
                                                                                                                                                            • C:\Windows\SysWOW64\xcopy.exe
                                                                                                                                                              xcopy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data" "C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\" /s /e /y
                                                                                                                                                              5⤵
                                                                                                                                                              • Enumerates system info in registry
                                                                                                                                                              PID:4932
                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --window-position=-50000,-50000 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" https://www.facebook.com/ https://www.facebook.com/pages/ https://secure.facebook.com/ads/manager/account_settings/account_billing/
                                                                                                                                                              5⤵
                                                                                                                                                              • Enumerates system info in registry
                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                                                                              PID:6100
                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xd4,0xd8,0xdc,0xb0,0xe0,0x7fffbf8c4f50,0x7fffbf8c4f60,0x7fffbf8c4f70
                                                                                                                                                                6⤵
                                                                                                                                                                  PID:6108
                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1544,549924085538452531,18141973163118915737,131072 --lang=en-US --service-sandbox-type=network --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=1932 /prefetch:8
                                                                                                                                                                  6⤵
                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                  PID:4232
                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1544,549924085538452531,18141973163118915737,131072 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1576 /prefetch:2
                                                                                                                                                                  6⤵
                                                                                                                                                                    PID:4168
                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1544,549924085538452531,18141973163118915737,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=2188 /prefetch:8
                                                                                                                                                                    6⤵
                                                                                                                                                                      PID:5300
                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,549924085538452531,18141973163118915737,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2732 /prefetch:1
                                                                                                                                                                      6⤵
                                                                                                                                                                        PID:628
                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,549924085538452531,18141973163118915737,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2712 /prefetch:1
                                                                                                                                                                        6⤵
                                                                                                                                                                          PID:5640
                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,549924085538452531,18141973163118915737,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
                                                                                                                                                                          6⤵
                                                                                                                                                                            PID:656
                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,549924085538452531,18141973163118915737,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3128 /prefetch:1
                                                                                                                                                                            6⤵
                                                                                                                                                                              PID:5596
                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,549924085538452531,18141973163118915737,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:1
                                                                                                                                                                              6⤵
                                                                                                                                                                                PID:2408
                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1544,549924085538452531,18141973163118915737,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3876 /prefetch:1
                                                                                                                                                                                6⤵
                                                                                                                                                                                  PID:3328
                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1544,549924085538452531,18141973163118915737,131072 --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=5744 /prefetch:8
                                                                                                                                                                                  6⤵
                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                  PID:6088
                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1544,549924085538452531,18141973163118915737,131072 --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=5696 /prefetch:8
                                                                                                                                                                                  6⤵
                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                  PID:5724
                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1544,549924085538452531,18141973163118915737,131072 --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=1496 /prefetch:8
                                                                                                                                                                                  6⤵
                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                  PID:1832
                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1544,549924085538452531,18141973163118915737,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=5524 /prefetch:8
                                                                                                                                                                                  6⤵
                                                                                                                                                                                    PID:4516
                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1544,549924085538452531,18141973163118915737,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=5676 /prefetch:8
                                                                                                                                                                                    6⤵
                                                                                                                                                                                      PID:1952
                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1544,549924085538452531,18141973163118915737,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=4340 /prefetch:8
                                                                                                                                                                                      6⤵
                                                                                                                                                                                        PID:5224
                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1544,549924085538452531,18141973163118915737,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3732 /prefetch:2
                                                                                                                                                                                        6⤵
                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                        PID:1972
                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1544,549924085538452531,18141973163118915737,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=5660 /prefetch:8
                                                                                                                                                                                        6⤵
                                                                                                                                                                                          PID:2292
                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1544,549924085538452531,18141973163118915737,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=5668 /prefetch:8
                                                                                                                                                                                          6⤵
                                                                                                                                                                                            PID:1036
                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1544,549924085538452531,18141973163118915737,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=1376 /prefetch:8
                                                                                                                                                                                            6⤵
