bazarloader | hxxps://officesupply[.]com

Analysis

max time kernel
757s
max time network
759s
platform
windows10_x64
resource
win10-en-20210920
submitted
05-10-2021 20:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://officesupply.com
Sample

211005-ystnmsafbp

Score

10^/10

bazarloader dropper loader spyware stealer suricata

Malware Config

Signatures

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader
Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

Processes:

2.exe1.exe

description pid process target process

PID 4384 created 1776 4384 2.exe chrome.exe
PID 1512 created 1776 1512 1.exe chrome.exe
suricata: ET MALWARE BazaLoader Activity (GET)
suricata: ET MALWARE BazaLoader Activity (GET)
suricata

description	pid	process	target process
PID 4384 created 1776	4384	2.exe	chrome.exe
PID 1512 created 1776	1512	1.exe	chrome.exe

Bazar/Team9 Loader payload 7 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1560-387-0x0000000002440000-0x000000000246F000-memory.dmp	BazarLoaderVar5
behavioral1/memory/1360-388-0x0000000003050000-0x000000000307F000-memory.dmp	BazarLoaderVar5
behavioral1/memory/1560-394-0x0000000002410000-0x0000000002437000-memory.dmp	BazarLoaderVar5
behavioral1/memory/4912-405-0x0000000002890000-0x00000000028BF000-memory.dmp	BazarLoaderVar5
behavioral1/memory/4384-404-0x0000000002FA0000-0x0000000002FCF000-memory.dmp	BazarLoaderVar5
behavioral1/memory/4256-468-0x000002DAE85B0000-0x000002DAE88C2000-memory.dmp	BazarLoaderVar5
behavioral1/memory/4488-528-0x000001BF37BC0000-0x000001BF37ED2000-memory.dmp	BazarLoaderVar5

Executes dropped EXE 24 IoCs

Processes:

code.execode.tmp1.exe2.exe1.exe2.execode.execode.tmpcode.execode.tmpcode.execode.tmp1.exe2.exe1.exe2.exe2.exe2.execode.execode.tmpsoftware_reporter_tool.exesoftware_reporter_tool.exesoftware_reporter_tool.exesoftware_reporter_tool.exe

pid	process
4984	code.exe
5092	code.tmp
1360	1.exe
1560	2.exe
4912	1.exe
4384	2.exe
2112	code.exe
2560	code.tmp
4876	code.exe
4924	code.tmp
2004	code.exe
1372	code.tmp
1768	1.exe
588	2.exe
1512	1.exe
4508	2.exe
3936	2.exe
1212	2.exe
2904	code.exe
1880	code.tmp
2504	software_reporter_tool.exe
1060	software_reporter_tool.exe
3860	software_reporter_tool.exe
4904	software_reporter_tool.exe

Tries to connect to .bazar domain 64 IoCs

Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.

Processes:

flow	ioc
1155	lieluhem.bazar
1280	ypcawyom.bazar
1171	iqekekom.bazar
1179	biewuhed.bazar
277	reddew28c.bazar
343	reddew28c.bazar
344	reddew28c.bazar
386	whitestorm9p.bazar
632	aquheked.bazar
1138	fuacided.bazar
1520	exwyided.bazar
886	fuuhwyyw.bazar
1305	vuibekyw.bazar
1595	ufemwyed.bazar
1696	tutouhyw.bazar
1795	excauhom.bazar
433	bluehail.bazar
445	whitestorm9p.bazar
1019	huudekom.bazar
1494	ydywidyw.bazar
1556	vueduhed.bazar
1593	yponidem.bazar
625	aquheked.bazar
628	aquheked.bazar
1228	ydidekem.bazar
1273	huwyidem.bazar
1614	izsoekyw.bazar
1800	ydibeked.bazar
1808	ydibeked.bazar
361	bluehail.bazar
507	ehcaekem.bazar
1045	ufcawyem.bazar
1150	lieluhem.bazar
1313	izeduhem.bazar
1527	exwyided.bazar
1590	yponidem.bazar
581	lionwyed.bazar
646	owacidyw.bazar
932	ydewuhom.bazar
982	agidided.bazar
1200	aqtowyem.bazar
1442	futowyom.bazar
1285	ypcawyom.bazar
1470	iqcuuhem.bazar
1688	tutouhyw.bazar
1823	vuqewyom.bazar
564	fuqeidem.bazar
616	fusouhem.bazar
645	owacidyw.bazar
1334	ufonidyw.bazar
617	fusouhem.bazar
1108	ehemeked.bazar
267	reddew28c.bazar
381	whitestorm9p.bazar
446	whitestorm9p.bazar
452	whitestorm9p.bazar
544	tuedwyyw.bazar
608	fusouhem.bazar
1111	tysoidem.bazar
1168	iqekekom.bazar
423	reddew28c.bazar
426	reddew28c.bazar
427	bluehail.bazar
967	exomidem.bazar

Loads dropped DLL 7 IoCs

Processes:

software_reporter_tool.exe

pid	process
3860	software_reporter_tool.exe
3860	software_reporter_tool.exe
3860	software_reporter_tool.exe
3860	software_reporter_tool.exe
3860	software_reporter_tool.exe
3860	software_reporter_tool.exe
3860	software_reporter_tool.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of SetThreadContext 2 IoCs

