xmrig | 3f5c16db3f1a5bb724288688d15038da32f1b89cbd662fddc9def8b8da2a84c1

Resubmissions

03-12-2021 16:55

211203-vfgxjahafr 10

03-12-2021 16:38

211203-t5d2hacab9 10

Analysis

max time kernel
359s
max time network
384s
platform
windows7_x64
resource
win7-en-20211104
submitted
03-12-2021 16:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sqlservr.exe.7z
Size

3.7MB
MD5

0923d82afd72038a03dda84170b793bb
SHA1

2ac02a4b0e0dc807e8e3328934d5007002b12514
SHA256

3f5c16db3f1a5bb724288688d15038da32f1b89cbd662fddc9def8b8da2a84c1
SHA512

515238347da2af77d82b4ac4be420d6c89b25dc836c3e13cdb02aee45380df374363bfd182aa84a26fac835ae7eb2241a4b2798b236b2e09721a7af55bcc1ff4

Score

10^/10

xmrig discovery miner persistence spyware stealer

Malware Config

Signatures

Registers COM server for autorun 1 TTPs
persistence

Registry Run Keys / Startup Folder
T1060
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner Payload 6 IoCs

miner

Processes:

resource	yara_rule
behavioral1/memory/2264-117-0x000000013FB20000-0x0000000140E7B000-memory.dmp	xmrig
behavioral1/memory/2264-119-0x000000013FB20000-0x0000000140E7B000-memory.dmp	xmrig
behavioral1/memory/2264-120-0x000000013FB20000-0x0000000140E7B000-memory.dmp	xmrig
behavioral1/memory/2224-152-0x000000013F1D0000-0x000000014052B000-memory.dmp	xmrig
behavioral1/memory/2224-153-0x000000013F1D0000-0x000000014052B000-memory.dmp	xmrig
behavioral1/memory/2224-154-0x000000013F1D0000-0x000000014052B000-memory.dmp	xmrig

Downloads MZ/PE file

Executes dropped EXE 29 IoCs

Processes:

sqlservr.exesqlservr.exesqlservr.exeChromeRecovery.exeGoogleUpdateSetup.exeGoogleUpdate.exeGoogleUpdate.exeGoogleUpdate.exeGoogleUpdateComRegisterShell64.exeGoogleUpdateComRegisterShell64.exeGoogleUpdateComRegisterShell64.exeGoogleUpdate.exeGoogleUpdate.exeGoogleUpdate.exesoftware_reporter_tool.exesoftware_reporter_tool.exesoftware_reporter_tool.exeGoogleUpdateSetup.exeGoogleCrashHandler.exeGoogleCrashHandler64.exeGoogleUpdate.exeGoogleUpdate.exesoftware_reporter_tool.exeGoogleUpdate.exeGoogleUpdate.exeGoogleUpdateComRegisterShell64.exeGoogleUpdateComRegisterShell64.exeGoogleUpdateComRegisterShell64.exeGoogleUpdate.exe

pid	process
2264	sqlservr.exe
2224	sqlservr.exe
1624	sqlservr.exe
2896	ChromeRecovery.exe
3012	GoogleUpdateSetup.exe
2080	GoogleUpdate.exe
2284	GoogleUpdate.exe
2324	GoogleUpdate.exe
2132	GoogleUpdateComRegisterShell64.exe
2220	GoogleUpdateComRegisterShell64.exe
2200	GoogleUpdateComRegisterShell64.exe
2952	GoogleUpdate.exe
2976	GoogleUpdate.exe
2484	GoogleUpdate.exe
2424	software_reporter_tool.exe
2416	software_reporter_tool.exe
1916	software_reporter_tool.exe
1488	GoogleUpdateSetup.exe
792	GoogleCrashHandler.exe
1880	GoogleCrashHandler64.exe
1652	GoogleUpdate.exe
304	GoogleUpdate.exe
1136	software_reporter_tool.exe
964	GoogleUpdate.exe
548	GoogleUpdate.exe
1540	GoogleUpdateComRegisterShell64.exe
2888	GoogleUpdateComRegisterShell64.exe
1216	GoogleUpdateComRegisterShell64.exe
3052	GoogleUpdate.exe

Sets file execution options in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Loads dropped DLL 64 IoCs

Processes:

chrome.execmd.exeChromeRecovery.exeGoogleUpdateSetup.exeGoogleUpdate.exeGoogleUpdate.exeGoogleUpdate.exeGoogleUpdateComRegisterShell64.exeGoogleUpdateComRegisterShell64.exeGoogleUpdateComRegisterShell64.exeGoogleUpdate.exeGoogleUpdate.exeGoogleUpdate.exechrome.exe

pid	process
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
1396
1396
1396
1396
1396
1396
1396
1396
1396
1396
1396
1396
1396
1396
1396
1396
1396
2160
2308	cmd.exe
2308	cmd.exe
2896	ChromeRecovery.exe
3012	GoogleUpdateSetup.exe
2080	GoogleUpdate.exe
2080	GoogleUpdate.exe
2080	GoogleUpdate.exe
2080	GoogleUpdate.exe
2284	GoogleUpdate.exe
2284	GoogleUpdate.exe
2284	GoogleUpdate.exe
2080	GoogleUpdate.exe
2324	GoogleUpdate.exe
2324	GoogleUpdate.exe
2324	GoogleUpdate.exe
2132	GoogleUpdateComRegisterShell64.exe
2324	GoogleUpdate.exe
2324	GoogleUpdate.exe
2220	GoogleUpdateComRegisterShell64.exe
2324	GoogleUpdate.exe
2324	GoogleUpdate.exe
2200	GoogleUpdateComRegisterShell64.exe
2324	GoogleUpdate.exe
2080	GoogleUpdate.exe
2080	GoogleUpdate.exe
2080	GoogleUpdate.exe
2952	GoogleUpdate.exe
2896	ChromeRecovery.exe
2896	ChromeRecovery.exe
2896	ChromeRecovery.exe
2976	GoogleUpdate.exe
2976	GoogleUpdate.exe
2976	GoogleUpdate.exe
2484	GoogleUpdate.exe
2484	GoogleUpdate.exe
2484	GoogleUpdate.exe
2484	GoogleUpdate.exe
2976	GoogleUpdate.exe
1756	chrome.exe
2484	GoogleUpdate.exe
2484	GoogleUpdate.exe
2484	GoogleUpdate.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

Processes:

sqlservr.exesqlservr.exesqlservr.exe

pid process

2264 sqlservr.exe
2224 sqlservr.exe
2224 sqlservr.exe
1624 sqlservr.exe
1624 sqlservr.exe

Drops file in Program Files directory 64 IoCs

Processes:

GoogleUpdate.exeGoogleUpdateSetup.exeGoogleUpdateSetup.exeGoogleUpdate.exeelevation_service.exeGoogleUpdate.exe

description	ioc	process
File created	C:\Program Files (x86)\Google\Update\1.3.36.111\goopdateres_pl.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.111\goopdateres_pt-PT.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUM712.tmp\goopdateres_en.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM712.tmp\goopdateres_fr.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM712.tmp\goopdateres_pt-BR.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMAF62.tmp\goopdateres_lv.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.111\GoogleCrashHandler.exe	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.111\goopdateres_iw.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUM712.tmp\goopdateres_et.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.112\psuser.dll	GoogleUpdate.exe
File opened for modification	C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir2872_1789892516\ChromeRecovery.exe	elevation_service.exe
File created	C:\Program Files (x86)\Google\Temp\GUMAF62.tmp\goopdateres_pt-PT.dll	GoogleUpdateSetup.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{30BE9CC2-6023-4B4D-87DD-C0CCCF2611F0}\GoogleUpdateSetup.exe	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUM712.tmp\goopdateres_fi.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.112\goopdateres_kn.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.112\goopdateres_pt-PT.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.112\goopdateres_zh-CN.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUMAF62.tmp\goopdateres_es.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.111\goopdateres_hu.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.111\goopdateres_is.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.111\GoogleCrashHandler64.exe	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUM712.tmp\GoogleUpdateBroker.exe	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM712.tmp\goopdateres_kn.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMAF62.tmp\goopdateres_ta.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM712.tmp\goopdate.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.112\goopdateres_ta.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUM712.tmp\goopdateres_te.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.112\goopdateres_id.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUMAF62.tmp\GoogleCrashHandler.exe	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMAF62.tmp\goopdateres_fa.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.111\goopdateres_bg.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.112\psuser_64.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUMAF62.tmp\goopdateres_it.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM712.tmp\goopdateres_hr.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.112\goopdateres_el.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.111\goopdateres_am.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.112\goopdateres_mr.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUMAF62.tmp\goopdateres_ca.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMAF62.tmp\goopdateres_ml.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMAF62.tmp\goopdateres_ro.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.112\goopdateres_ml.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir2872_1789892516\ChromeRecoveryCRX.crx	elevation_service.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.111\goopdateres_mr.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.112\goopdate.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.111\goopdateres_zh-CN.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUM712.tmp\psuser.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM712.tmp\goopdateres_el.dll	GoogleUpdateSetup.exe
File opened for modification	C:\Program Files (x86)\Google\Temp\GUTAF63.tmp	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMAF62.tmp\goopdateres_pl.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.111\goopdateres_ar.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.111\goopdateres_ja.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.111\goopdateres_sr.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.112\goopdateres_en-GB.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.112\goopdateres_fr.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.112\goopdateres_lt.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUMAF62.tmp\goopdate.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMAF62.tmp\goopdateres_sk.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM712.tmp\goopdateres_cs.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMAF62.tmp\GoogleUpdateCore.exe	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.111\psmachine.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUM712.tmp\goopdateres_bg.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.111\goopdateres_gu.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.112\goopdateres_ca.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUMAF62.tmp\psuser.dll	GoogleUpdateSetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 64 IoCs

