Analysis

  • max time kernel
    1800s
  • max time network
    1797s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    14-04-2021 19:59

General

  • Target

    https://keygenit.com/d/1c818f1c5f1110n55198.html

  • Sample

    210414-96mhr5t97j

Malware Config

Extracted

Family

raccoon

Botnet

a6bfe7e504db71e25642b830fd9b2c4366cf882a

Attributes
  • url4cnc

    https://telete.in/j90dadarobin

rc4.plain
rc4.plain

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • Executes dropped EXE 24 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 20 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Drops Chrome extension 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Enumerates system info in registry 2 TTPs 7 IoCs
  • Kills process with taskkill 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 13 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Runs ping.exe 1 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 60 IoCs
  • Suspicious behavior: MapViewOfSection 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 14 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Schedule
    1⤵
      PID:1064
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" https://keygenit.com/d/1c818f1c5f1110n55198.html
      1⤵
      • Enumerates system info in registry
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:640
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc8,0xcc,0xd0,0xa4,0xd4,0x7ffdd6b14f50,0x7ffdd6b14f60,0x7ffdd6b14f70
        2⤵
          PID:1528
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1584,9360733036958789628,4338094722425469065,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1604 /prefetch:2
          2⤵
            PID:1624
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1584,9360733036958789628,4338094722425469065,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1656 /prefetch:8
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:3832
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1584,9360733036958789628,4338094722425469065,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2168 /prefetch:8
            2⤵
              PID:3740
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1584,9360733036958789628,4338094722425469065,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2880 /prefetch:1
              2⤵
                PID:1264
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1584,9360733036958789628,4338094722425469065,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2896 /prefetch:1
                2⤵
                  PID:3100
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1584,9360733036958789628,4338094722425469065,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
                  2⤵
                    PID:1312
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1584,9360733036958789628,4338094722425469065,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3632 /prefetch:1
                    2⤵
                      PID:2680
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1584,9360733036958789628,4338094722425469065,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3656 /prefetch:1
                      2⤵
                        PID:2176
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1584,9360733036958789628,4338094722425469065,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3668 /prefetch:1
                        2⤵
                          PID:3976
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,9360733036958789628,4338094722425469065,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4740 /prefetch:8
                          2⤵
                            PID:4120
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1584,9360733036958789628,4338094722425469065,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4904 /prefetch:8
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:4312
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,9360733036958789628,4338094722425469065,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5268 /prefetch:8
                            2⤵
                              PID:4516
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,9360733036958789628,4338094722425469065,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5440 /prefetch:8
                              2⤵
                                PID:4544
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,9360733036958789628,4338094722425469065,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5424 /prefetch:8
                                2⤵
                                  PID:4588
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,9360733036958789628,4338094722425469065,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5312 /prefetch:8
                                  2⤵
                                    PID:4624
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,9360733036958789628,4338094722425469065,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5412 /prefetch:8
                                    2⤵
                                      PID:4688
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,9360733036958789628,4338094722425469065,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5584 /prefetch:8
                                      2⤵
                                        PID:4700
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,9360733036958789628,4338094722425469065,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5380 /prefetch:8
                                        2⤵
                                          PID:4736
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,9360733036958789628,4338094722425469065,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5572 /prefetch:8
                                          2⤵
                                            PID:4772
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,9360733036958789628,4338094722425469065,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5300 /prefetch:8
                                            2⤵
                                              PID:4808
                                            • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe
                                              "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --channel --force-configure-user-settings
                                              2⤵
                                                PID:4844
                                                • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe
                                                  "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff7b663a890,0x7ff7b663a8a0,0x7ff7b663a8b0
                                                  3⤵
                                                    PID:4864
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1584,9360733036958789628,4338094722425469065,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5288 /prefetch:8
                                                  2⤵
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:4944
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,9360733036958789628,4338094722425469065,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5520 /prefetch:8
                                                  2⤵
                                                    PID:4956
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,9360733036958789628,4338094722425469065,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5456 /prefetch:8
                                                    2⤵
                                                      PID:4968
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,9360733036958789628,4338094722425469065,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5512 /prefetch:8
                                                      2⤵
                                                        PID:4992
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,9360733036958789628,4338094722425469065,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5560 /prefetch:8
                                                        2⤵
                                                          PID:4980
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,9360733036958789628,4338094722425469065,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5504 /prefetch:8
                                                          2⤵
                                                            PID:5004
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,9360733036958789628,4338094722425469065,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5452 /prefetch:8
                                                            2⤵
                                                              PID:5020
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,9360733036958789628,4338094722425469065,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5364 /prefetch:8
                                                              2⤵
                                                                PID:5032
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,9360733036958789628,4338094722425469065,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5356 /prefetch:8
                                                                2⤵
                                                                  PID:5064
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,9360733036958789628,4338094722425469065,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5376 /prefetch:8
                                                                  2⤵
                                                                    PID:5084
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,9360733036958789628,4338094722425469065,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6584 /prefetch:8
                                                                    2⤵
                                                                      PID:4528
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,9360733036958789628,4338094722425469065,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6532 /prefetch:8
                                                                      2⤵
                                                                        PID:792
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,9360733036958789628,4338094722425469065,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6480 /prefetch:8
                                                                        2⤵
                                                                          PID:4604
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,9360733036958789628,4338094722425469065,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6468 /prefetch:8
                                                                          2⤵
                                                                            PID:4544
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,9360733036958789628,4338094722425469065,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5904 /prefetch:8
                                                                            2⤵
                                                                              PID:4588
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,9360733036958789628,4338094722425469065,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6240 /prefetch:8
                                                                              2⤵
                                                                                PID:4712
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,9360733036958789628,4338094722425469065,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7680 /prefetch:8
                                                                                2⤵
                                                                                  PID:4732
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,9360733036958789628,4338094722425469065,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7800 /prefetch:8
                                                                                  2⤵
                                                                                    PID:4784
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,9360733036958789628,4338094722425469065,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7928 /prefetch:8
                                                                                    2⤵
                                                                                      PID:4748