Processes:

2.exe1.exe

description pid process target process

PID 4384 set thread context of 4256 4384 2.exe chrome.exe
PID 1512 set thread context of 4488 1512 1.exe chrome.exe

description	pid	process	target process
PID 4384 set thread context of 4256	4384	2.exe	chrome.exe
PID 1512 set thread context of 4488	1512	1.exe	chrome.exe

Drops file in Program Files directory 7 IoCs

Processes:

code.tmpcode.tmpcode.tmpcode.tmpcode.tmp

description	ioc	process
File opened for modification	C:\Program Files (x86)\cnBbOPfhTduj\1.exe	code.tmp
File created	C:\Program Files (x86)\cnBbOPfhTduj\is-VE854.tmp	code.tmp
File opened for modification	C:\Program Files (x86)\cnBbOPfhTduj\1.exe	code.tmp
File opened for modification	C:\Program Files (x86)\cnBbOPfhTduj\1.exe	code.tmp
File opened for modification	C:\Program Files (x86)\cnBbOPfhTduj\1.exe	code.tmp
File created	C:\Program Files (x86)\cnBbOPfhTduj\is-B4G78.tmp	code.tmp
File opened for modification	C:\Program Files (x86)\cnBbOPfhTduj\1.exe	code.tmp

Drops file in Windows directory 6 IoCs

Processes:

taskmgr.exetaskmgr.exetaskmgr.exe

description	ioc	process
File created	C:\Windows\rescache\_merged\1601268389\3068621934.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\4183903823\1195458082.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\1601268389\3068621934.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\4183903823\1195458082.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\1601268389\3068621934.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\4183903823\1195458082.pri	taskmgr.exe

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exetaskmgr.exetaskmgr.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exefirefox.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies registry class 1 IoCs

Processes:

chrome.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

chrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.execode.tmpchrome.execode.tmpcode.tmptaskmgr.exe2.execode.tmp

pid	process
3428	chrome.exe
3428	chrome.exe
1776	chrome.exe
1776	chrome.exe
4712	chrome.exe
4712	chrome.exe
5100	chrome.exe
5100	chrome.exe
4520	chrome.exe
4520	chrome.exe
4628	chrome.exe
4628	chrome.exe
4788	chrome.exe
4788	chrome.exe
428	chrome.exe
428	chrome.exe
428	chrome.exe
428	chrome.exe
4468	chrome.exe
4468	chrome.exe
3480	chrome.exe
3480	chrome.exe
4928	chrome.exe
4928	chrome.exe
5092	code.tmp
5092	code.tmp
4488	chrome.exe
4488	chrome.exe
2560	code.tmp
2560	code.tmp
2560	code.tmp
2560	code.tmp
2560	code.tmp
2560	code.tmp
2560	code.tmp
2560	code.tmp
2560	code.tmp
2560	code.tmp
2560	code.tmp
2560	code.tmp
4924	code.tmp
4924	code.tmp
4924	code.tmp
4924	code.tmp
4924	code.tmp
4924	code.tmp
4924	code.tmp
4924	code.tmp
4924	code.tmp
4924	code.tmp
4924	code.tmp
4924	code.tmp
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4384	2.exe
4384	2.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
1372	code.tmp

Suspicious use of AdjustPrivilegeToken 23 IoCs

Processes:

taskmgr.exetaskmgr.exetaskmgr.exesoftware_reporter_tool.exesoftware_reporter_tool.exesoftware_reporter_tool.exesoftware_reporter_tool.exe

description	pid	process
Token: SeDebugPrivilege	4764	taskmgr.exe
Token: SeSystemProfilePrivilege	4764	taskmgr.exe
Token: SeCreateGlobalPrivilege	4764	taskmgr.exe
Token: 33	4764	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4764	taskmgr.exe
Token: SeDebugPrivilege	4904	taskmgr.exe
Token: SeSystemProfilePrivilege	4904	taskmgr.exe
Token: SeCreateGlobalPrivilege	4904	taskmgr.exe
Token: 33	4904	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4904	taskmgr.exe
Token: SeDebugPrivilege	4308	taskmgr.exe
Token: SeSystemProfilePrivilege	4308	taskmgr.exe
Token: SeCreateGlobalPrivilege	4308	taskmgr.exe
Token: 33	4308	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4308	taskmgr.exe
Token: 33	1060	software_reporter_tool.exe
Token: SeIncBasePriorityPrivilege	1060	software_reporter_tool.exe
Token: 33	2504	software_reporter_tool.exe
Token: SeIncBasePriorityPrivilege	2504	software_reporter_tool.exe
Token: 33	3860	software_reporter_tool.exe
Token: SeIncBasePriorityPrivilege	3860	software_reporter_tool.exe
Token: 33	4904	software_reporter_tool.exe
Token: SeIncBasePriorityPrivilege	4904	software_reporter_tool.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

chrome.execode.tmpcode.tmpcode.tmptaskmgr.exe

pid	process
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
5092	code.tmp
4924	code.tmp
2560	code.tmp
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

chrome.exetaskmgr.exetaskmgr.exe

pid	process
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe

Suspicious use of SetWindowsHookEx 21 IoCs

Processes:

1.exe2.exe1.exe2.exe2.exe1.exe1.exe2.exe2.exe2.exefirefox.exe

pid	process
1360	1.exe
1360	1.exe
1560	2.exe
1560	2.exe
4912	1.exe
4912	1.exe
4384	2.exe
4384	2.exe
588	2.exe
1768	1.exe
1768	1.exe
588	2.exe
1512	1.exe
1512	1.exe
4508	2.exe
4508	2.exe
3936	2.exe
3936	2.exe
1212	2.exe
1212	2.exe
5048	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 1776 wrote to memory of 2276	1776	chrome.exe	chrome.exe
PID 1776 wrote to memory of 2276	1776	chrome.exe	chrome.exe
PID 1776 wrote to memory of 3508	1776	chrome.exe	chrome.exe
PID 1776 wrote to memory of 3508	1776	chrome.exe	chrome.exe
PID 1776 wrote to memory of 3508	1776	chrome.exe	chrome.exe
PID 1776 wrote to memory of 3508	1776	chrome.exe	chrome.exe
PID 1776 wrote to memory of 3508	1776	chrome.exe	chrome.exe
PID 1776 wrote to memory of 3508	1776	chrome.exe	chrome.exe
PID 1776 wrote to memory of 3508	1776	chrome.exe	chrome.exe
PID 1776 wrote to memory of 3508	1776	chrome.exe	chrome.exe
PID 1776 wrote to memory of 3508	1776	chrome.exe	chrome.exe
PID 1776 wrote to memory of 3508	1776	chrome.exe	chrome.exe
PID 1776 wrote to memory of 3508	1776	chrome.exe	chrome.exe
PID 1776 wrote to memory of 3508	1776	chrome.exe	chrome.exe
PID 1776 wrote to memory of 3508	1776	chrome.exe	chrome.exe
PID 1776 wrote to memory of 3508	1776	chrome.exe	chrome.exe
PID 1776 wrote to memory of 3508	1776	chrome.exe	chrome.exe
PID 1776 wrote to memory of 3508	1776	chrome.exe	chrome.exe
PID 1776 wrote to memory of 3508	1776	chrome.exe	chrome.exe
PID 1776 wrote to memory of 3508	1776	chrome.exe	chrome.exe
PID 1776 wrote to memory of 3508	1776	chrome.exe	chrome.exe
PID 1776 wrote to memory of 3508	1776	chrome.exe	chrome.exe
PID 1776 wrote to memory of 3508	1776	chrome.exe	chrome.exe
PID 1776 wrote to memory of 3508	1776	chrome.exe	chrome.exe
PID 1776 wrote to memory of 3508	1776	chrome.exe	chrome.exe
PID 1776 wrote to memory of 3508	1776	chrome.exe	chrome.exe
PID 1776 wrote to memory of 3508	1776	chrome.exe	chrome.exe
PID 1776 wrote to memory of 3508	1776	chrome.exe	chrome.exe
PID 1776 wrote to memory of 3508	1776	chrome.exe	chrome.exe
PID 1776 wrote to memory of 3508	1776	chrome.exe	chrome.exe
PID 1776 wrote to memory of 3508	1776	chrome.exe	chrome.exe
PID 1776 wrote to memory of 3508	1776	chrome.exe	chrome.exe
PID 1776 wrote to memory of 3508	1776	chrome.exe	chrome.exe
PID 1776 wrote to memory of 3508	1776	chrome.exe	chrome.exe
PID 1776 wrote to memory of 3508	1776	chrome.exe	chrome.exe
PID 1776 wrote to memory of 3508	1776	chrome.exe	chrome.exe
PID 1776 wrote to memory of 3508	1776	chrome.exe	chrome.exe
PID 1776 wrote to memory of 3508	1776	chrome.exe	chrome.exe
PID 1776 wrote to memory of 3508	1776	chrome.exe	chrome.exe
PID 1776 wrote to memory of 3508	1776	chrome.exe	chrome.exe
PID 1776 wrote to memory of 3508	1776	chrome.exe	chrome.exe
PID 1776 wrote to memory of 3508	1776	chrome.exe	chrome.exe
PID 1776 wrote to memory of 3428	1776	chrome.exe	chrome.exe
PID 1776 wrote to memory of 3428	1776	chrome.exe	chrome.exe
PID 1776 wrote to memory of 1604	1776	chrome.exe	chrome.exe
PID 1776 wrote to memory of 1604	1776	chrome.exe	chrome.exe
PID 1776 wrote to memory of 1604	1776	chrome.exe	chrome.exe
PID 1776 wrote to memory of 1604	1776	chrome.exe	chrome.exe
PID 1776 wrote to memory of 1604	1776	chrome.exe	chrome.exe
PID 1776 wrote to memory of 1604	1776	chrome.exe	chrome.exe
PID 1776 wrote to memory of 1604	1776	chrome.exe	chrome.exe
PID 1776 wrote to memory of 1604	1776	chrome.exe	chrome.exe
PID 1776 wrote to memory of 1604	1776	chrome.exe	chrome.exe
PID 1776 wrote to memory of 1604	1776	chrome.exe	chrome.exe
PID 1776 wrote to memory of 1604	1776	chrome.exe	chrome.exe
PID 1776 wrote to memory of 1604	1776	chrome.exe	chrome.exe
PID 1776 wrote to memory of 1604	1776	chrome.exe	chrome.exe
PID 1776 wrote to memory of 1604	1776	chrome.exe	chrome.exe
PID 1776 wrote to memory of 1604	1776	chrome.exe	chrome.exe
PID 1776 wrote to memory of 1604	1776	chrome.exe	chrome.exe
PID 1776 wrote to memory of 1604	1776	chrome.exe	chrome.exe
PID 1776 wrote to memory of 1604	1776	chrome.exe	chrome.exe
PID 1776 wrote to memory of 1604	1776	chrome.exe	chrome.exe
PID 1776 wrote to memory of 1604	1776	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" https://officesupply.com
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1776