Processes:

chrome.exeGoogleUpdate.exeGoogleUpdateComRegisterShell64.exeGoogleUpdate.exeGoogleUpdate.exeGoogleUpdateComRegisterShell64.exeGoogleUpdate.exeGoogleUpdateComRegisterShell64.exeGoogleUpdateComRegisterShell64.exeGoogleUpdateComRegisterShell64.exeGoogleUpdateComRegisterShell64.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\NumMethods	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E225E692-4B47-4777-9BED-4FD7FE257F0E}	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E225E692-4B47-4777-9BED-4FD7FE257F0E}\VersionIndependentProgID	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\ = "ICurrentState"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}\ELEVATION	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7DE94008-8AFD-4C70-9728-C6FBFFF6A73E}\ = "CoCreateAsync"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BCDCB538-01C0-46D1-A6A7-52F4D021C272}\ = "IAppVersion"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DAB1D343-1B2A-47F9-B445-93DC50704BFE}\ = "ICoCreateAsync"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DCAB8386-4F03-4DBD-A366-D90BC9F68DE6}\NumMethods\ = "10"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{521FDB42-7130-4806-822A-FC5163FAD983}\VersionIndependentProgID\ = "GoogleUpdate.PolicyStatusMachine"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\NumMethods	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5B25A8DC-1780-4178-A629-6BE8B8DEFAA2}\ProxyStubClsid32\ = "{A3ADC43E-56D9-4EC1-ADDA-49C5B9069B07}"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{084D78A8-B084-4E14-A629-A2C419B0E3D9}\NumMethods	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1C642CED-CA3B-4013-A9DF-CA6CE5FF6503}\ = "IProgressWndEvents"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2E629606-312A-482F-9B12-2C4ABF6F0B6D}\NumMethods\ = "10"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\ProgID	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}\NumMethods	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{05A30352-EB25-45B6-8449-BCA7B0542CE5}\NumMethods	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6F8BD55B-E83D-4A47-85BE-81FFA8057A69}\Elevation	GoogleUpdate.exe
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3D05F64F-71E3-48A5-BF6B-83315BC8AE1F}\ProxyStubClsid32	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{084D78A8-B084-4E14-A629-A2C419B0E3D9}\NumMethods\ = "43"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D363682-561D-4C3A-81C6-F2F82107562A}\ = "IGoogleUpdate3WebSecurity"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2E629606-312A-482F-9B12-2C4ABF6F0B6D}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DB17455-4E85-46E7-9D23-E555E4B005AF}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{084D78A8-B084-4E14-A629-A2C419B0E3D9}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{084D78A8-B084-4E14-A629-A2C419B0E3D9}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31AC3F11-E5EA-4A85-8A3D-8E095A39C27B}\ProxyStubClsid32\ = "{A3ADC43E-56D9-4EC1-ADDA-49C5B9069B07}"	GoogleUpdateComRegisterShell64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\NodeSlot = "6"	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{05A30352-EB25-45B6-8449-BCA7B0542CE5}\NumMethods\ = "24"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B3A47570-0A85-4AEA-8270-529D47899603}	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{27634814-8E41-4C35-8577-980134A96544}\ = "IPolicyStatusValue"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{909489C2-85A6-4322-AA56-D25278649D67}	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FE908CDD-22BB-472A-9870-1A0390E42F36}\ = "IAppBundle"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{598FE0E5-E02D-465D-9A9D-37974A28FD42}\ProgID\ = "GoogleUpdate.Update3WebMachineFallback.1.0"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1C642CED-CA3B-4013-A9DF-CA6CE5FF6503}\ProxyStubClsid32	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3D05F64F-71E3-48A5-BF6B-83315BC8AE1F}\NumMethods	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}\ = "IPolicyStatus"	GoogleUpdateComRegisterShell64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0\NodeSlot = "7"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8324F243-250C-4E97-915C-8220BAE15E18}\InprocHandler32\ThreadingModel = "Both"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31AC3F11-E5EA-4A85-8A3D-8E095A39C27B}	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\ = "IProcessLauncher2"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13}\ProxyStubClsid32\ = "{A3ADC43E-56D9-4EC1-ADDA-49C5B9069B07}"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{05A30352-EB25-45B6-8449-BCA7B0542CE5}\NumMethods\ = "24"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{598FE0E5-E02D-465D-9A9D-37974A28FD42}\PROGID	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{521FDB42-7130-4806-822A-FC5163FAD983}\LocalServer32	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{521FDB42-7130-4806-822A-FC5163FAD983}\Elevation	GoogleUpdate.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4E223325-C16B-4EEB-AEDC-19AA99A237FA}	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FE908CDD-22BB-472A-9870-1A0390E42F36}	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{05A30352-EB25-45B6-8449-BCA7B0542CE5}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\ProxyStubClsid32	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{25461599-633D-42B1-84FB-7CD68D026E53}\ = "GoogleUpdate CredentialDialog"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{76F7B787-A67C-4C73-82C7-31F5E3AABC5C}	GoogleUpdate.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

Processes:

chrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exeGoogleUpdate.exeGoogleUpdate.exeGoogleUpdate.exeGoogleUpdate.exeGoogleUpdate.exeGoogleUpdate.exesoftware_reporter_tool.exeGoogleUpdate.exe

pid	process
1388	chrome.exe
1756	chrome.exe
1756	chrome.exe
2744	chrome.exe
2932	chrome.exe
2200	chrome.exe
1684	chrome.exe
1756	chrome.exe
1756	chrome.exe
2440	chrome.exe
2080	GoogleUpdate.exe
2080	GoogleUpdate.exe
2080	GoogleUpdate.exe
2080	GoogleUpdate.exe
2080	GoogleUpdate.exe
2080	GoogleUpdate.exe
2080	GoogleUpdate.exe
2080	GoogleUpdate.exe
2080	GoogleUpdate.exe
2952	GoogleUpdate.exe
2952	GoogleUpdate.exe
2976	GoogleUpdate.exe
2976	GoogleUpdate.exe
2484	GoogleUpdate.exe
2484	GoogleUpdate.exe
1652	GoogleUpdate.exe
1652	GoogleUpdate.exe
304	GoogleUpdate.exe
304	GoogleUpdate.exe
304	GoogleUpdate.exe
304	GoogleUpdate.exe
304	GoogleUpdate.exe
304	GoogleUpdate.exe
2424	software_reporter_tool.exe
2424	software_reporter_tool.exe
3052	GoogleUpdate.exe
3052	GoogleUpdate.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

chrome.exe

pid process

2744 chrome.exe

Suspicious use of AdjustPrivilegeToken 32 IoCs

Processes:

7zG.exeAUDIODG.EXEGoogleUpdate.exeGoogleUpdate.exeGoogleUpdate.exesoftware_reporter_tool.exesoftware_reporter_tool.exesoftware_reporter_tool.exeGoogleCrashHandler.exeGoogleUpdate.exeGoogleCrashHandler64.exeGoogleUpdate.exeGoogleUpdate.exesoftware_reporter_tool.exeGoogleUpdate.exe

description	pid	process
Token: SeRestorePrivilege	2628	7zG.exe
Token: 35	2628	7zG.exe
Token: SeSecurityPrivilege	2628	7zG.exe
Token: SeSecurityPrivilege	2628	7zG.exe
Token: 33	3024	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3024	AUDIODG.EXE
Token: 33	3024	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3024	AUDIODG.EXE
Token: SeDebugPrivilege	2080	GoogleUpdate.exe
Token: SeDebugPrivilege	2080	GoogleUpdate.exe
Token: SeDebugPrivilege	2080	GoogleUpdate.exe
Token: SeDebugPrivilege	2080	GoogleUpdate.exe
Token: SeDebugPrivilege	2952	GoogleUpdate.exe
Token: SeDebugPrivilege	2976	GoogleUpdate.exe
Token: 33	2416	software_reporter_tool.exe
Token: SeIncBasePriorityPrivilege	2416	software_reporter_tool.exe
Token: 33	2424	software_reporter_tool.exe
Token: SeIncBasePriorityPrivilege	2424	software_reporter_tool.exe
Token: 33	1916	software_reporter_tool.exe
Token: SeIncBasePriorityPrivilege	1916	software_reporter_tool.exe
Token: 33	792	GoogleCrashHandler.exe
Token: SeIncBasePriorityPrivilege	792	GoogleCrashHandler.exe
Token: SeDebugPrivilege	2484	GoogleUpdate.exe
Token: 33	1880	GoogleCrashHandler64.exe
Token: SeIncBasePriorityPrivilege	1880	GoogleCrashHandler64.exe
Token: SeDebugPrivilege	1652	GoogleUpdate.exe
Token: SeDebugPrivilege	304	GoogleUpdate.exe
Token: SeDebugPrivilege	304	GoogleUpdate.exe
Token: SeDebugPrivilege	304	GoogleUpdate.exe
Token: 33	1136	software_reporter_tool.exe
Token: SeIncBasePriorityPrivilege	1136	software_reporter_tool.exe
Token: SeDebugPrivilege	3052	GoogleUpdate.exe

Suspicious use of FindShellTrayWindow 35 IoCs

Processes:

chrome.exe7zG.exe

pid	process
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
2628	7zG.exe

Suspicious use of SendNotifyMessage 32 IoCs

Processes:

chrome.exe

pid	process
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

AcroRd32.exechrome.exe

pid	process
608	AcroRd32.exe
608	AcroRd32.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cmd.exerundll32.exechrome.exe

description	pid	process	target process
PID 1164 wrote to memory of 896	1164	cmd.exe	rundll32.exe
PID 1164 wrote to memory of 896	1164	cmd.exe	rundll32.exe
PID 1164 wrote to memory of 896	1164	cmd.exe	rundll32.exe
PID 896 wrote to memory of 608	896	rundll32.exe	AcroRd32.exe
PID 896 wrote to memory of 608	896	rundll32.exe	AcroRd32.exe
PID 896 wrote to memory of 608	896	rundll32.exe	AcroRd32.exe
PID 896 wrote to memory of 608	896	rundll32.exe	AcroRd32.exe
PID 1756 wrote to memory of 1048	1756	chrome.exe	chrome.exe
PID 1756 wrote to memory of 1048	1756	chrome.exe	chrome.exe
PID 1756 wrote to memory of 1048	1756	chrome.exe	chrome.exe
PID 1756 wrote to memory of 1176	1756	chrome.exe	chrome.exe
PID 1756 wrote to memory of 1176	1756	chrome.exe	chrome.exe
PID 1756 wrote to memory of 1176	1756	chrome.exe	chrome.exe
PID 1756 wrote to memory of 1176	1756	chrome.exe	chrome.exe
PID 1756 wrote to memory of 1176	1756	chrome.exe	chrome.exe
PID 1756 wrote to memory of 1176	1756	chrome.exe	chrome.exe
PID 1756 wrote to memory of 1176	1756	chrome.exe	chrome.exe
PID 1756 wrote to memory of 1176	1756	chrome.exe	chrome.exe
PID 1756 wrote to memory of 1176	1756	chrome.exe	chrome.exe
PID 1756 wrote to memory of 1176	1756	chrome.exe	chrome.exe
PID 1756 wrote to memory of 1176	1756	chrome.exe	chrome.exe
PID 1756 wrote to memory of 1176	1756	chrome.exe	chrome.exe
PID 1756 wrote to memory of 1176	1756	chrome.exe	chrome.exe
PID 1756 wrote to memory of 1176	1756	chrome.exe	chrome.exe
PID 1756 wrote to memory of 1176	1756	chrome.exe	chrome.exe
PID 1756 wrote to memory of 1176	1756	chrome.exe	chrome.exe
PID 1756 wrote to memory of 1176	1756	chrome.exe	chrome.exe
PID 1756 wrote to memory of 1176	1756	chrome.exe	chrome.exe
PID 1756 wrote to memory of 1176	1756	chrome.exe	chrome.exe
PID 1756 wrote to memory of 1176	1756	chrome.exe	chrome.exe
PID 1756 wrote to memory of 1176	1756	chrome.exe	chrome.exe
PID 1756 wrote to memory of 1176	1756	chrome.exe	chrome.exe
PID 1756 wrote to memory of 1176	1756	chrome.exe	chrome.exe
PID 1756 wrote to memory of 1176	1756	chrome.exe	chrome.exe
PID 1756 wrote to memory of 1176	1756	chrome.exe	chrome.exe
PID 1756 wrote to memory of 1176	1756	chrome.exe	chrome.exe
PID 1756 wrote to memory of 1176	1756	chrome.exe	chrome.exe
PID 1756 wrote to memory of 1176	1756	chrome.exe	chrome.exe
PID 1756 wrote to memory of 1176	1756	chrome.exe	chrome.exe
PID 1756 wrote to memory of 1176	1756	chrome.exe	chrome.exe
PID 1756 wrote to memory of 1176	1756	chrome.exe	chrome.exe
PID 1756 wrote to memory of 1176	1756	chrome.exe	chrome.exe
PID 1756 wrote to memory of 1176	1756	chrome.exe	chrome.exe
PID 1756 wrote to memory of 1176	1756	chrome.exe	chrome.exe
PID 1756 wrote to memory of 1176	1756	chrome.exe	chrome.exe
PID 1756 wrote to memory of 1176	1756	chrome.exe	chrome.exe
PID 1756 wrote to memory of 1176	1756	chrome.exe	chrome.exe
PID 1756 wrote to memory of 1176	1756	chrome.exe	chrome.exe
PID 1756 wrote to memory of 1176	1756	chrome.exe	chrome.exe
PID 1756 wrote to memory of 1176	1756	chrome.exe	chrome.exe
PID 1756 wrote to memory of 1176	1756	chrome.exe	chrome.exe
PID 1756 wrote to memory of 1388	1756	chrome.exe	chrome.exe
PID 1756 wrote to memory of 1388	1756	chrome.exe	chrome.exe
PID 1756 wrote to memory of 1388	1756	chrome.exe	chrome.exe
PID 1756 wrote to memory of 824	1756	chrome.exe	chrome.exe
PID 1756 wrote to memory of 824	1756	chrome.exe	chrome.exe
PID 1756 wrote to memory of 824	1756	chrome.exe	chrome.exe
PID 1756 wrote to memory of 824	1756	chrome.exe	chrome.exe
PID 1756 wrote to memory of 824	1756	chrome.exe	chrome.exe
PID 1756 wrote to memory of 824	1756	chrome.exe	chrome.exe
PID 1756 wrote to memory of 824	1756	chrome.exe	chrome.exe
PID 1756 wrote to memory of 824	1756	chrome.exe	chrome.exe
PID 1756 wrote to memory of 824	1756	chrome.exe	chrome.exe
PID 1756 wrote to memory of 824	1756	chrome.exe	chrome.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\sqlservr.exe.7z
1⤵
- Suspicious use of WriteProcessMemory
PID:1164

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\sqlservr.exe.7z
2⤵
- Suspicious use of WriteProcessMemory
PID:896

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\sqlservr.exe.7z"
3⤵
- Suspicious use of SetWindowsHookEx
PID:608

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Loads dropped DLL
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1756

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef69e4f50,0x7fef69e4f60,0x7fef69e4f70
2⤵
PID:1048