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,9360733036958789628,4338094722425469065,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7392 /prefetch:8
                                                                                      2⤵
                                                                                        PID:4872
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,9360733036958789628,4338094722425469065,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7920 /prefetch:8
                                                                                        2⤵
                                                                                          PID:4856
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,9360733036958789628,4338094722425469065,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7676 /prefetch:8
                                                                                          2⤵
                                                                                            PID:5072
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,9360733036958789628,4338094722425469065,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8288 /prefetch:8
                                                                                            2⤵
                                                                                              PID:4536
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,9360733036958789628,4338094722425469065,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5656 /prefetch:8
                                                                                              2⤵
                                                                                                PID:4136
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,9360733036958789628,4338094722425469065,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8480 /prefetch:8
                                                                                                2⤵
                                                                                                  PID:1484
                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,9360733036958789628,4338094722425469065,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5404 /prefetch:8
                                                                                                  2⤵
                                                                                                    PID:4996
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,9360733036958789628,4338094722425469065,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3876 /prefetch:8
                                                                                                    2⤵
                                                                                                      PID:4696
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,9360733036958789628,4338094722425469065,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3748 /prefetch:8
                                                                                                      2⤵
                                                                                                        PID:4692
                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1584,9360733036958789628,4338094722425469065,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3800 /prefetch:8
                                                                                                        2⤵
                                                                                                          PID:4432
                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1584,9360733036958789628,4338094722425469065,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6480 /prefetch:1
                                                                                                          2⤵
                                                                                                            PID:4912
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1584,9360733036958789628,4338094722425469065,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7400 /prefetch:1
                                                                                                            2⤵
                                                                                                              PID:3620
                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1584,9360733036958789628,4338094722425469065,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3448 /prefetch:8
                                                                                                              2⤵
                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                              PID:4320
                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1584,9360733036958789628,4338094722425469065,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
                                                                                                              2⤵
                                                                                                                PID:4644
                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1584,9360733036958789628,4338094722425469065,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7336 /prefetch:8
                                                                                                                2⤵
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                PID:4652
                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,9360733036958789628,4338094722425469065,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8544 /prefetch:8
                                                                                                                2⤵
                                                                                                                  PID:4280
                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1584,9360733036958789628,4338094722425469065,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2484 /prefetch:8
                                                                                                                  2⤵
                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                  PID:4120
                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,9360733036958789628,4338094722425469065,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
                                                                                                                  2⤵
                                                                                                                    PID:3260
                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,9360733036958789628,4338094722425469065,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2152 /prefetch:8
                                                                                                                    2⤵
                                                                                                                      PID:2680
                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1584,9360733036958789628,4338094722425469065,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=772 /prefetch:8
                                                                                                                      2⤵
                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                      PID:4108
                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,9360733036958789628,4338094722425469065,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2200 /prefetch:8
                                                                                                                      2⤵
                                                                                                                        PID:4964
                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1584,9360733036958789628,4338094722425469065,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4716 /prefetch:2
                                                                                                                        2⤵
                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                        PID:5028
                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,9360733036958789628,4338094722425469065,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3524 /prefetch:8
                                                                                                                        2⤵
                                                                                                                          PID:4976
                                                                                                                      • c:\windows\system32\svchost.exe
                                                                                                                        c:\windows\system32\svchost.exe -k netsvcs -s Browser
                                                                                                                        1⤵
                                                                                                                          PID:2656
                                                                                                                        • c:\windows\system32\svchost.exe
                                                                                                                          c:\windows\system32\svchost.exe -k netsvcs -s WpnService
                                                                                                                          1⤵
                                                                                                                            PID:2436
                                                                                                                          • c:\windows\system32\svchost.exe
                                                                                                                            c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
                                                                                                                            1⤵
                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                            PID:2428
                                                                                                                          • c:\windows\system32\svchost.exe
                                                                                                                            c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
                                                                                                                            1⤵
                                                                                                                              PID:2320
                                                                                                                            • c:\windows\system32\svchost.exe
                                                                                                                              c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
                                                                                                                              1⤵
                                                                                                                                PID:2272
                                                                                                                              • c:\windows\system32\svchost.exe
                                                                                                                                c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
                                                                                                                                1⤵
                                                                                                                                  PID:1864
                                                                                                                                • c:\windows\system32\svchost.exe