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff956754f50,0x7ff956754f60,0x7ff956754f70
2⤵
PID:2276

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1620,16105802508085216699,1284644030841180805,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1640 /prefetch:2
2⤵
PID:3508

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1620,16105802508085216699,1284644030841180805,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1688 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3428

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1620,16105802508085216699,1284644030841180805,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2168 /prefetch:8
2⤵
PID:1604

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,16105802508085216699,1284644030841180805,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2912 /prefetch:1
2⤵
PID:1012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,16105802508085216699,1284644030841180805,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2920 /prefetch:1
2⤵
PID:1972

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,16105802508085216699,1284644030841180805,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4152 /prefetch:8
2⤵
PID:1560

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,16105802508085216699,1284644030841180805,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4340 /prefetch:1
2⤵
PID:508

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,16105802508085216699,1284644030841180805,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4228 /prefetch:1
2⤵
PID:656

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,16105802508085216699,1284644030841180805,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4188 /prefetch:1
2⤵
PID:2640

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,16105802508085216699,1284644030841180805,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5244 /prefetch:8
2⤵
PID:1544

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,16105802508085216699,1284644030841180805,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5352 /prefetch:8
2⤵
PID:4108

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,16105802508085216699,1284644030841180805,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
2⤵
PID:4196

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,16105802508085216699,1284644030841180805,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
2⤵
PID:4284

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,16105802508085216699,1284644030841180805,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
2⤵
PID:4368

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,16105802508085216699,1284644030841180805,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6192 /prefetch:8
2⤵
PID:4452

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,16105802508085216699,1284644030841180805,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6224 /prefetch:1
2⤵
PID:4512

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,16105802508085216699,1284644030841180805,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6724 /prefetch:8
2⤵
PID:4608

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,16105802508085216699,1284644030841180805,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6864 /prefetch:8
2⤵
PID:4660

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,16105802508085216699,1284644030841180805,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6720 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4712

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,16105802508085216699,1284644030841180805,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6716 /prefetch:8
2⤵
PID:4724

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,16105802508085216699,1284644030841180805,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6900 /prefetch:8
2⤵
PID:4812

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,16105802508085216699,1284644030841180805,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7004 /prefetch:8
2⤵
PID:4864

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,16105802508085216699,1284644030841180805,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6996 /prefetch:8
2⤵
PID:4916

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,16105802508085216699,1284644030841180805,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6176 /prefetch:8
2⤵
PID:4968

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,16105802508085216699,1284644030841180805,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6180 /prefetch:8
2⤵
PID:5020

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,16105802508085216699,1284644030841180805,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
2⤵
PID:5072

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,16105802508085216699,1284644030841180805,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5984 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5100

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,16105802508085216699,1284644030841180805,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
2⤵
PID:4340

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,16105802508085216699,1284644030841180805,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2936 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4520

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,16105802508085216699,1284644030841180805,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2980 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4628

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,16105802508085216699,1284644030841180805,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=772 /prefetch:8
2⤵
PID:4640

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,16105802508085216699,1284644030841180805,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1624 /prefetch:8
2⤵
PID:4732

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,16105802508085216699,1284644030841180805,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6968 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4788

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,16105802508085216699,1284644030841180805,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1460 /prefetch:8
2⤵
PID:4816

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,16105802508085216699,1284644030841180805,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4400 /prefetch:8
2⤵
PID:5024

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,16105802508085216699,1284644030841180805,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
2⤵
PID:5112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,16105802508085216699,1284644030841180805,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4228 /prefetch:8
2⤵
PID:4412

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,16105802508085216699,1284644030841180805,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4260 /prefetch:8
2⤵
PID:4768

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,16105802508085216699,1284644030841180805,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7160 /prefetch:8
2⤵
PID:4136

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1620,16105802508085216699,1284644030841180805,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1632 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:428

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,16105802508085216699,1284644030841180805,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6888 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4468

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1620,16105802508085216699,1284644030841180805,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6804 /prefetch:8
2⤵
PID:380

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1620,16105802508085216699,1284644030841180805,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5152 /prefetch:8
2⤵
PID:1884

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,16105802508085216699,1284644030841180805,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5628 /prefetch:8
2⤵
PID:4668

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1620,16105802508085216699,1284644030841180805,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4220 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3480

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1620,16105802508085216699,1284644030841180805,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5148 /prefetch:8
2⤵
PID:4828

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1620,16105802508085216699,1284644030841180805,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5072 /prefetch:8
2⤵
PID:4720

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,16105802508085216699,1284644030841180805,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4244 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4928

C:\Users\Admin\Downloads\code.exe
"C:\Users\Admin\Downloads\code.exe"
2⤵
- Executes dropped EXE
PID:4984