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1040,5149980122862851847,11378081426687345107,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1060 /prefetch:2
2⤵
PID:1176

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1040,5149980122862851847,11378081426687345107,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1252 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1388

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1040,5149980122862851847,11378081426687345107,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1816 /prefetch:8
2⤵
PID:824

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,5149980122862851847,11378081426687345107,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2060 /prefetch:1
2⤵
PID:1524

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,5149980122862851847,11378081426687345107,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2072 /prefetch:1
2⤵
PID:1532

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1040,5149980122862851847,11378081426687345107,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
2⤵
PID:2076

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1040,5149980122862851847,11378081426687345107,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2592 /prefetch:2
2⤵
PID:2148

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,5149980122862851847,11378081426687345107,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2412 /prefetch:1
2⤵
PID:2192

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1040,5149980122862851847,11378081426687345107,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
2⤵
PID:2256

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1040,5149980122862851847,11378081426687345107,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3120 /prefetch:8
2⤵
PID:2292

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1040,5149980122862851847,11378081426687345107,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3304 /prefetch:8
2⤵
PID:2328

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1040,5149980122862851847,11378081426687345107,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3120 /prefetch:8
2⤵
PID:2336

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1040,5149980122862851847,11378081426687345107,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3376 /prefetch:8
2⤵
PID:2372

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,5149980122862851847,11378081426687345107,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4012 /prefetch:1
2⤵
PID:2492

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,5149980122862851847,11378081426687345107,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
2⤵
PID:2552

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1040,5149980122862851847,11378081426687345107,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2188 /prefetch:8
2⤵
PID:2616

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1040,5149980122862851847,11378081426687345107,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2460 /prefetch:8
2⤵
PID:2660

C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\setup.exe
"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\setup.exe" --reenable-autoupdates --system-level
2⤵
PID:2696

C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\setup.exe
"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x13c,0x140,0x144,0x110,0x148,0x13fb2a890,0x13fb2a8a0,0x13fb2a8b0
3⤵
PID:2880

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1040,5149980122862851847,11378081426687345107,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3704 /prefetch:8
2⤵
PID:2704

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1040,5149980122862851847,11378081426687345107,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3572 /prefetch:8
2⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2744

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\sqlservr.exe\" -spe -an -ai#7zMap29374:102:7zEvent8665
3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2628

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1040,5149980122862851847,11378081426687345107,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3264 /prefetch:8
2⤵
PID:2924

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1040,5149980122862851847,11378081426687345107,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3396 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2932

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1040,5149980122862851847,11378081426687345107,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3432 /prefetch:8
2⤵
PID:2940

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1040,5149980122862851847,11378081426687345107,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3452 /prefetch:8
2⤵
PID:3008

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1040,5149980122862851847,11378081426687345107,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3336 /prefetch:8
2⤵
PID:3044

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1040,5149980122862851847,11378081426687345107,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3276 /prefetch:8
2⤵
PID:2076

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1040,5149980122862851847,11378081426687345107,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3492 /prefetch:8
2⤵
PID:2140

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,5149980122862851847,11378081426687345107,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1776 /prefetch:1
2⤵
PID:2316

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,5149980122862851847,11378081426687345107,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2252 /prefetch:1
2⤵
PID:2340

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1040,5149980122862851847,11378081426687345107,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3492 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2200

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1040,5149980122862851847,11378081426687345107,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=544 /prefetch:8
2⤵
PID:1660

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1040,5149980122862851847,11378081426687345107,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1724 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1684

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1040,5149980122862851847,11378081426687345107,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3676 /prefetch:8
2⤵
PID:3008

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1040,5149980122862851847,11378081426687345107,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3424 /prefetch:8
2⤵
PID:1908

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1040,5149980122862851847,11378081426687345107,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3660 /prefetch:8
2⤵
PID:2664

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1040,5149980122862851847,11378081426687345107,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1948 /prefetch:8
2⤵
PID:2772

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1040,5149980122862851847,11378081426687345107,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1800 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2440

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1040,5149980122862851847,11378081426687345107,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=972 /prefetch:8
2⤵
PID:1616

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1040,5149980122862851847,11378081426687345107,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1948 /prefetch:8
2⤵
PID:2336

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\93.269.200\software_reporter_tool.exe
"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\93.269.200\software_reporter_tool.exe" --engine=2 --scan-locations=1,2,3,4,5,6,7,8,10 --disabled-locations=9,11 --session-id=iM17jGMavVyO7RyKwxScoj0Y+AYcicbD8lf/CmQD --registry-suffix=ESET --enable-crash-reporting --srt-field-trial-group-name=NewCleanerUIExperiment
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2424

\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\93.269.200\software_reporter_tool.exe
"c:\users\admin\appdata\local\google\chrome\user data\swreporter\93.269.200\software_reporter_tool.exe" --crash-handler "--database=c:\users\admin\appdata\local\Google\Software Reporter Tool" --url=https://clients2.google.com/cr/report --annotation=plat=Win32 --annotation=prod=ChromeFoil --annotation=ver=93.269.200 --initial-client-data=0x160,0x164,0x168,0x134,0x16c,0x13fc59300,0x13fc59310,0x13fc59320
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2416

\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\93.269.200\software_reporter_tool.exe
"c:\users\admin\appdata\local\google\chrome\user data\swreporter\93.269.200\software_reporter_tool.exe" --enable-crash-reporting --use-crash-handler-with-id="\\.\pipe\crashpad_2424_WXXHKSDMBRIFZYJI" --sandboxed-process-id=2 --init-done-notifier=488 --sandbox-mojo-pipe-token=8853588830996190658 --mojo-platform-channel-handle=456 --engine=2
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1916

\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\93.269.200\software_reporter_tool.exe
"c:\users\admin\appdata\local\google\chrome\user data\swreporter\93.269.200\software_reporter_tool.exe" --enable-crash-reporting --use-crash-handler-with-id="\\.\pipe\crashpad_2424_WXXHKSDMBRIFZYJI" --sandboxed-process-id=3 --init-done-notifier=644 --sandbox-mojo-pipe-token=3868922615516690115 --mojo-platform-channel-handle=640
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1136

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1040,5149980122862851847,11378081426687345107,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1796 /prefetch:8
2⤵
PID:2684

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2704

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x500
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3024

C:\Users\Admin\AppData\Local\Temp\sqlservr.exe\sqlservr.exe
"C:\Users\Admin\AppData\Local\Temp\sqlservr.exe\sqlservr.exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2264

C:\Windows\system32\cmd.exe
"cmd.exe" /s /k pushd "C:\Users\Admin\AppData\Local\Temp\sqlservr.exe"
1⤵
- Loads dropped DLL
PID:2308

C:\Users\Admin\AppData\Local\Temp\sqlservr.exe\sqlservr.exe
sqlservr.exe
2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2224

C:\Users\Admin\AppData\Local\Temp\sqlservr.exe\sqlservr.exe
sqlservr.exe _h
2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1624

C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"
1⤵
- Drops file in Program Files directory
PID:2872

C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir2872_1789892516\ChromeRecovery.exe
"C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir2872_1789892516\ChromeRecovery.exe" --appguid={8A69D345-D564-463c-AFF1-A69D9E530F96} --browser-version=89.0.4389.114 --sessionid={802270a9-3987-4b9e-96eb-8e0d63adbdcc} --system
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2896

C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir2872_1789892516\GoogleUpdateSetup.exe
"C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir2872_1789892516\GoogleUpdateSetup.exe" /install "runtime=true&needsadmin=true" /installsource chromerecovery /silent
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:3012

C:\Program Files (x86)\Google\Temp\GUMAF62.tmp\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Temp\GUMAF62.tmp\GoogleUpdate.exe" /install "runtime=true&needsadmin=true" /installsource chromerecovery /silent
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2080

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regsvc
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2284

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regserver
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2324

C:\Program Files (x86)\Google\Update\1.3.36.111\GoogleUpdateComRegisterShell64.exe
"C:\Program Files (x86)\Google\Update\1.3.36.111\GoogleUpdateComRegisterShell64.exe"
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2132

C:\Program Files (x86)\Google\Update\1.3.36.111\GoogleUpdateComRegisterShell64.exe
"C:\Program Files (x86)\Google\Update\1.3.36.111\GoogleUpdateComRegisterShell64.exe"
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2220