                                                                                                                                  c:\windows\system32\svchost.exe -k netsvcs -s SENS
                                                                                                                                  1⤵
                                                                                                                                    PID:1456
                                                                                                                                  • c:\windows\system32\svchost.exe
                                                                                                                                    c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                                                                                                                                    1⤵
                                                                                                                                      PID:1396
                                                                                                                                    • c:\windows\system32\svchost.exe
                                                                                                                                      c:\windows\system32\svchost.exe -k netsvcs -s Themes
                                                                                                                                      1⤵
                                                                                                                                        PID:1288
                                                                                                                                      • c:\windows\system32\svchost.exe
                                                                                                                                        c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                                                                                                                                        1⤵
                                                                                                                                          PID:1148
                                                                                                                                        • c:\windows\system32\svchost.exe
                                                                                                                                          c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                                                                                                                                          1⤵
                                                                                                                                            PID:352
                                                                                                                                          • \??\c:\windows\system32\svchost.exe
                                                                                                                                            c:\windows\system32\svchost.exe -k netsvcs -s BITS
                                                                                                                                            1⤵
                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:1012
                                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                                              C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                              2⤵
                                                                                                                                              • Drops file in System32 directory
                                                                                                                                              • Checks processor information in registry
                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                              • Modifies registry class
                                                                                                                                              PID:1084
                                                                                                                                          • C:\Windows\System32\rundll32.exe
                                                                                                                                            C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                                                            1⤵
                                                                                                                                              PID:4516
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp2_Bullzip_Pdf_Printer_3_0_0_serials_keygen.zip\Bullzip_Pdf_Printer_3_0_0_serials_keygen.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Temp2_Bullzip_Pdf_Printer_3_0_0_serials_keygen.zip\Bullzip_Pdf_Printer_3_0_0_serials_keygen.exe"
                                                                                                                                              1⤵
                                                                                                                                                PID:4816
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "
                                                                                                                                                  2⤵
                                                                                                                                                    PID:4356
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
                                                                                                                                                      keygen-pr.exe -p83fsase3Ge
                                                                                                                                                      3⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:420
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe"
                                                                                                                                                        4⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        PID:3984
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe
                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe -txt -scanlocal -file:potato.dat
                                                                                                                                                          5⤵
                                                                                                                                                            PID:1772
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
                                                                                                                                                        keygen-step-1.exe
                                                                                                                                                        3⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        PID:416
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exe
                                                                                                                                                        keygen-step-2.exe
                                                                                                                                                        3⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Modifies system certificate store
                                                                                                                                                        PID:3460
                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\1312.tmp.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\1312.tmp.exe"
                                                                                                                                                          4⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                          PID:4180
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Roaming\1312.tmp.exe"
                                                                                                                                                            5⤵
                                                                                                                                                              PID:5828
                                                                                                                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                timeout /T 10 /NOBREAK
                                                                                                                                                                6⤵
                                                                                                                                                                • Delays execution with timeout.exe
                                                                                                                                                                PID:5868
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exe" >> NUL
                                                                                                                                                            4⤵
                                                                                                                                                              PID:4188
                                                                                                                                                              • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                                ping 127.0.0.1
                                                                                                                                                                5⤵
                                                                                                                                                                • Runs ping.exe
                                                                                                                                                                PID:4620
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe
                                                                                                                                                            keygen-step-3.exe
                                                                                                                                                            3⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            PID:2372
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"
                                                                                                                                                              4⤵
                                                                                                                                                                PID:2212
                                                                                                                                                                • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                                  ping 1.1.1.1 -n 1 -w 3000
                                                                                                                                                                  5⤵
                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                  PID:1312
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe
                                                                                                                                                              keygen-step-4.exe
                                                                                                                                                              3⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Checks computer location settings