                                                                                                                                                                                              PID:4220
                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1544,549924085538452531,18141973163118915737,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=4196 /prefetch:8
                                                                                                                                                                                              6⤵
                                                                                                                                                                                                PID:5468
                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1544,549924085538452531,18141973163118915737,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=1652 /prefetch:8
                                                                                                                                                                                                6⤵
                                                                                                                                                                                                  PID:2300
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\SwReporter\89.258.200\software_reporter_tool.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\SwReporter\89.258.200\software_reporter_tool.exe" --engine=2 --scan-locations=1,2,3,4,5,6,7,8,10 --disabled-locations=9,11 --session-id=OUVPsO2pJ6Pw06IZi3foc8eKIWkIZcxQRX1WZDd/ --registry-suffix=ESET --srt-field-trial-group-name=NewCleanerUIExperiment
                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                  PID:5032
                                                                                                                                                                                                  • \??\c:\users\admin\appdata\local\temp\cghjgasaaz99\swreporter\89.258.200\software_reporter_tool.exe
                                                                                                                                                                                                    c:\users\admin\appdata\local\temp\cghjgasaaz99\swreporter\89.258.200\software_reporter_tool.exe --crash-handler "--database=c:\users\admin\appdata\local\Google\Software Reporter Tool" --url=https://clients2.google.com/cr/report --annotation=plat=Win32 --annotation=prod=ChromeFoil --annotation=ver=89.258.200 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff7919cac28,0x7ff7919cac38,0x7ff7919cac48
                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    PID:1832
                                                                                                                                                                                                  • \??\c:\users\admin\appdata\local\temp\cghjgasaaz99\swreporter\89.258.200\software_reporter_tool.exe
                                                                                                                                                                                                    "c:\users\admin\appdata\local\temp\cghjgasaaz99\swreporter\89.258.200\software_reporter_tool.exe" --use-crash-handler-with-id="\\.\pipe\crashpad_5032_CCLMEJPSLCRRGYKH" --sandboxed-process-id=2 --init-done-notifier=696 --sandbox-mojo-pipe-token=3944231740533863906 --mojo-platform-channel-handle=672 --engine=2
                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                                    PID:4140
                                                                                                                                                                                                  • \??\c:\users\admin\appdata\local\temp\cghjgasaaz99\swreporter\89.258.200\software_reporter_tool.exe
                                                                                                                                                                                                    "c:\users\admin\appdata\local\temp\cghjgasaaz99\swreporter\89.258.200\software_reporter_tool.exe" --use-crash-handler-with-id="\\.\pipe\crashpad_5032_CCLMEJPSLCRRGYKH" --sandboxed-process-id=3 --init-done-notifier=916 --sandbox-mojo-pipe-token=14802748902378736488 --mojo-platform-channel-handle=912
                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    PID:700
                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1544,549924085538452531,18141973163118915737,131072 --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=6000 /prefetch:8
                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                  PID:5720
                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1544,549924085538452531,18141973163118915737,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=732 /prefetch:8
                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                    PID:5036
                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1544,549924085538452531,18141973163118915737,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=3448 /prefetch:8
                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                      PID:1288
                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1544,549924085538452531,18141973163118915737,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=5728 /prefetch:8
                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                        PID:4920
                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1544,549924085538452531,18141973163118915737,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=3448 /prefetch:8
                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                          PID:4540
                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1544,549924085538452531,18141973163118915737,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=5880 /prefetch:8
                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                            PID:1672
                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1544,549924085538452531,18141973163118915737,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=2192 /prefetch:8
                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                              PID:4644
                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1544,549924085538452531,18141973163118915737,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=3836 /prefetch:8
                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                PID:3188
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"
                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            PID:5732
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe" >> NUL
                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                PID:4212
                                                                                                                                                                                                                • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                                                                                  ping 127.0.0.1
                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                                  PID:2700
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\RarSFX2\md2_2efs.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\RarSFX2\md2_2efs.exe"
                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • Checks whether UAC is enabled
                                                                                                                                                                                                              PID:5768
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\RarSFX2\BTRSetp.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\RarSFX2\BTRSetp.exe"
                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              PID:4740
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\RarSFX2\gcttt.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\RarSFX2\gcttt.exe"
                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                              PID:5560
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                PID:1732
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                PID:2604
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                PID:3808
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                PID:4516
                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                        • Modifies Internet Explorer settings
                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                        PID:3864
                                                                                                                                                                                                      • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                        C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                        • Modifies Internet Explorer settings
                                                                                                                                                                                                        PID:3784
                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                        • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                        PID:4760
                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                        • Modifies Internet Explorer settings
                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                        PID:4856
                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                        PID:4772
                                                                                                                                                                                                      • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                        C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                        • Modifies Internet Explorer settings
                                                                                                                                                                                                        PID:4352
                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                        • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                        PID:1176
                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                        PID:5084
                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                        PID:5892
                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                        PID:4544
                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                        PID:2112
                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                        PID:4136
                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                        PID:5248
                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                        PID:1484
                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                        PID:2224
                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                        PID:5552