C:\Program Files (x86)\Google\Update\1.3.36.111\GoogleUpdateComRegisterShell64.exe
"C:\Program Files (x86)\Google\Update\1.3.36.111\GoogleUpdateComRegisterShell64.exe"
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2200

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4xMTEiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4xMTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OTk1MUUwQkUtNDMxNi00NzlBLUI5NTQtREQ2NDg0RTVDMkZFfSIgdXNlcmlkPSJ7NzI0MTFGMUMtMzgyRC00Q0ZELThFMjUtMEY5ODJEREE0QTIyfSIgaW5zdGFsbHNvdXJjZT0iY2hyb21lcmVjb3ZlcnkiIHJlcXVlc3RpZD0iezlGMEY1NUQ4LTA5QkUtNDU4Ny1BNjlCLTlBRUY2OUJFQ0E3QX0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMCIgc3NlNDE9IjAiIHNzZTQyPSIwIiBhdng9IjAiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iNi4xLjc2MDEuMCIgc3A9IlNlcnZpY2UgUGFjayAxIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7NDMwRkQ0RDAtQjcyOS00RjYxLUFBMzQtOTE1MjY0ODE3OTlEfSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMS4zLjM2LjExMSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgaW5zdGFsbF90aW1lX21zPSIxMzA5Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2952

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ua /machine /installsource chromerecovery
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2976

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2484

C:\Program Files (x86)\Google\Update\Install\{30BE9CC2-6023-4B4D-87DD-C0CCCF2611F0}\GoogleUpdateSetup.exe
"C:\Program Files (x86)\Google\Update\Install\{30BE9CC2-6023-4B4D-87DD-C0CCCF2611F0}\GoogleUpdateSetup.exe" /update /sessionid "{B0BEFF10-A093-4923-8DD1-D28321F50A62}"
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1488

C:\Program Files (x86)\Google\Temp\GUM712.tmp\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Temp\GUM712.tmp\GoogleUpdate.exe" /update /sessionid "{B0BEFF10-A093-4923-8DD1-D28321F50A62}"
3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:304

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regsvc
4⤵
- Executes dropped EXE
- Modifies registry class
PID:964

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regserver
4⤵
- Executes dropped EXE
- Modifies registry class
PID:548

C:\Program Files (x86)\Google\Update\1.3.36.112\GoogleUpdateComRegisterShell64.exe
"C:\Program Files (x86)\Google\Update\1.3.36.112\GoogleUpdateComRegisterShell64.exe"
5⤵
- Executes dropped EXE
- Modifies registry class
PID:1540

C:\Program Files (x86)\Google\Update\1.3.36.112\GoogleUpdateComRegisterShell64.exe
"C:\Program Files (x86)\Google\Update\1.3.36.112\GoogleUpdateComRegisterShell64.exe"
5⤵
- Executes dropped EXE
- Modifies registry class
PID:2888

C:\Program Files (x86)\Google\Update\1.3.36.112\GoogleUpdateComRegisterShell64.exe
"C:\Program Files (x86)\Google\Update\1.3.36.112\GoogleUpdateComRegisterShell64.exe"
5⤵
- Executes dropped EXE
- Modifies registry class
PID:1216

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4xMTIiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4xMTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QjBCRUZGMTAtQTA5My00OTIzLThERDEtRDI4MzIxRjUwQTYyfSIgdXNlcmlkPSJ7NzI0MTFGMUMtMzgyRC00Q0ZELThFMjUtMEY5ODJEREE0QTIyfSIgaW5zdGFsbHNvdXJjZT0ic2VsZnVwZGF0ZSIgcmVxdWVzdGlkPSJ7QzAzODYxRjItMTI2OC00Mjk3LUI5OEQtMURFQUFGRkQ4MkJBfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBwaHlzbWVtb3J5PSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIwIiBzc2U0MT0iMCIgc3NlNDI9IjAiIGF2eD0iMCIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSI2LjEuNzYwMS4wIiBzcD0iU2VydmljZSBQYWNrIDEiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9Ins0MzBGRDREMC1CNzI5LTRGNjEtQUEzNC05MTUyNjQ4MTc5OUR9IiB2ZXJzaW9uPSIxLjMuMzYuMTExIiBuZXh0dmVyc2lvbj0iMS4zLjM2LjExMiIgbGFuZz0iIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjaHJvbWVyZWMzPTIwMjE0OVIiIGluc3RhbGxhZ2U9IjI4IiBpbnN0YWxsZGF0ZT0iNTQ0NiIgY29ob3J0PSIxOjljbzoiIGNvaG9ydG5hbWU9IkV2ZXJ5b25lIEVsc2UiPjxldmVudCBldmVudHR5cGU9IjMiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48L2FwcD48L3JlcXVlc3Q-
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3052

C:\Program Files (x86)\Google\Update\1.3.36.111\GoogleCrashHandler.exe
"C:\Program Files (x86)\Google\Update\1.3.36.111\GoogleCrashHandler.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:792

C:\Program Files (x86)\Google\Update\1.3.36.111\GoogleCrashHandler64.exe
"C:\Program Files (x86)\Google\Update\1.3.36.111\GoogleCrashHandler64.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1880

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4xMTEiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4xMTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QjBCRUZGMTAtQTA5My00OTIzLThERDEtRDI4MzIxRjUwQTYyfSIgdXNlcmlkPSJ7NzI0MTFGMUMtMzgyRC00Q0ZELThFMjUtMEY5ODJEREE0QTIyfSIgaW5zdGFsbHNvdXJjZT0iY2hyb21lcmVjb3ZlcnkiIHJlcXVlc3RpZD0iezU0RDNFMjFCLUQ4MkEtNDgxOC04OUFBLTIwQ0YyMUREMzE0Nn0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMCIgc3NlNDE9IjAiIHNzZTQyPSIwIiBhdng9IjAiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iNi4xLjc2MDEuMCIgc3A9IlNlcnZpY2UgUGFjayAxIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7NDMwRkQ0RDAtQjcyOS00RjYxLUFBMzQtOTE1MjY0ODE3OTlEfSIgdmVyc2lvbj0iMS4zLjM2LjExMSIgbmV4dHZlcnNpb249IjEuMy4zNi4xMTIiIGxhbmc9IiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY2hyb21lcmVjMz0yMDIxNDlSIiBpbnN0YWxsYWdlPSIyOCIgaWlkPSJ7OEQ4QjE0NjAtMzA3NS00RjI3LUQ4MzEtOEMwMTU3QkIzNjYwfSIgY29ob3J0PSIxOjljbzoiIGNvaG9ydG5hbWU9IkV2ZXJ5b25lIEVsc2UiPjxldmVudCBldmVudHR5cGU9IjEyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTMiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vZWRnZWRsLm1lLmd2dDEuY29tL2VkZ2VkbC9yZWxlYXNlMi91cGRhdGUyL2FkeG1vbWZ0cmtvaW9kazdhd3l2YTNtejZ1dGFfMS4zLjM2LjExMi9Hb29nbGVVcGRhdGVTZXR1cC5leGUiIGRvd25sb2FkZWQ9IjEzNDEyNzIiIHRvdGFsPSIxMzQxMjcyIiBkb3dubG9hZF90aW1lX21zPSIzNTQ1Ii8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjwvYXBwPjxhcHAgYXBwaWQ9Ins4QTY5RDM0NS1ENTY0LTQ2M0MtQUZGMS1BNjlEOUU1MzBGOTZ9IiB2ZXJzaW9uPSI4OS4wLjQzODkuMTE0IiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY2hyb21lcmVjMz0yMDIxNDlSIiBpbnN0YWxsYWdlPSIyOCIgaWlkPSJ7OEQ4QjE0NjAtMzA3NS00RjI3LUQ4MzEtOEMwMTU3QkIzNjYwfSI-PGV2ZW50IGV2ZW50dHlwZT0iMyIgZXZlbnRyZXN1bHQ9IjkiIGVycm9yY29kZT0iLTE2MDYyMTk3NDgiIGV4dHJhY29kZTE9IjAiLz48L2FwcD48L3JlcXVlc3Q-
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1652

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ea8f00a3-f8dd-4b4a-9787-b28d0d2e6dd7.tmp
MD5
5f50f9bb9570308810409ece15127ae8