C:\Users\Admin\AppData\Local\Temp\is-MF21N.tmp\code.tmp
"C:\Users\Admin\AppData\Local\Temp\is-MF21N.tmp\code.tmp" /SL5="$C0048,1549918,785408,C:\Users\Admin\Downloads\code.exe"
3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:5092

C:\Program Files (x86)\cnBbOPfhTduj\1.exe
"C:\Program Files (x86)\cnBbOPfhTduj\1.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1360

C:\Program Files (x86)\cnBbOPfhTduj\1.exe
"C:\Program Files (x86)\cnBbOPfhTduj\1.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4912

C:\cnBbOPfhTdujcnBbOPfhTduj\2.exe
"C:\cnBbOPfhTdujcnBbOPfhTduj\2.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1560

C:\cnBbOPfhTdujcnBbOPfhTduj\2.exe
"C:\cnBbOPfhTdujcnBbOPfhTduj\2.exe"
5⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4384

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,16105802508085216699,1284644030841180805,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4608 /prefetch:8
2⤵
PID:4796

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,16105802508085216699,1284644030841180805,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5108 /prefetch:8
2⤵
PID:4216

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,16105802508085216699,1284644030841180805,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1428 /prefetch:1
2⤵
PID:4108

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,16105802508085216699,1284644030841180805,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2856 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4488

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,16105802508085216699,1284644030841180805,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4660 /prefetch:8
2⤵
PID:4932

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,16105802508085216699,1284644030841180805,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6744 /prefetch:8
2⤵
PID:5064

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,16105802508085216699,1284644030841180805,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4380 /prefetch:8
2⤵
PID:376

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,16105802508085216699,1284644030841180805,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4704 /prefetch:8
2⤵
PID:4308

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
2⤵
PID:4256

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,16105802508085216699,1284644030841180805,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6088 /prefetch:8
2⤵
PID:380

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,16105802508085216699,1284644030841180805,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3012 /prefetch:8
2⤵
PID:1680

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,16105802508085216699,1284644030841180805,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5496 /prefetch:8
2⤵
PID:4796

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,16105802508085216699,1284644030841180805,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1360 /prefetch:8
2⤵
PID:4364

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
2⤵
PID:4488

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,16105802508085216699,1284644030841180805,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6928 /prefetch:8
2⤵
PID:4508

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,16105802508085216699,1284644030841180805,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3132 /prefetch:8
2⤵
PID:4868

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\93.269.200\software_reporter_tool.exe
"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\93.269.200\software_reporter_tool.exe" --engine=2 --scan-locations=1,2,3,4,5,6,7,8,10 --disabled-locations=9,11 --session-id=HXJ4GCz8EnSBh1+UPadhpHgHOKQbhU9VTJaDWz5c --registry-suffix=ESET --enable-crash-reporting --srt-field-trial-group-name=NewCleanerUIExperiment
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2504

\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\93.269.200\software_reporter_tool.exe
"c:\users\admin\appdata\local\google\chrome\user data\swreporter\93.269.200\software_reporter_tool.exe" --crash-handler "--database=c:\users\admin\appdata\local\Google\Software Reporter Tool" --url=https://clients2.google.com/cr/report --annotation=plat=Win32 --annotation=prod=ChromeFoil --annotation=ver=93.269.200 --initial-client-data=0x260,0x264,0x268,0x23c,0x26c,0x7ff6bf929300,0x7ff6bf929310,0x7ff6bf929320
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1060

\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\93.269.200\software_reporter_tool.exe
"c:\users\admin\appdata\local\google\chrome\user data\swreporter\93.269.200\software_reporter_tool.exe" --enable-crash-reporting --use-crash-handler-with-id="\\.\pipe\crashpad_2504_KMZUPNYYVPVJHZRJ" --sandboxed-process-id=2 --init-done-notifier=716 --sandbox-mojo-pipe-token=5457086080725403288 --mojo-platform-channel-handle=692 --engine=2
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3860

\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\93.269.200\software_reporter_tool.exe
"c:\users\admin\appdata\local\google\chrome\user data\swreporter\93.269.200\software_reporter_tool.exe" --enable-crash-reporting --use-crash-handler-with-id="\\.\pipe\crashpad_2504_KMZUPNYYVPVJHZRJ" --sandboxed-process-id=3 --init-done-notifier=916 --sandbox-mojo-pipe-token=11569141006492952566 --mojo-platform-channel-handle=912
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4904

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1896

C:\Users\Admin\Downloads\code.exe
"C:\Users\Admin\Downloads\code.exe"
1⤵
- Executes dropped EXE
PID:2112

C:\Users\Admin\AppData\Local\Temp\is-53SC6.tmp\code.tmp
"C:\Users\Admin\AppData\Local\Temp\is-53SC6.tmp\code.tmp" /SL5="$1029E,1549918,785408,C:\Users\Admin\Downloads\code.exe"
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:2560

C:\Users\Admin\Downloads\code.exe
"C:\Users\Admin\Downloads\code.exe"
1⤵
- Executes dropped EXE
PID:4876

C:\Users\Admin\AppData\Local\Temp\is-8TU5H.tmp\code.tmp
"C:\Users\Admin\AppData\Local\Temp\is-8TU5H.tmp\code.tmp" /SL5="$40298,1549918,785408,C:\Users\Admin\Downloads\code.exe"
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:4924