                                                                                                                                                              PID:2724
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe"
                                                                                                                                                                4⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                PID:5040
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\KC54UMNOQS\setups.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\KC54UMNOQS\setups.exe" ll
                                                                                                                                                                  5⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  PID:2524
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-O2QU8.tmp\setups.tmp
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-O2QU8.tmp\setups.tmp" /SL5="$102F6,726852,244736,C:\Users\Admin\AppData\Local\Temp\KC54UMNOQS\setups.exe" ll
                                                                                                                                                                    6⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                    PID:3108
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\RarSFX1\Full Version.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\RarSFX1\Full Version.exe"
                                                                                                                                                                4⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                                PID:2056
                                                                                                                                                                • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                  "C:\Windows\System32\WScript.exe" "C:\Program Files\unins0000.vbs"
                                                                                                                                                                  5⤵
                                                                                                                                                                    PID:2208
                                                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                      "C:\Windows\System32\rundll32.exe" "C:\Program Files\unins0000.dll",install
                                                                                                                                                                      6⤵
                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                      PID:4256
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exe"
                                                                                                                                                                  4⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Drops Chrome extension
                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                  PID:4900
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    cmd.exe /c taskkill /f /im chrome.exe
                                                                                                                                                                    5⤵
                                                                                                                                                                      PID:4396
                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                        taskkill /f /im chrome.exe
                                                                                                                                                                        6⤵
                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                        PID:1192
                                                                                                                                                                    • C:\Windows\SysWOW64\xcopy.exe
                                                                                                                                                                      xcopy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data" "C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\" /s /e /y
                                                                                                                                                                      5⤵
                                                                                                                                                                      • Enumerates system info in registry
                                                                                                                                                                      PID:4020
                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --window-position=-50000,-50000 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" https://www.facebook.com/ https://www.facebook.com/pages/ https://secure.facebook.com/ads/manager/account_settings/account_billing/
                                                                                                                                                                      5⤵
                                                                                                                                                                      • Enumerates system info in registry
                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                                                                                                      PID:1208
                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xd4,0xd8,0xdc,0xb0,0xe0,0x7ffdc2624f50,0x7ffdc2624f60,0x7ffdc2624f70
                                                                                                                                                                        6⤵
                                                                                                                                                                          PID:4688
                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1496,11148390497762771180,2235585707063395956,131072 --lang=en-US --service-sandbox-type=network --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=1840 /prefetch:8
                                                                                                                                                                          6⤵
                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                          PID:2836
                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1496,11148390497762771180,2235585707063395956,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=2212 /prefetch:8
                                                                                                                                                                          6⤵
                                                                                                                                                                            PID:2028
                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1496,11148390497762771180,2235585707063395956,131072 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1568 /prefetch:2
                                                                                                                                                                            6⤵
                                                                                                                                                                              PID:2676
                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1496,11148390497762771180,2235585707063395956,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2856 /prefetch:1
                                                                                                                                                                              6⤵
                                                                                                                                                                                PID:1788
                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1496,11148390497762771180,2235585707063395956,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2836 /prefetch:1
                                                                                                                                                                                6⤵
                                                                                                                                                                                  PID:3816
                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1496,11148390497762771180,2235585707063395956,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
                                                                                                                                                                                  6⤵
                                                                                                                                                                                    PID:3260
                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1496,11148390497762771180,2235585707063395956,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3616 /prefetch:1
                                                                                                                                                                                    6⤵
                                                                                                                                                                                      PID:3596
                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1496,11148390497762771180,2235585707063395956,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
                                                                                                                                                                                      6⤵
                                                                                                                                                                                        PID:2056
                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1496,11148390497762771180,2235585707063395956,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3920 /prefetch:1
                                                                                                                                                                                        6⤵
                                                                                                                                                                                          PID:5196
                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1496,11148390497762771180,2235585707063395956,131072 --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=3932 /prefetch:8
                                                                                                                                                                                          6⤵
                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                          PID:6012
                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1496,11148390497762771180,2235585707063395956,131072 --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=5688 /prefetch:8
                                                                                                                                                                                          6⤵
                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                          PID:6084
                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1496,11148390497762771180,2235585707063395956,131072 --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=2408 /prefetch:8
                                                                                                                                                                                          6⤵