                                                                                                                                                                                                      Network

                                                                                                                                                                                                      MITRE ATT&CK Matrix ATT&CK v6

                                                                                                                                                                                                      Persistence

                                                                                                                                                                                                      Registry Run Keys / Startup Folder

                                                                                                                                                                                                      1
                                                                                                                                                                                                      T1060

                                                                                                                                                                                                      Defense Evasion

                                                                                                                                                                                                      Modify Registry

                                                                                                                                                                                                      3
                                                                                                                                                                                                      T1112

                                                                                                                                                                                                      Install Root Certificate

                                                                                                                                                                                                      1
                                                                                                                                                                                                      T1130

                                                                                                                                                                                                      Credential Access

                                                                                                                                                                                                      Credentials in Files

                                                                                                                                                                                                      3
                                                                                                                                                                                                      T1081

                                                                                                                                                                                                      Discovery

                                                                                                                                                                                                      Query Registry

                                                                                                                                                                                                      4
                                                                                                                                                                                                      T1012

                                                                                                                                                                                                      System Information Discovery

                                                                                                                                                                                                      5
                                                                                                                                                                                                      T1082

                                                                                                                                                                                                      Remote System Discovery

                                                                                                                                                                                                      1
                                                                                                                                                                                                      T1018

                                                                                                                                                                                                      Collection

                                                                                                                                                                                                      Data from Local System

                                                                                                                                                                                                      3
                                                                                                                                                                                                      T1005

                                                                                                                                                                                                      Command and Control

                                                                                                                                                                                                      Web Service

                                                                                                                                                                                                      1
                                                                                                                                                                                                      T1102

                                                                                                                                                                                                      Replay Monitor

                                                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                                                      Downloads

                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
                                                                                                                                                                                                        MD5

                                                                                                                                                                                                        13e4144d6c3c9edb5c4f723d66636534

                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                        225f24157c3cdb8b1bf4d1da087c2b9fe28be8e2

                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                        46acd60dec03f0e72277a91fe88fda67a2bfe31a354dfc52147e55ed7b0b1ed0

                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                        997a87546f87a000299d339a9711461df9894d6645560daa817955f7ae90a8e705afb11f5da88ac12f9ccae6eaac3230e808a371a1897b40dee626ad2431b031

                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
                                                                                                                                                                                                        MD5

                                                                                                                                                                                                        65b49b106ec0f6cf61e7dc04c0a7eb74

                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                        a1f4784377c53151167965e0ff225f5085ebd43b

                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                        862a8cf0e5561c848145a1a1f464acf77f92a3b15cc43722a7208701f60a2fcd

                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                        e9030cd609f42fb616e5bac3a5203ae46bbae9ec95682432a367f8805cdaa3e30c18a732ceddb0545ac653d543348a6728866149d2822752c80948066bfdf3da

                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
                                                                                                                                                                                                        MD5

                                                                                                                                                                                                        65b49b106ec0f6cf61e7dc04c0a7eb74

                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                        a1f4784377c53151167965e0ff225f5085ebd43b

                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                        862a8cf0e5561c848145a1a1f464acf77f92a3b15cc43722a7208701f60a2fcd

                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                        e9030cd609f42fb616e5bac3a5203ae46bbae9ec95682432a367f8805cdaa3e30c18a732ceddb0545ac653d543348a6728866149d2822752c80948066bfdf3da

                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat
                                                                                                                                                                                                        MD5