SHA1
c980d4a769b654951226fc22c7a7de7bec139189

SHA256
e8ea9de18e45dcf1a276c1b8206ae3f30b826cf4f9df75791b6bb1efb51d7a79

SHA512
d9bde9fdb4dd7f2f4df074b9277e725a3b8116bee5b5eeda4e1d9db98649fb9aac40b82284a4bc8b28f09d713371ab3bab537bb02f2beb2b9711529c2239c4b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\sqlservr.exe\sqlservr.exe
MD5
325d88ea2ee59fc0faec0cd4e6db494e

SHA1
63f2c5cbabd05e857c983741f4b9d71f7fbc6f69

SHA256
eef7b9db43f331b41bfdc87fa0517fbd76981a9b9574fe2ee45bcc1ca390e616

SHA512
6fdc79184bb209c1ec7e4a720fa6aed6a50a6dae2a6773d2c30c71be0eadbf2fb5dad6f906815a977a4081b239a06c4d087bcbb9b01a7aa8ffd8e4f0bb659cc2

Download Submit
C:\Users\Admin\AppData\Local\Temp\sqlservr.exe\sqlservr.exe
MD5
325d88ea2ee59fc0faec0cd4e6db494e

SHA1
63f2c5cbabd05e857c983741f4b9d71f7fbc6f69

SHA256
eef7b9db43f331b41bfdc87fa0517fbd76981a9b9574fe2ee45bcc1ca390e616

SHA512
6fdc79184bb209c1ec7e4a720fa6aed6a50a6dae2a6773d2c30c71be0eadbf2fb5dad6f906815a977a4081b239a06c4d087bcbb9b01a7aa8ffd8e4f0bb659cc2

Download Submit
C:\Users\Admin\AppData\Local\Temp\sqlservr.exe\sqlservr.exe
MD5
325d88ea2ee59fc0faec0cd4e6db494e

SHA1
63f2c5cbabd05e857c983741f4b9d71f7fbc6f69

SHA256
eef7b9db43f331b41bfdc87fa0517fbd76981a9b9574fe2ee45bcc1ca390e616

SHA512
6fdc79184bb209c1ec7e4a720fa6aed6a50a6dae2a6773d2c30c71be0eadbf2fb5dad6f906815a977a4081b239a06c4d087bcbb9b01a7aa8ffd8e4f0bb659cc2

Download Submit
C:\Users\Admin\AppData\Local\Temp\sqlservr.exe\sqlservr.exe
MD5
325d88ea2ee59fc0faec0cd4e6db494e

SHA1
63f2c5cbabd05e857c983741f4b9d71f7fbc6f69

SHA256
eef7b9db43f331b41bfdc87fa0517fbd76981a9b9574fe2ee45bcc1ca390e616

SHA512
6fdc79184bb209c1ec7e4a720fa6aed6a50a6dae2a6773d2c30c71be0eadbf2fb5dad6f906815a977a4081b239a06c4d087bcbb9b01a7aa8ffd8e4f0bb659cc2

Download Submit
\??\pipe\crashpad_1756_EJPNLENAEUXOQWAU
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\sqlservr.exe\sqlservr.exe
MD5
325d88ea2ee59fc0faec0cd4e6db494e

SHA1
63f2c5cbabd05e857c983741f4b9d71f7fbc6f69

SHA256
eef7b9db43f331b41bfdc87fa0517fbd76981a9b9574fe2ee45bcc1ca390e616

SHA512
6fdc79184bb209c1ec7e4a720fa6aed6a50a6dae2a6773d2c30c71be0eadbf2fb5dad6f906815a977a4081b239a06c4d087bcbb9b01a7aa8ffd8e4f0bb659cc2

Download Submit
\Users\Admin\AppData\Local\Temp\sqlservr.exe\sqlservr.exe
MD5
325d88ea2ee59fc0faec0cd4e6db494e

SHA1
63f2c5cbabd05e857c983741f4b9d71f7fbc6f69

SHA256
eef7b9db43f331b41bfdc87fa0517fbd76981a9b9574fe2ee45bcc1ca390e616

SHA512
6fdc79184bb209c1ec7e4a720fa6aed6a50a6dae2a6773d2c30c71be0eadbf2fb5dad6f906815a977a4081b239a06c4d087bcbb9b01a7aa8ffd8e4f0bb659cc2

Download Submit
\Users\Admin\AppData\Local\Temp\sqlservr.exe\sqlservr.exe
MD5
325d88ea2ee59fc0faec0cd4e6db494e

SHA1
63f2c5cbabd05e857c983741f4b9d71f7fbc6f69

SHA256
eef7b9db43f331b41bfdc87fa0517fbd76981a9b9574fe2ee45bcc1ca390e616

SHA512
6fdc79184bb209c1ec7e4a720fa6aed6a50a6dae2a6773d2c30c71be0eadbf2fb5dad6f906815a977a4081b239a06c4d087bcbb9b01a7aa8ffd8e4f0bb659cc2

Download Submit
\Users\Admin\AppData\Local\Temp\sqlservr.exe\sqlservr.exe
MD5
325d88ea2ee59fc0faec0cd4e6db494e

SHA1
63f2c5cbabd05e857c983741f4b9d71f7fbc6f69

SHA256
eef7b9db43f331b41bfdc87fa0517fbd76981a9b9574fe2ee45bcc1ca390e616

SHA512
6fdc79184bb209c1ec7e4a720fa6aed6a50a6dae2a6773d2c30c71be0eadbf2fb5dad6f906815a977a4081b239a06c4d087bcbb9b01a7aa8ffd8e4f0bb659cc2

Download Submit
\Users\Admin\AppData\Local\Temp\sqlservr.exe\sqlservr.exe
MD5
325d88ea2ee59fc0faec0cd4e6db494e

SHA1
63f2c5cbabd05e857c983741f4b9d71f7fbc6f69

SHA256
eef7b9db43f331b41bfdc87fa0517fbd76981a9b9574fe2ee45bcc1ca390e616

SHA512
6fdc79184bb209c1ec7e4a720fa6aed6a50a6dae2a6773d2c30c71be0eadbf2fb5dad6f906815a977a4081b239a06c4d087bcbb9b01a7aa8ffd8e4f0bb659cc2

Download Submit
\Users\Admin\AppData\Local\Temp\sqlservr.exe\sqlservr.exe
MD5
325d88ea2ee59fc0faec0cd4e6db494e

SHA1
63f2c5cbabd05e857c983741f4b9d71f7fbc6f69

SHA256
eef7b9db43f331b41bfdc87fa0517fbd76981a9b9574fe2ee45bcc1ca390e616

SHA512
6fdc79184bb209c1ec7e4a720fa6aed6a50a6dae2a6773d2c30c71be0eadbf2fb5dad6f906815a977a4081b239a06c4d087bcbb9b01a7aa8ffd8e4f0bb659cc2

Download Submit
\Users\Admin\AppData\Local\Temp\sqlservr.exe\sqlservr.exe
MD5
325d88ea2ee59fc0faec0cd4e6db494e

SHA1
63f2c5cbabd05e857c983741f4b9d71f7fbc6f69

SHA256
eef7b9db43f331b41bfdc87fa0517fbd76981a9b9574fe2ee45bcc1ca390e616

SHA512
6fdc79184bb209c1ec7e4a720fa6aed6a50a6dae2a6773d2c30c71be0eadbf2fb5dad6f906815a977a4081b239a06c4d087bcbb9b01a7aa8ffd8e4f0bb659cc2

Download Submit
\Users\Admin\AppData\Local\Temp\sqlservr.exe\sqlservr.exe
MD5
325d88ea2ee59fc0faec0cd4e6db494e

SHA1
63f2c5cbabd05e857c983741f4b9d71f7fbc6f69

SHA256
eef7b9db43f331b41bfdc87fa0517fbd76981a9b9574fe2ee45bcc1ca390e616

SHA512
6fdc79184bb209c1ec7e4a720fa6aed6a50a6dae2a6773d2c30c71be0eadbf2fb5dad6f906815a977a4081b239a06c4d087bcbb9b01a7aa8ffd8e4f0bb659cc2

Download Submit
\Users\Admin\AppData\Local\Temp\sqlservr.exe\sqlservr.exe
MD5
325d88ea2ee59fc0faec0cd4e6db494e

SHA1
63f2c5cbabd05e857c983741f4b9d71f7fbc6f69

SHA256
eef7b9db43f331b41bfdc87fa0517fbd76981a9b9574fe2ee45bcc1ca390e616

SHA512
6fdc79184bb209c1ec7e4a720fa6aed6a50a6dae2a6773d2c30c71be0eadbf2fb5dad6f906815a977a4081b239a06c4d087bcbb9b01a7aa8ffd8e4f0bb659cc2