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4764

C:\Users\Admin\Downloads\code.exe
"C:\Users\Admin\Downloads\code.exe"
1⤵
- Executes dropped EXE
PID:2004

C:\Users\Admin\AppData\Local\Temp\is-6C20S.tmp\code.tmp
"C:\Users\Admin\AppData\Local\Temp\is-6C20S.tmp\code.tmp" /SL5="$902B8,1549918,785408,C:\Users\Admin\Downloads\code.exe"
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:1372

C:\Program Files (x86)\cnBbOPfhTduj\1.exe
"C:\Program Files (x86)\cnBbOPfhTduj\1.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1768

C:\Program Files (x86)\cnBbOPfhTduj\1.exe
"C:\Program Files (x86)\cnBbOPfhTduj\1.exe"
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1512

C:\cnBbOPfhTdujcnBbOPfhTduj\2.exe
"C:\cnBbOPfhTdujcnBbOPfhTduj\2.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:588

C:\cnBbOPfhTdujcnBbOPfhTduj\2.exe
"C:\cnBbOPfhTdujcnBbOPfhTduj\2.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4508

C:\cnBbOPfhTdujcnBbOPfhTduj\2.exe
"C:\cnBbOPfhTdujcnBbOPfhTduj\2.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3936

C:\cnBbOPfhTdujcnBbOPfhTduj\2.exe
"C:\cnBbOPfhTdujcnBbOPfhTduj\2.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1212

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:4904

C:\Users\Admin\Downloads\code.exe
"C:\Users\Admin\Downloads\code.exe"
1⤵
- Executes dropped EXE
PID:2904

C:\Users\Admin\AppData\Local\Temp\is-G1ME6.tmp\code.tmp
"C:\Users\Admin\AppData\Local\Temp\is-G1ME6.tmp\code.tmp" /SL5="$A03DA,1549918,785408,C:\Users\Admin\Downloads\code.exe"
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1880

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4308

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:1884

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:5048

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5048.0.1837586744\965720098" -parentBuildID 20200403170909 -prefsHandle 1532 -prefMapHandle 1524 -prefsLen 1 -prefMapSize 219808 -appdir "C:\Program Files\Mozilla Firefox\browser" - 5048 "\\.\pipe\gecko-crash-server-pipe.5048" 1624 gpu
3⤵
PID:4208

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:2892

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
PID:1736

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\cnBbOPfhTduj\1.exe
MD5
6fc026c1356ff3c526eec72f7e84124f

SHA1
6ac6d745c29fb1c4710453c069ad64ec57f82d24

SHA256
6ed974d5d6b95bfd930bfba9ebaeede749d51b706f34374f1b4a96a2520ba295

SHA512
364fe93d5ec9af2836123a0ce81e267d77d9df12f48da367a95a3a0de3f48ab94db9a404077bf8f8dcf68934901bb1e881c8375e585b7daa18f72faddd961069

Download Submit
C:\Program Files (x86)\cnBbOPfhTduj\1.exe
MD5
6fc026c1356ff3c526eec72f7e84124f

SHA1
6ac6d745c29fb1c4710453c069ad64ec57f82d24

SHA256
6ed974d5d6b95bfd930bfba9ebaeede749d51b706f34374f1b4a96a2520ba295

SHA512
364fe93d5ec9af2836123a0ce81e267d77d9df12f48da367a95a3a0de3f48ab94db9a404077bf8f8dcf68934901bb1e881c8375e585b7daa18f72faddd961069

Download Submit
C:\Program Files (x86)\cnBbOPfhTduj\1.exe
MD5
6fc026c1356ff3c526eec72f7e84124f

SHA1
6ac6d745c29fb1c4710453c069ad64ec57f82d24

SHA256
6ed974d5d6b95bfd930bfba9ebaeede749d51b706f34374f1b4a96a2520ba295

SHA512
364fe93d5ec9af2836123a0ce81e267d77d9df12f48da367a95a3a0de3f48ab94db9a404077bf8f8dcf68934901bb1e881c8375e585b7daa18f72faddd961069

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-53SC6.tmp\code.tmp
MD5
98f486d5fdcee9a04aafc19421ae3b4c

SHA1
47c4b49fd158121d9f9277ae0bd2cb352b7774c6

SHA256
e416869df4dac82b629639782ec7db7383e1f9776cdb7e0b91233675ec6ac360

SHA512
78a72ba3d4ce60723999b4f4e09359e03b1f371fac709ee0511c899b20df5c9f015871aade3316c4ca49c529cdd949df86c34145f8060bb46b6d5cb1a0795dfe

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-8TU5H.tmp\code.tmp
MD5
98f486d5fdcee9a04aafc19421ae3b4c

SHA1
47c4b49fd158121d9f9277ae0bd2cb352b7774c6

SHA256
e416869df4dac82b629639782ec7db7383e1f9776cdb7e0b91233675ec6ac360

SHA512
78a72ba3d4ce60723999b4f4e09359e03b1f371fac709ee0511c899b20df5c9f015871aade3316c4ca49c529cdd949df86c34145f8060bb46b6d5cb1a0795dfe

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-MF21N.tmp\code.tmp
MD5
98f486d5fdcee9a04aafc19421ae3b4c