                                                                                                                                                                                                        a12e7acce9c54e8f477830c938cd5bb7

                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                        482ac6ae9ea9ab1673e1444269bba2ef7a86794c

                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                        b5433a43058d8b81958e13064f7d5485b787d6812513600c27b913dc5c3b3bd0

                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                        5198b9b7f7ab17a0173a5eed18f3b1906ab3fc64da62cfb765ff43539acdcf3a0eafeefe6184f51f1fbebaacdb0bdf422572b4b3ba70de0b116c779f5e1b7174

                                                                                                                                                                                                      • \??\pipe\crashpad_4040_EGACRUFTGELKXBTF
                                                                                                                                                                                                        MD5

                                                                                                                                                                                                        d41d8cd98f00b204e9800998ecf8427e

                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                                                                                                                                      • \??\pipe\crashpad_5076_IRJYRVSERVXNGZCG
                                                                                                                                                                                                        MD5

                                                                                                                                                                                                        d41d8cd98f00b204e9800998ecf8427e

                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                                                                                                                                      • memory/204-121-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/204-124-0x00007FFFDA760000-0x00007FFFDA761000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        4KB

                                                                                                                                                                                                      • memory/352-262-0x000001E078E40000-0x000001E078EA7000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        412KB

                                                                                                                                                                                                      • memory/588-212-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/928-270-0x0000020859E40000-0x0000020859EA7000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        412KB

                                                                                                                                                                                                      • memory/1104-268-0x0000026B11320000-0x0000026B11387000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        412KB

                                                                                                                                                                                                      • memory/1228-276-0x0000015777240000-0x00000157772A7000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        412KB

                                                                                                                                                                                                      • memory/1276-278-0x000001C197B60000-0x000001C197BC7000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        412KB

                                                                                                                                                                                                      • memory/1328-216-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/1352-272-0x000001A927A50000-0x000001A927AB7000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        412KB

                                                                                                                                                                                                      • memory/1852-274-0x000001AD22F50000-0x000001AD22FB7000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        412KB

                                                                                                                                                                                                      • memory/2088-122-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/2300-128-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/2456-264-0x00000122DE830000-0x00000122DE897000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        412KB

                                                                                                                                                                                                      • memory/2472-266-0x000001B8EADD0000-0x000001B8EAE37000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        412KB

                                                                                                                                                                                                      • memory/2496-155-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/2604-149-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/2616-280-0x000001C469900000-0x000001C469967000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        412KB

                                                                                                                                                                                                      • memory/2644-283-0x000001BE65C40000-0x000001BE65CA7000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        412KB

                                                                                                                                                                                                      • memory/2864-258-0x000001EB92840000-0x000001EB928A7000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        412KB

                                                                                                                                                                                                      • memory/3208-116-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/3216-227-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/3304-220-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/3304-250-0x0000000000400000-0x0000000000983000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        5.5MB

                                                                                                                                                                                                      • memory/3312-160-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/3748-138-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/3824-147-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/3848-135-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/3928-213-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4004-256-0x000002463AB20000-0x000002463AB87000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        412KB

                                                                                                                                                                                                      • memory/4004-255-0x000002463AA60000-0x000002463AAA4000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        272KB

                                                                                                                                                                                                      • memory/4128-230-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4140-308-0x0000020C80180000-0x0000020C801C0000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        256KB

                                                                                                                                                                                                      • memory/4140-303-0x0000020C80140000-0x0000020C80141000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        4KB

                                                                                                                                                                                                      • memory/4140-293-0x0000020C80140000-0x0000020C80180000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        256KB

                                                                                                                                                                                                      • memory/4140-294-0x0000020C80140000-0x0000020C80141000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        4KB

                                                                                                                                                                                                      • memory/4140-309-0x0000020C80140000-0x0000020C80141000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        4KB

                                                                                                                                                                                                      • memory/4140-295-0x0000020C80140000-0x0000020C80180000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        256KB

                                                                                                                                                                                                      • memory/4140-290-0x0000020C80140000-0x0000020C80141000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        4KB

                                                                                                                                                                                                      • memory/4140-292-0x0000020C80140000-0x0000020C80141000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        4KB

                                                                                                                                                                                                      • memory/4140-291-0x0000020C80140000-0x0000020C80180000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        256KB