Download Submit
\Users\Admin\AppData\Local\Temp\sqlservr.exe\sqlservr.exe
MD5
325d88ea2ee59fc0faec0cd4e6db494e

SHA1
63f2c5cbabd05e857c983741f4b9d71f7fbc6f69

SHA256
eef7b9db43f331b41bfdc87fa0517fbd76981a9b9574fe2ee45bcc1ca390e616

SHA512
6fdc79184bb209c1ec7e4a720fa6aed6a50a6dae2a6773d2c30c71be0eadbf2fb5dad6f906815a977a4081b239a06c4d087bcbb9b01a7aa8ffd8e4f0bb659cc2

Download Submit
\Users\Admin\AppData\Local\Temp\sqlservr.exe\sqlservr.exe
MD5
325d88ea2ee59fc0faec0cd4e6db494e

SHA1
63f2c5cbabd05e857c983741f4b9d71f7fbc6f69

SHA256
eef7b9db43f331b41bfdc87fa0517fbd76981a9b9574fe2ee45bcc1ca390e616

SHA512
6fdc79184bb209c1ec7e4a720fa6aed6a50a6dae2a6773d2c30c71be0eadbf2fb5dad6f906815a977a4081b239a06c4d087bcbb9b01a7aa8ffd8e4f0bb659cc2

Download Submit
\Users\Admin\AppData\Local\Temp\sqlservr.exe\sqlservr.exe
MD5
325d88ea2ee59fc0faec0cd4e6db494e

SHA1
63f2c5cbabd05e857c983741f4b9d71f7fbc6f69

SHA256
eef7b9db43f331b41bfdc87fa0517fbd76981a9b9574fe2ee45bcc1ca390e616

SHA512
6fdc79184bb209c1ec7e4a720fa6aed6a50a6dae2a6773d2c30c71be0eadbf2fb5dad6f906815a977a4081b239a06c4d087bcbb9b01a7aa8ffd8e4f0bb659cc2

Download Submit
\Users\Admin\AppData\Local\Temp\sqlservr.exe\sqlservr.exe
MD5
325d88ea2ee59fc0faec0cd4e6db494e

SHA1
63f2c5cbabd05e857c983741f4b9d71f7fbc6f69

SHA256
eef7b9db43f331b41bfdc87fa0517fbd76981a9b9574fe2ee45bcc1ca390e616

SHA512
6fdc79184bb209c1ec7e4a720fa6aed6a50a6dae2a6773d2c30c71be0eadbf2fb5dad6f906815a977a4081b239a06c4d087bcbb9b01a7aa8ffd8e4f0bb659cc2

Download Submit
\Users\Admin\AppData\Local\Temp\sqlservr.exe\sqlservr.exe
MD5
325d88ea2ee59fc0faec0cd4e6db494e

SHA1
63f2c5cbabd05e857c983741f4b9d71f7fbc6f69

SHA256
eef7b9db43f331b41bfdc87fa0517fbd76981a9b9574fe2ee45bcc1ca390e616

SHA512
6fdc79184bb209c1ec7e4a720fa6aed6a50a6dae2a6773d2c30c71be0eadbf2fb5dad6f906815a977a4081b239a06c4d087bcbb9b01a7aa8ffd8e4f0bb659cc2

Download Submit
\Users\Admin\AppData\Local\Temp\sqlservr.exe\sqlservr.exe
MD5
325d88ea2ee59fc0faec0cd4e6db494e

SHA1
63f2c5cbabd05e857c983741f4b9d71f7fbc6f69

SHA256
eef7b9db43f331b41bfdc87fa0517fbd76981a9b9574fe2ee45bcc1ca390e616

SHA512
6fdc79184bb209c1ec7e4a720fa6aed6a50a6dae2a6773d2c30c71be0eadbf2fb5dad6f906815a977a4081b239a06c4d087bcbb9b01a7aa8ffd8e4f0bb659cc2

Download Submit
\Users\Admin\AppData\Local\Temp\sqlservr.exe\sqlservr.exe
MD5
325d88ea2ee59fc0faec0cd4e6db494e

SHA1
63f2c5cbabd05e857c983741f4b9d71f7fbc6f69

SHA256
eef7b9db43f331b41bfdc87fa0517fbd76981a9b9574fe2ee45bcc1ca390e616

SHA512
6fdc79184bb209c1ec7e4a720fa6aed6a50a6dae2a6773d2c30c71be0eadbf2fb5dad6f906815a977a4081b239a06c4d087bcbb9b01a7aa8ffd8e4f0bb659cc2

Download Submit
\Users\Admin\AppData\Local\Temp\sqlservr.exe\sqlservr.exe
MD5
325d88ea2ee59fc0faec0cd4e6db494e

SHA1
63f2c5cbabd05e857c983741f4b9d71f7fbc6f69

SHA256
eef7b9db43f331b41bfdc87fa0517fbd76981a9b9574fe2ee45bcc1ca390e616

SHA512
6fdc79184bb209c1ec7e4a720fa6aed6a50a6dae2a6773d2c30c71be0eadbf2fb5dad6f906815a977a4081b239a06c4d087bcbb9b01a7aa8ffd8e4f0bb659cc2

Download Submit
\Users\Admin\AppData\Local\Temp\sqlservr.exe\sqlservr.exe
MD5
325d88ea2ee59fc0faec0cd4e6db494e

SHA1
63f2c5cbabd05e857c983741f4b9d71f7fbc6f69

SHA256
eef7b9db43f331b41bfdc87fa0517fbd76981a9b9574fe2ee45bcc1ca390e616

SHA512
6fdc79184bb209c1ec7e4a720fa6aed6a50a6dae2a6773d2c30c71be0eadbf2fb5dad6f906815a977a4081b239a06c4d087bcbb9b01a7aa8ffd8e4f0bb659cc2

Download Submit
\Users\Admin\AppData\Local\Temp\sqlservr.exe\sqlservr.exe
MD5
325d88ea2ee59fc0faec0cd4e6db494e

SHA1
63f2c5cbabd05e857c983741f4b9d71f7fbc6f69

SHA256
eef7b9db43f331b41bfdc87fa0517fbd76981a9b9574fe2ee45bcc1ca390e616

SHA512
6fdc79184bb209c1ec7e4a720fa6aed6a50a6dae2a6773d2c30c71be0eadbf2fb5dad6f906815a977a4081b239a06c4d087bcbb9b01a7aa8ffd8e4f0bb659cc2

Download Submit
\Users\Admin\AppData\Local\Temp\sqlservr.exe\sqlservr.exe
MD5
325d88ea2ee59fc0faec0cd4e6db494e

SHA1
63f2c5cbabd05e857c983741f4b9d71f7fbc6f69

SHA256
eef7b9db43f331b41bfdc87fa0517fbd76981a9b9574fe2ee45bcc1ca390e616

SHA512
6fdc79184bb209c1ec7e4a720fa6aed6a50a6dae2a6773d2c30c71be0eadbf2fb5dad6f906815a977a4081b239a06c4d087bcbb9b01a7aa8ffd8e4f0bb659cc2

Download Submit
\Users\Admin\AppData\Local\Temp\sqlservr.exe\sqlservr.exe
MD5
325d88ea2ee59fc0faec0cd4e6db494e

SHA1
63f2c5cbabd05e857c983741f4b9d71f7fbc6f69

SHA256
eef7b9db43f331b41bfdc87fa0517fbd76981a9b9574fe2ee45bcc1ca390e616

SHA512
6fdc79184bb209c1ec7e4a720fa6aed6a50a6dae2a6773d2c30c71be0eadbf2fb5dad6f906815a977a4081b239a06c4d087bcbb9b01a7aa8ffd8e4f0bb659cc2

Download Submit
\Users\Admin\AppData\Local\Temp\sqlservr.exe\sqlservr.exe
MD5
325d88ea2ee59fc0faec0cd4e6db494e

SHA1
63f2c5cbabd05e857c983741f4b9d71f7fbc6f69

SHA256
eef7b9db43f331b41bfdc87fa0517fbd76981a9b9574fe2ee45bcc1ca390e616

SHA512
6fdc79184bb209c1ec7e4a720fa6aed6a50a6dae2a6773d2c30c71be0eadbf2fb5dad6f906815a977a4081b239a06c4d087bcbb9b01a7aa8ffd8e4f0bb659cc2