                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                          PID:5456
                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1496,11148390497762771180,2235585707063395956,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=5196 /prefetch:8
                                                                                                                                                                                          6⤵
                                                                                                                                                                                            PID:5208
                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1496,11148390497762771180,2235585707063395956,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=5664 /prefetch:8
                                                                                                                                                                                            6⤵
                                                                                                                                                                                              PID:5880
                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1496,11148390497762771180,2235585707063395956,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=4212 /prefetch:8
                                                                                                                                                                                              6⤵
                                                                                                                                                                                                PID:5232
                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1496,11148390497762771180,2235585707063395956,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=5784 /prefetch:8
                                                                                                                                                                                                6⤵
                                                                                                                                                                                                  PID:5300
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\SwReporter\89.259.200\software_reporter_tool.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\SwReporter\89.259.200\software_reporter_tool.exe" --engine=2 --scan-locations=1,2,3,4,5,6,7,8,10 --disabled-locations=9,11 --session-id=+yX8xpFLW0I8/qKjZXF5gGefediYOxEfentFdwKk --registry-suffix=ESET --srt-field-trial-group-name=NewCleanerUIExperiment
                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                  PID:6024
                                                                                                                                                                                                  • \??\c:\users\admin\appdata\local\temp\cghjgasaaz99\swreporter\89.259.200\software_reporter_tool.exe
                                                                                                                                                                                                    c:\users\admin\appdata\local\temp\cghjgasaaz99\swreporter\89.259.200\software_reporter_tool.exe --crash-handler "--database=c:\users\admin\appdata\local\Google\Software Reporter Tool" --url=https://clients2.google.com/cr/report --annotation=plat=Win32 --annotation=prod=ChromeFoil --annotation=ver=89.259.200 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff6fe93ac28,0x7ff6fe93ac38,0x7ff6fe93ac48
                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    PID:6012
                                                                                                                                                                                                  • \??\c:\users\admin\appdata\local\temp\cghjgasaaz99\swreporter\89.259.200\software_reporter_tool.exe
                                                                                                                                                                                                    "c:\users\admin\appdata\local\temp\cghjgasaaz99\swreporter\89.259.200\software_reporter_tool.exe" --use-crash-handler-with-id="\\.\pipe\crashpad_6024_AXAVJTFAQAAQYLNC" --sandboxed-process-id=2 --init-done-notifier=716 --sandbox-mojo-pipe-token=15379960110857312548 --mojo-platform-channel-handle=692 --engine=2
                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                                    PID:4744
                                                                                                                                                                                                  • \??\c:\users\admin\appdata\local\temp\cghjgasaaz99\swreporter\89.259.200\software_reporter_tool.exe
                                                                                                                                                                                                    "c:\users\admin\appdata\local\temp\cghjgasaaz99\swreporter\89.259.200\software_reporter_tool.exe" --use-crash-handler-with-id="\\.\pipe\crashpad_6024_AXAVJTFAQAAQYLNC" --sandboxed-process-id=3 --init-done-notifier=920 --sandbox-mojo-pipe-token=9163418643414014949 --mojo-platform-channel-handle=916
                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    PID:4704
                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1496,11148390497762771180,2235585707063395956,131072 --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=2384 /prefetch:8
                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                  PID:5740
                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1496,11148390497762771180,2235585707063395956,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1372 /prefetch:2
                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                  PID:4912
                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1496,11148390497762771180,2235585707063395956,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=5196 /prefetch:8
                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                    PID:1812
                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1496,11148390497762771180,2235585707063395956,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=2492 /prefetch:8
                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                      PID:3228
                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1496,11148390497762771180,2235585707063395956,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=2408 /prefetch:8
                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                        PID:4128
                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1496,11148390497762771180,2235585707063395956,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=5804 /prefetch:8
                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                          PID:4560
                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1496,11148390497762771180,2235585707063395956,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=2496 /prefetch:8
                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                            PID:4796
                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1496,11148390497762771180,2235585707063395956,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=2492 /prefetch:8
                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                              PID:5060
                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1496,11148390497762771180,2235585707063395956,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=2404 /prefetch:8
                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                PID:1336
                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1496,11148390497762771180,2235585707063395956,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=1672 /prefetch:8
                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                  PID:5208
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"
                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              PID:5204
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe" >> NUL
                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                  PID:5544
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                                                                                    ping 127.0.0.1
                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                    • Runs ping.exe
                                                                                                                                                                                                                    PID:5608
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe"
                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                • Checks whether UAC is enabled
                                                                                                                                                                                                                PID:5572
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\RarSFX1\BTRSetp.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\RarSFX1\BTRSetp.exe"
                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                PID:5608
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\RarSFX1\gcttt.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\RarSFX1\gcttt.exe"
                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                PID:5920
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  PID:5932
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                  PID:6048
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                  PID:4392
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                  PID:2956
                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                          • Modifies Internet Explorer settings
                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                          PID:5016
                                                                                                                                                                                                        • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                          C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                          • Modifies Internet Explorer settings
                                                                                                                                                                                                          PID:5092
                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                          • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                          PID:4748
                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                          • Modifies Internet Explorer settings
                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                          PID:4684
                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                          PID:5900
                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                          PID:5568
                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                          PID:5344
                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                            PID:4980
                                                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                            PID:5840
                                                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                              PID:6028
                                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                              PID:5460
                                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                              PID:1600