SHA1
47c4b49fd158121d9f9277ae0bd2cb352b7774c6

SHA256
e416869df4dac82b629639782ec7db7383e1f9776cdb7e0b91233675ec6ac360

SHA512
78a72ba3d4ce60723999b4f4e09359e03b1f371fac709ee0511c899b20df5c9f015871aade3316c4ca49c529cdd949df86c34145f8060bb46b6d5cb1a0795dfe

Download Submit
C:\Users\Admin\Downloads\code.exe
MD5
2a24adb241c593439bdf0287e1e97214

SHA1
764983c865f8a3ac59a605e0c1291b97a55636cc

SHA256
005f2b402427f551cad68e7d159b7bcf588b6c4f773fbd8e367bd9ad404e66cc

SHA512
f586d2c3be0bc2e0aa29bbbefdae2c90e25f4ef293e62df05de35c8184e10a8eb1431254e1d8b9f570e243f737da36852e38a1b81074ed73fcf1a805edfabb90

Download Submit
C:\Users\Admin\Downloads\code.exe
MD5
2a24adb241c593439bdf0287e1e97214

SHA1
764983c865f8a3ac59a605e0c1291b97a55636cc

SHA256
005f2b402427f551cad68e7d159b7bcf588b6c4f773fbd8e367bd9ad404e66cc

SHA512
f586d2c3be0bc2e0aa29bbbefdae2c90e25f4ef293e62df05de35c8184e10a8eb1431254e1d8b9f570e243f737da36852e38a1b81074ed73fcf1a805edfabb90

Download Submit
C:\Users\Admin\Downloads\code.exe
MD5
2a24adb241c593439bdf0287e1e97214

SHA1
764983c865f8a3ac59a605e0c1291b97a55636cc

SHA256
005f2b402427f551cad68e7d159b7bcf588b6c4f773fbd8e367bd9ad404e66cc

SHA512
f586d2c3be0bc2e0aa29bbbefdae2c90e25f4ef293e62df05de35c8184e10a8eb1431254e1d8b9f570e243f737da36852e38a1b81074ed73fcf1a805edfabb90

Download Submit
C:\Users\Admin\Downloads\code.exe
MD5
2a24adb241c593439bdf0287e1e97214

SHA1
764983c865f8a3ac59a605e0c1291b97a55636cc

SHA256
005f2b402427f551cad68e7d159b7bcf588b6c4f773fbd8e367bd9ad404e66cc

SHA512
f586d2c3be0bc2e0aa29bbbefdae2c90e25f4ef293e62df05de35c8184e10a8eb1431254e1d8b9f570e243f737da36852e38a1b81074ed73fcf1a805edfabb90

Download Submit
C:\cnBbOPfhTdujcnBbOPfhTduj\2.exe
MD5
df79570fb49b88fb30fa76d368b9c8de

SHA1
c60c42087678616ab6d0f37974acee1cc34f135d

SHA256
b34ec38d3da5de76b79ad604063cea454c2d366baa6b36938323f7d88f7c8b16

SHA512
fe18074212315fbe17d44645a727579b9b94c9e7508ba3c69abf1fa44d3f1f3698d4c4dd10de72322f85d651344031cc5068f94ad32f370b1ba699a3cae0b976

Download Submit
C:\cnBbOPfhTdujcnBbOPfhTduj\2.exe
MD5
df79570fb49b88fb30fa76d368b9c8de

SHA1
c60c42087678616ab6d0f37974acee1cc34f135d

SHA256
b34ec38d3da5de76b79ad604063cea454c2d366baa6b36938323f7d88f7c8b16

SHA512
fe18074212315fbe17d44645a727579b9b94c9e7508ba3c69abf1fa44d3f1f3698d4c4dd10de72322f85d651344031cc5068f94ad32f370b1ba699a3cae0b976

Download Submit
C:\cnBbOPfhTdujcnBbOPfhTduj\2.exe
MD5
df79570fb49b88fb30fa76d368b9c8de

SHA1
c60c42087678616ab6d0f37974acee1cc34f135d

SHA256
b34ec38d3da5de76b79ad604063cea454c2d366baa6b36938323f7d88f7c8b16

SHA512
fe18074212315fbe17d44645a727579b9b94c9e7508ba3c69abf1fa44d3f1f3698d4c4dd10de72322f85d651344031cc5068f94ad32f370b1ba699a3cae0b976

Download Submit
\??\pipe\crashpad_1776_DLGZBTRZDNRSEPXU
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/376-459-0x0000000000000000-mapping.dmp