Download Submit
\Users\Admin\AppData\Local\Temp\sqlservr.exe\sqlservr.exe
MD5
325d88ea2ee59fc0faec0cd4e6db494e

SHA1
63f2c5cbabd05e857c983741f4b9d71f7fbc6f69

SHA256
eef7b9db43f331b41bfdc87fa0517fbd76981a9b9574fe2ee45bcc1ca390e616

SHA512
6fdc79184bb209c1ec7e4a720fa6aed6a50a6dae2a6773d2c30c71be0eadbf2fb5dad6f906815a977a4081b239a06c4d087bcbb9b01a7aa8ffd8e4f0bb659cc2

Download Submit
\Users\Admin\AppData\Local\Temp\sqlservr.exe\sqlservr.exe
MD5
325d88ea2ee59fc0faec0cd4e6db494e

SHA1
63f2c5cbabd05e857c983741f4b9d71f7fbc6f69

SHA256
eef7b9db43f331b41bfdc87fa0517fbd76981a9b9574fe2ee45bcc1ca390e616

SHA512
6fdc79184bb209c1ec7e4a720fa6aed6a50a6dae2a6773d2c30c71be0eadbf2fb5dad6f906815a977a4081b239a06c4d087bcbb9b01a7aa8ffd8e4f0bb659cc2

Download Submit
memory/304-227-0x0000000000000000-mapping.dmp

Download
memory/548-242-0x0000000000000000-mapping.dmp

Download
memory/608-59-0x00000000760C1000-0x00000000760C3000-memory.dmp

Filesize
8KB

Download
memory/608-58-0x0000000000000000-mapping.dmp

Download
memory/792-222-0x0000000000000000-mapping.dmp

Download
memory/896-56-0x0000000000000000-mapping.dmp

Download
memory/964-240-0x0000000000000000-mapping.dmp

Download
memory/1136-239-0x0000000000000000-mapping.dmp

Download
memory/1164-55-0x000007FEFBDE1000-0x000007FEFBDE3000-memory.dmp

Filesize
8KB

Download
memory/1216-246-0x0000000000000000-mapping.dmp

Download
memory/1488-220-0x0000000000000000-mapping.dmp

Download
memory/1540-244-0x0000000000000000-mapping.dmp

Download
memory/1624-187-0x000007FFFFBD0000-0x000007FFFFFA1000-memory.dmp

Filesize
3.8MB

Download
memory/1624-156-0x0000000000000000-mapping.dmp

Download
memory/1652-225-0x0000000000000000-mapping.dmp

Download
memory/1880-224-0x0000000000000000-mapping.dmp

Download
memory/1916-250-0x0000000000C00000-0x0000000000C40000-memory.dmp

Filesize
256KB

Download
memory/1916-249-0x0000000000520000-0x0000000000560000-memory.dmp

Filesize
256KB

Download
memory/1916-219-0x0000000000000000-mapping.dmp

Download
memory/1916-251-0x0000000000520000-0x0000000000560000-memory.dmp

Filesize
256KB

Download
memory/2080-192-0x0000000000000000-mapping.dmp

Download
memory/2132-198-0x0000000000000000-mapping.dmp

Download
memory/2200-200-0x0000000000000000-mapping.dmp

Download
memory/2220-199-0x0000000000000000-mapping.dmp

Download
memory/2224-154-0x000000013F1D0000-0x000000014052B000-memory.dmp

Filesize
19.4MB

Download
memory/2224-153-0x000000013F1D0000-0x000000014052B000-memory.dmp

Filesize
19.4MB

Download
memory/2224-152-0x000000013F1D0000-0x000000014052B000-memory.dmp

Filesize
19.4MB

Download
memory/2224-144-0x000007FFFFBD0000-0x000007FFFFFA1000-memory.dmp

Filesize
3.8MB

Download
memory/2224-123-0x0000000000000000-mapping.dmp

Download
memory/2264-101-0x00000000774E0000-0x00000000774F0000-memory.dmp

Filesize
64KB

Download
memory/2264-119-0x000000013FB20000-0x0000000140E7B000-memory.dmp

Filesize
19.4MB

Download
memory/2264-121-0x0000000002090000-0x00000000020A4000-memory.dmp

Filesize
80KB

Download
memory/2264-91-0x00000000774E0000-0x00000000774F0000-memory.dmp

Filesize
64KB

Download
memory/2264-92-0x00000000774E0000-0x00000000774F0000-memory.dmp

Filesize
64KB

Download
memory/2264-94-0x00000000774E0000-0x00000000774F0000-memory.dmp

Filesize
64KB

Download
memory/2264-96-0x00000000774E0000-0x00000000774F0000-memory.dmp

Filesize
64KB

Download
memory/2264-98-0x00000000774E0000-0x00000000774F0000-memory.dmp

Filesize
64KB

Download
memory/2264-99-0x00000000774E0000-0x00000000774F0000-memory.dmp

Filesize
64KB

Download
memory/2264-100-0x00000000774E0000-0x00000000774F0000-memory.dmp

Filesize
64KB

Download
memory/2264-102-0x00000000774E0000-0x00000000774F0000-memory.dmp

Filesize
64KB

Download
memory/2264-104-0x00000000774E0000-0x00000000774F0000-memory.dmp

Filesize
64KB

Download
memory/2264-103-0x00000000774E0000-0x00000000774F0000-memory.dmp

Filesize
64KB

Download
memory/2264-106-0x00000000774E0000-0x00000000774F0000-memory.dmp

Filesize
64KB

Download
memory/2264-93-0x00000000774E0000-0x00000000774F0000-memory.dmp

Filesize
64KB

Download
memory/2264-95-0x00000000774E0000-0x00000000774F0000-memory.dmp

Filesize
64KB

Download
memory/2264-97-0x00000000774E0000-0x00000000774F0000-memory.dmp

Filesize
64KB

Download
memory/2264-105-0x00000000774E0000-0x00000000774F0000-memory.dmp

Filesize
64KB

Download
memory/2264-107-0x00000000774E0000-0x00000000774F0000-memory.dmp

Filesize
64KB

Download
memory/2264-109-0x00000000774E0000-0x00000000774F0000-memory.dmp

Filesize
64KB

Download
memory/2264-111-0x00000000774E0000-0x00000000774F0000-memory.dmp

Filesize
64KB

Download
memory/2264-108-0x00000000774E0000-0x00000000774F0000-memory.dmp

Filesize
64KB

Download
memory/2264-110-0x00000000774E0000-0x00000000774F0000-memory.dmp

Filesize
64KB

Download
memory/2264-120-0x000000013FB20000-0x0000000140E7B000-memory.dmp

Filesize
19.4MB

Download
memory/2264-115-0x00000000774E0000-0x00000000774F0000-memory.dmp

Filesize
64KB

Download
memory/2264-116-0x00000000774E0000-0x00000000774F0000-memory.dmp

Filesize
64KB

Download
memory/2264-114-0x00000000774E0000-0x00000000774F0000-memory.dmp

Filesize
64KB

Download
memory/2264-113-0x00000000774E0000-0x00000000774F0000-memory.dmp

Filesize
64KB

Download
memory/2264-117-0x000000013FB20000-0x0000000140E7B000-memory.dmp

Filesize
19.4MB

Download
memory/2264-112-0x00000000774E0000-0x00000000774F0000-memory.dmp

Filesize
64KB

Download
memory/2264-118-0x000007FFFFBD0000-0x000007FFFFFA1000-memory.dmp

Filesize
3.8MB

Download
memory/2284-194-0x0000000000000000-mapping.dmp

Download
memory/2324-196-0x0000000000000000-mapping.dmp

Download
memory/2416-208-0x0000000000000000-mapping.dmp

Download
memory/2424-207-0x0000000000000000-mapping.dmp

Download
memory/2628-63-0x0000000000000000-mapping.dmp

Download
memory/2696-61-0x0000000000000000-mapping.dmp

Download
memory/2880-62-0x0000000000000000-mapping.dmp

Download
memory/2888-245-0x0000000000000000-mapping.dmp

Download
memory/2896-188-0x0000000000000000-mapping.dmp

Download
memory/2952-201-0x0000000000000000-mapping.dmp

Download
memory/2976-203-0x0000000000000000-mapping.dmp

Download
memory/2976-206-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/3012-190-0x0000000000000000-mapping.dmp

Download
memory/3052-247-0x0000000000000000-mapping.dmp

Download