                                                                                                                                                                                                            Network

                                                                                                                                                                                                            MITRE ATT&CK Matrix ATT&CK v6

                                                                                                                                                                                                            Persistence

                                                                                                                                                                                                            Registry Run Keys / Startup Folder

                                                                                                                                                                                                            1
                                                                                                                                                                                                            T1060

                                                                                                                                                                                                            Defense Evasion

                                                                                                                                                                                                            Modify Registry

                                                                                                                                                                                                            3
                                                                                                                                                                                                            T1112

                                                                                                                                                                                                            Install Root Certificate

                                                                                                                                                                                                            1
                                                                                                                                                                                                            T1130

                                                                                                                                                                                                            Credential Access

                                                                                                                                                                                                            Credentials in Files

                                                                                                                                                                                                            2
                                                                                                                                                                                                            T1081

                                                                                                                                                                                                            Discovery

                                                                                                                                                                                                            Query Registry

                                                                                                                                                                                                            4
                                                                                                                                                                                                            T1012

                                                                                                                                                                                                            System Information Discovery

                                                                                                                                                                                                            5
                                                                                                                                                                                                            T1082

                                                                                                                                                                                                            Remote System Discovery

                                                                                                                                                                                                            1
                                                                                                                                                                                                            T1018

                                                                                                                                                                                                            Collection

                                                                                                                                                                                                            Data from Local System

                                                                                                                                                                                                            2
                                                                                                                                                                                                            T1005

                                                                                                                                                                                                            Command and Control

                                                                                                                                                                                                            Web Service

                                                                                                                                                                                                            1
                                                                                                                                                                                                            T1102

                                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                                            Downloads

                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              05c4e7b85724c314df9e6730d2b61ca2

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              b0397525b6285065865389bd032bbd1bdb05aea2

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              1ba99b39ed3c2576791c65d421dd6aa04bb7f0e0879423033b925d069f3fe4ad

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              040f678415ac98a4b3bca5eb40a0b2890caea110393a738fa4006365b2933f107f6a9afa05cba1104f4c009e76c6ff0100f0a3758150cd53b534f0708c69fe67

                                                                                                                                                                                                            • \??\pipe\crashpad_4844_BSDTBIEGMVZOPDAG
                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              d41d8cd98f00b204e9800998ecf8427e

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                                                                                                                                            • \??\pipe\crashpad_640_UYQPFVDIABQVPHTF
                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              d41d8cd98f00b204e9800998ecf8427e

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                                                                                                                                            • memory/352-267-0x000001F963240000-0x000001F9632A7000-memory.dmp
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              412KB

                                                                                                                                                                                                            • memory/792-215-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                            • memory/1012-253-0x000001DDCAF40000-0x000001DDCAF84000-memory.dmp
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              272KB

                                                                                                                                                                                                            • memory/1012-255-0x000001DDCB100000-0x000001DDCB167000-memory.dmp
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              412KB