Download
memory/380-343-0x0000000000000000-mapping.dmp

Download
memory/428-334-0x0000000000000000-mapping.dmp

Download
memory/508-160-0x0000000000000000-mapping.dmp

Download
memory/656-165-0x0000000000000000-mapping.dmp

Download
memory/1012-133-0x0000000000000000-mapping.dmp

Download
memory/1360-388-0x0000000003050000-0x000000000307F000-memory.dmp

Filesize
188KB

Download
memory/1360-381-0x0000000000000000-mapping.dmp

Download
memory/1372-471-0x0000000000880000-0x0000000000881000-memory.dmp

Filesize
4KB

Download
memory/1544-181-0x0000000000000000-mapping.dmp

Download
memory/1560-151-0x0000000000000000-mapping.dmp

Download
memory/1560-384-0x0000000000000000-mapping.dmp

Download
memory/1560-387-0x0000000002440000-0x000000000246F000-memory.dmp

Filesize
188KB

Download
memory/1560-394-0x0000000002410000-0x0000000002437000-memory.dmp

Filesize
156KB

Download
memory/1604-129-0x0000000000000000-mapping.dmp

Download
memory/1880-514-0x0000000000960000-0x0000000000961000-memory.dmp

Filesize
4KB

Download
memory/1884-346-0x0000000000000000-mapping.dmp

Download
memory/1972-140-0x0000000000000000-mapping.dmp

Download
memory/2004-470-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/2112-440-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/2276-117-0x0000000000000000-mapping.dmp

Download
memory/2560-441-0x00000000007D0000-0x00000000007D1000-memory.dmp

Filesize
4KB

Download
memory/2560-438-0x0000000000000000-mapping.dmp

Download
memory/2640-169-0x0000000000000000-mapping.dmp

Download
memory/2904-513-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/3428-122-0x0000000000000000-mapping.dmp

Download
memory/3480-357-0x0000000000000000-mapping.dmp

Download
memory/3508-121-0x0000000000000000-mapping.dmp

Download
memory/3508-123-0x00007FF9618C0000-0x00007FF9618C1000-memory.dmp

Filesize
4KB

Download
memory/4108-184-0x0000000000000000-mapping.dmp

Download
memory/4108-427-0x0000000000000000-mapping.dmp

Download
memory/4136-330-0x0000000000000000-mapping.dmp

Download
memory/4196-191-0x0000000000000000-mapping.dmp

Download
memory/4216-422-0x0000000000000000-mapping.dmp

Download
memory/4256-468-0x000002DAE85B0000-0x000002DAE88C2000-memory.dmp

Filesize
3.1MB

Download
memory/4284-198-0x0000000000000000-mapping.dmp

Download
memory/4340-277-0x0000000000000000-mapping.dmp

Download
memory/4368-205-0x0000000000000000-mapping.dmp

Download
memory/4384-401-0x0000000000000000-mapping.dmp

Download
memory/4384-404-0x0000000002FA0000-0x0000000002FCF000-memory.dmp

Filesize
188KB

Download
memory/4412-320-0x0000000000000000-mapping.dmp

Download
memory/4452-212-0x0000000000000000-mapping.dmp

Download
memory/4468-339-0x0000000000000000-mapping.dmp

Download
memory/4488-528-0x000001BF37BC0000-0x000001BF37ED2000-memory.dmp

Filesize
3.1MB

Download
memory/4488-433-0x0000000000000000-mapping.dmp

Download
memory/4512-217-0x0000000000000000-mapping.dmp

Download
memory/4520-283-0x0000000000000000-mapping.dmp

Download
memory/4608-224-0x0000000000000000-mapping.dmp

Download
memory/4628-286-0x0000000000000000-mapping.dmp

Download
memory/4640-290-0x0000000000000000-mapping.dmp

Download
memory/4660-229-0x0000000000000000-mapping.dmp

Download
memory/4668-353-0x0000000000000000-mapping.dmp

Download
memory/4712-233-0x0000000000000000-mapping.dmp

Download
memory/4720-364-0x0000000000000000-mapping.dmp

Download
memory/4724-237-0x0000000000000000-mapping.dmp

Download
memory/4732-295-0x0000000000000000-mapping.dmp

Download
memory/4768-325-0x0000000000000000-mapping.dmp

Download
memory/4788-299-0x0000000000000000-mapping.dmp

Download
memory/4796-417-0x0000000000000000-mapping.dmp

Download
memory/4812-242-0x0000000000000000-mapping.dmp

Download
memory/4816-303-0x0000000000000000-mapping.dmp

Download
memory/4828-361-0x0000000000000000-mapping.dmp

Download
memory/4864-247-0x0000000000000000-mapping.dmp

Download
memory/4876-446-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/4912-400-0x0000000000000000-mapping.dmp

Download
memory/4912-405-0x0000000002890000-0x00000000028BF000-memory.dmp

Filesize
188KB

Download
memory/4916-252-0x0000000000000000-mapping.dmp

Download
memory/4924-444-0x0000000000000000-mapping.dmp

Download
memory/4924-447-0x00000000006F0000-0x000000000079E000-memory.dmp

Filesize
696KB

Download
memory/4928-370-0x0000000000000000-mapping.dmp

Download
memory/4932-449-0x0000000000000000-mapping.dmp

Download
memory/4968-257-0x0000000000000000-mapping.dmp

Download
memory/4984-373-0x0000000000000000-mapping.dmp

Download
memory/4984-379-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/5020-262-0x0000000000000000-mapping.dmp

Download
memory/5024-308-0x0000000000000000-mapping.dmp

Download
memory/5064-454-0x0000000000000000-mapping.dmp

Download
memory/5072-267-0x0000000000000000-mapping.dmp

Download
memory/5092-377-0x0000000000000000-mapping.dmp

Download
memory/5092-380-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Filesize
4KB

Download
memory/5100-271-0x0000000000000000-mapping.dmp

Download
memory/5112-313-0x0000000000000000-mapping.dmp

Download