                                                                                                                                                                                                      • memory/4140-311-0x0000020C80140000-0x0000020C80141000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        4KB

                                                                                                                                                                                                      • memory/4140-298-0x0000020C80140000-0x0000020C80141000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        4KB

                                                                                                                                                                                                      • memory/4140-297-0x0000020C80140000-0x0000020C80180000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        256KB

                                                                                                                                                                                                      • memory/4140-300-0x0000020C80180000-0x0000020C801C0000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        256KB

                                                                                                                                                                                                      • memory/4140-301-0x0000020C80430000-0x0000020C80470000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        256KB

                                                                                                                                                                                                      • memory/4140-310-0x0000020C80140000-0x0000020C80180000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        256KB

                                                                                                                                                                                                      • memory/4140-306-0x0000020C80140000-0x0000020C80141000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        4KB

                                                                                                                                                                                                      • memory/4140-307-0x0000020C80140000-0x0000020C80180000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        256KB

                                                                                                                                                                                                      • memory/4140-296-0x0000020C80140000-0x0000020C80141000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        4KB

                                                                                                                                                                                                      • memory/4140-302-0x0000020C80470000-0x0000020C804B0000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        256KB

                                                                                                                                                                                                      • memory/4140-299-0x0000020C80140000-0x0000020C80180000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        256KB

                                                                                                                                                                                                      • memory/4140-304-0x0000020C80140000-0x0000020C80180000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        256KB

                                                                                                                                                                                                      • memory/4140-305-0x0000020C80180000-0x0000020C801C0000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        256KB

                                                                                                                                                                                                      • memory/4224-202-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4320-254-0x0000000004110000-0x0000000004166000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        344KB

                                                                                                                                                                                                      • memory/4320-253-0x0000000000320000-0x00000000003CE000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        696KB

                                                                                                                                                                                                      • memory/4332-177-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4352-219-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4408-204-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4412-205-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4524-206-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4576-224-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4580-207-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4652-225-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4676-183-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4688-208-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4740-289-0x0000000000800000-0x0000000000802000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        8KB

                                                                                                                                                                                                      • memory/4752-187-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4772-209-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4776-251-0x0000000000400000-0x0000000000443000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        268KB

                                                                                                                                                                                                      • memory/4796-214-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4800-221-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4804-192-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4832-210-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4856-194-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4916-286-0x0000000000D30000-0x0000000000D31000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        4KB

                                                                                                                                                                                                      • memory/4916-285-0x00000000028C0000-0x00000000029AF000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        956KB

                                                                                                                                                                                                      • memory/4916-249-0x00000000011B0000-0x000000000125E000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        696KB

                                                                                                                                                                                                      • memory/4916-287-0x0000000000D20000-0x0000000000D3B000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        108KB

                                                                                                                                                                                                      • memory/4920-195-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4924-211-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4940-222-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4956-196-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4968-226-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4968-197-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/4988-229-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/5012-218-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/5024-223-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/5028-198-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/5036-215-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/5040-199-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/5068-228-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/5072-248-0x000000001C890000-0x000000001C892000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        8KB

                                                                                                                                                                                                      • memory/5076-201-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/5084-200-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/5100-217-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/5152-252-0x00000000001E0000-0x00000000001E1000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        4KB

                                                                                                                                                                                                      • memory/5172-281-0x0000000005A00000-0x0000000005A91000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        580KB

                                                                                                                                                                                                      • memory/5172-284-0x0000000000400000-0x0000000003DE8000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        57.9MB

                                                                                                                                                                                                      • memory/5176-231-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/5212-232-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/5252-233-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/5312-234-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/5376-235-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/5404-288-0x00000260FA900000-0x00000260FAA05000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        1.0MB

                                                                                                                                                                                                      • memory/5404-260-0x00000260F8470000-0x00000260F84D7000-memory.dmp
                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                        412KB

                                                                                                                                                                                                      • memory/5424-236-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/5588-237-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/5632-238-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/5676-239-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/5716-240-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/5888-241-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/5948-242-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/6004-244-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                      • memory/6020-247-0x0000000000000000-mapping.dmp