                                                                                                                                                                                                            • memory/1064-275-0x000001B747B10000-0x000001B747B77000-memory.dmp
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              412KB

                                                                                                                                                                                                            • memory/1084-265-0x000001C38A0B0000-0x000001C38A117000-memory.dmp
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              412KB

                                                                                                                                                                                                            • memory/1084-281-0x000001C38BB30000-0x000001C38BC35000-memory.dmp
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              1.0MB

                                                                                                                                                                                                            • memory/1148-273-0x000001EB44680000-0x000001EB446E7000-memory.dmp
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              412KB

                                                                                                                                                                                                            • memory/1264-135-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                            • memory/1288-280-0x0000027BB06A0000-0x0000027BB0707000-memory.dmp
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              412KB

                                                                                                                                                                                                            • memory/1312-145-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                            • memory/1396-257-0x000001F47A300000-0x000001F47A367000-memory.dmp
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              412KB

                                                                                                                                                                                                            • memory/1456-277-0x00000297D0190000-0x00000297D01F7000-memory.dmp
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              412KB

                                                                                                                                                                                                            • memory/1484-228-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                            • memory/1528-116-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                            • memory/1624-123-0x00007FFDDECF0000-0x00007FFDDECF1000-memory.dmp
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              4KB

                                                                                                                                                                                                            • memory/1624-121-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                            • memory/1864-279-0x000002B3A9F80000-0x000002B3A9FE7000-memory.dmp
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              412KB

                                                                                                                                                                                                            • memory/2176-156-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                            • memory/2272-269-0x000001A2C5780000-0x000001A2C57E7000-memory.dmp
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              412KB

                                                                                                                                                                                                            • memory/2320-271-0x0000016250BD0000-0x0000016250C37000-memory.dmp
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              412KB

                                                                                                                                                                                                            • memory/2428-259-0x0000029E4CC30000-0x0000029E4CC97000-memory.dmp
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              412KB

                                                                                                                                                                                                            • memory/2436-261-0x0000026CBD570000-0x0000026CBD5D7000-memory.dmp
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              412KB

                                                                                                                                                                                                            • memory/2524-247-0x0000000000400000-0x0000000000443000-memory.dmp
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              268KB

                                                                                                                                                                                                            • memory/2656-264-0x000001C2C16D0000-0x000001C2C1737000-memory.dmp
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              412KB

                                                                                                                                                                                                            • memory/2680-241-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                            • memory/2680-150-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                            • memory/3100-138-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                            • memory/3108-248-0x00000000001E0000-0x00000000001E1000-memory.dmp
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              4KB

                                                                                                                                                                                                            • memory/3260-240-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                            • memory/3620-234-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                            • memory/3740-126-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                            • memory/3832-122-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                            • memory/3976-163-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                            • memory/3984-246-0x00000000028D0000-0x0000000002A6C000-memory.dmp
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                            • memory/4108-242-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                            • memory/4120-239-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                            • memory/4120-177-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                            • memory/4136-227-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                            • memory/4180-252-0x0000000000400000-0x0000000000A5C000-memory.dmp
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              6.4MB

                                                                                                                                                                                                            • memory/4180-250-0x0000000002680000-0x0000000002711000-memory.dmp
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              580KB

                                                                                                                                                                                                            • memory/4256-249-0x00000000045B0000-0x00000000045EA000-memory.dmp
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              232KB

                                                                                                                                                                                                            • memory/4256-251-0x0000000004640000-0x0000000004696000-memory.dmp
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              344KB

                                                                                                                                                                                                            • memory/4280-238-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                            • memory/4312-181-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                            • memory/4320-235-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                            • memory/4432-232-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                            • memory/4516-187-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                            • memory/4528-214-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                            • memory/4536-226-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                            • memory/4544-192-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                            • memory/4544-217-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                            • memory/4588-194-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                            • memory/4588-218-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                            • memory/4604-216-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                            • memory/4624-195-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                            • memory/4644-236-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                            • memory/4652-237-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                            • memory/4688-196-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                            • memory/4692-231-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                            • memory/4696-230-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                            • memory/4700-197-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                            • memory/4712-219-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                            • memory/4732-220-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                            • memory/4736-198-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                            • memory/4744-297-0x0000026E01810000-0x0000026E01811000-memory.dmp
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              4KB

                                                                                                                                                                                                            • memory/4744-303-0x0000026E00EF0000-0x0000026E00F30000-memory.dmp
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              256KB

                                                                                                                                                                                                            • memory/4744-302-0x0000026E00EF0000-0x0000026E00EF1000-memory.dmp
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              4KB

                                                                                                                                                                                                            • memory/4744-300-0x0000026E01810000-0x0000026E01850000-memory.dmp
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              256KB

                                                                                                                                                                                                            • memory/4744-299-0x0000026E01850000-0x0000026E01890000-memory.dmp
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              256KB

                                                                                                                                                                                                            • memory/4744-288-0x0000026E00F30000-0x0000026E00F31000-memory.dmp
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              4KB

                                                                                                                                                                                                            • memory/4744-298-0x0000026E01810000-0x0000026E01850000-memory.dmp
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              256KB

                                                                                                                                                                                                            • memory/4744-296-0x0000026E02A50000-0x0000026E02A90000-memory.dmp
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              256KB

                                                                                                                                                                                                            • memory/4744-292-0x0000026E02F30000-0x0000026E02F31000-memory.dmp
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              4KB

                                                                                                                                                                                                            • memory/4744-295-0x0000026E02900000-0x0000026E02940000-memory.dmp
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              256KB

                                                                                                                                                                                                            • memory/4744-294-0x0000026E02F70000-0x0000026E02FB0000-memory.dmp
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              256KB

                                                                                                                                                                                                            • memory/4744-293-0x0000026E02F30000-0x0000026E02F70000-memory.dmp
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              256KB

                                                                                                                                                                                                            • memory/4744-291-0x0000026E00F30000-0x0000026E00F70000-memory.dmp
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              256KB

                                                                                                                                                                                                            • memory/4744-287-0x0000026E00F30000-0x0000026E00F70000-memory.dmp
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              256KB

                                                                                                                                                                                                            • memory/4744-290-0x0000026E00F30000-0x0000026E00F31000-memory.dmp
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              4KB

                                                                                                                                                                                                            • memory/4744-301-0x0000026E01850000-0x0000026E01890000-memory.dmp
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              256KB

                                                                                                                                                                                                            • memory/4744-286-0x0000026E00F30000-0x0000026E00F31000-memory.dmp
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              4KB

                                                                                                                                                                                                            • memory/4744-284-0x0000026E01810000-0x0000026E01850000-memory.dmp
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              256KB

                                                                                                                                                                                                            • memory/4744-285-0x0000026E00F00000-0x0000026E00F01000-memory.dmp
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              4KB

                                                                                                                                                                                                            • memory/4744-305-0x0000026E00EF0000-0x0000026E00F30000-memory.dmp
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              256KB

                                                                                                                                                                                                            • memory/4744-304-0x0000026E00EF0000-0x0000026E00EF1000-memory.dmp
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              4KB

                                                                                                                                                                                                            • memory/4744-306-0x0000026E00EF0000-0x0000026E00EF1000-memory.dmp
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              4KB

                                                                                                                                                                                                            • memory/4744-307-0x0000026E00EF0000-0x0000026E00F30000-memory.dmp
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              256KB

                                                                                                                                                                                                            • memory/4744-308-0x0000026E01810000-0x0000026E01850000-memory.dmp
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              256KB

                                                                                                                                                                                                            • memory/4744-289-0x0000026E00F30000-0x0000026E00F70000-memory.dmp
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              256KB

                                                                                                                                                                                                            • memory/4744-283-0x0000026E01810000-0x0000026E01850000-memory.dmp
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              256KB

                                                                                                                                                                                                            • memory/4748-222-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                            • memory/4772-199-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                            • memory/4784-221-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                            • memory/4808-200-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                            • memory/4844-201-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                            • memory/4856-224-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                            • memory/4864-202-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                            • memory/4872-223-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                            • memory/4912-233-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                            • memory/4944-204-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                            • memory/4956-205-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                            • memory/4964-243-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                            • memory/4968-206-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                            • memory/4980-207-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                            • memory/4992-208-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                            • memory/4996-229-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                            • memory/5004-209-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                            • memory/5020-210-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                            • memory/5028-244-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                            • memory/5032-211-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                            • memory/5040-245-0x000000001BB30000-0x000000001BB32000-memory.dmp
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              8KB

                                                                                                                                                                                                            • memory/5064-212-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                            • memory/5072-225-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                            • memory/5084-213-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                            • memory/5608-282-0x000000001B970000-0x000000001B972000-memory.dmp
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              8KB