hxxps://youtube[.]com

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Creates new service(s) 1 TTPs
persistence

New Service
T1050
Executes dropped EXE 8 IoCs

Processes:

Setup.exeKMSpico.exeKMSpico.tmpUninsHs.exeKMSELDI.exeSECOH-QAD.exeKMSELDI.exeAutoPico.exe

pid process

5060 Setup.exe
5076 KMSpico.exe
5116 KMSpico.tmp
3092 UninsHs.exe
2500 KMSELDI.exe
596 SECOH-QAD.exe
4864 KMSELDI.exe
5028 AutoPico.exe
Sets file execution options in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

pid	process
5060	Setup.exe
5076	KMSpico.exe
5116	KMSpico.tmp
3092	UninsHs.exe
2500	KMSELDI.exe
596	SECOH-QAD.exe
4864	KMSELDI.exe
5028	AutoPico.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Setup.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Setup.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Program Files (x86)\ulmous1\Setup.exe	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

Setup.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Setup.exe
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

[email protected]

description ioc process

File opened for modification \??\PhysicalDrive0 [email protected]

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Setup.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	[email protected]

Drops file in System32 directory 3 IoCs

Processes:

KMSpico.tmp

description	ioc	process
File opened for modification	C:\Windows\System32\Vestris.ResourceLib.dll	KMSpico.tmp
File created	C:\Windows\system32\is-9CDRN.tmp	KMSpico.tmp
File created	C:\Windows\system32\is-DRQH2.tmp	KMSpico.tmp

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

Setup.exe

pid process

5060 Setup.exe

pid	process
5060	Setup.exe

Drops file in Program Files directory 64 IoCs

Processes:

KMSpico.tmpKMSELDI.exe

description	ioc	process
File created	C:\Program Files\KMSpico\cert\kmscert2013\Standard\is-CTHIG.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-H0IT7.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscertW8\Enterprise\is-CNKSP.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscertW8\Professional\is-911TP.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\icons\is-8GL4V.tmp	KMSpico.tmp
File opened for modification	C:\Program Files\KMSpico\TokensBackup\Keys.txt	KMSELDI.exe
File created	C:\Program Files\KMSpico\cert\kmscert2010\Excel\is-GJ2GN.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2010\OneNote\is-39BPT.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2010\ProjectStd\is-KNMF7.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-8PVHI.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2013\OneNote\is-8G7H0.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2013\VisioPro\is-P11U5.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2016\VisioStd\is-RRJR9.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-3BU24.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscertW8\CoreN\is-ILGTD.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscertW81\Enterprise\is-CK5EE.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\scripts\is-SKK99.tmp	KMSpico.tmp
File opened for modification	C:\Program Files\KMSpico\Vestris.ResourceLib.dll	KMSpico.tmp
File created	C:\Program Files\KMSpico\is-KSREP.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2010\Access\is-2LEC7.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2010\Standard\is-0RCOB.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2010\Standard\is-0O7UM.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscertW6\Business\is-TP4F5.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscertW7\Professional\is-RNCC4.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\sounds\is-9U78F.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2010\Excel\is-S95AC.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2013\ProjectStd\is-FJ002.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\is-VV9BR.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\driver\is-LVKCS.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\is-J6F6T.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\is-4M2U0.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscertW6\Business\is-PBUD2.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-2AUPN.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2010\ProPlus\is-AFC2V.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2010\Standard\is-J4NR6.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2013\is-3DDTS.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2013\Excel\is-VLGPB.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2016\Access\is-L1D1U.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscertW10\Education\is-FI9IN.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscertW7\Professional\is-KBST6.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2010\Access\is-NBPO3.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2010\Groove\is-8SFLA.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2010\Publisher\is-3CIJE.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2010\Publisher\is-FO31K.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscertW10\Education\is-I1388.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\scripts\is-LA3F9.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\sounds\is-CDAC5.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-DIFB4.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2016\is-4R3KF.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2016\Outlook\is-FT77L.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2016\ProPlus\is-KCPVO.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-RM5HL.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-6K9FG.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\TokensBackup\Windows\cache\cache.dat	KMSELDI.exe
File created	C:\Program Files\KMSpico\cert\kmscert2010\Access\is-0HFI1.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2010\ProPlus\is-77CRF.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscertW6\Business\is-NC8IP.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscertW8\is-131QR.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\scripts\is-JNM9O.tmp	KMSpico.tmp
File opened for modification	C:\Program Files\KMSpico\unins000.dat	KMSpico.tmp
File opened for modification	C:\Program Files\KMSpico\TokensBackup\Windows\data.dat	KMSELDI.exe
File created	C:\Program Files\KMSpico\cert\kmscert2010\Outlook\is-7U7NL.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2010\ProPlus\is-MIJNO.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-QJGVS.tmp	KMSpico.tmp

Drops file in Windows directory 7 IoCs

Processes:

taskmgr.exeKMSELDI.exeSystemSettings.exe

description	ioc	process
File created	C:\Windows\rescache\_merged\2717123927\1253081315.pri	taskmgr.exe
File created	C:\Windows\SECOH-QAD.dll	KMSELDI.exe
File created	C:\Windows\SECOH-QAD.exe	KMSELDI.exe
File created	C:\Windows\rescache\_merged\4183903823\97717462.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\1601268389\1361672858.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\2717123927\1253081315.pri	SystemSettings.exe
File created	C:\Windows\rescache\_merged\3060194815\1650753000.pri	SystemSettings.exe

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 7 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exeSystemSettings.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	SystemSettings.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	SystemSettings.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SystemSettings.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	SystemSettings.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Setup.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Setup.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3688 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

4324 timeout.exe

pid	process
3688	schtasks.exe

pid	process
4324	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command-Line Interface
T1059

Processes:

NETSTAT.EXE

pid process

4920 NETSTAT.EXE

pid	process
4920	NETSTAT.EXE

Modifies Control Panel 1 IoCs

evasion

Processes:

AutoPico.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Control Panel\Desktop\PaintDesktopVersion = "0"	AutoPico.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

Processes:

KMSpico.tmp

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter	KMSpico.tmp
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 = "0"	KMSpico.tmp

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8db62ff13956941acf514a4778508d700000000020000000000106600000001000020000000daa8b59fd5b7ab10062c30541e304ecce3f884ed405cbc7d71877d361a18dea9000000000e80000000020000200000008a32e28044eecb39f6fe348a732d0affaf7cba4fc38924116b9e00e9594677d92000000078904096b3865633e86e973e37b8f1b4c99859cc436334d66ac4adbb3a14c21540000000cb7b48fd5871f71d55075c66effee5c095f55ccf33b4e124eb78d1deb8c1ac4993a36de3f04169bddc706ebb4ffeec6ccd6a5ece399cebfd7d83c31628db09bd	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "115"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "6"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "115"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "6"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "0"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0f6b6c0a9f2d701	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8db62ff13956941acf514a4778508d7000000000200000000001066000000010000200000000686f50c807146b1be1a4dc592c2bdb6442721a689a97d60d141415b90124a4c000000000e800000000200002000000090c202d2ba738899f2a19c68ac3248f3185fd3687d9d3b83b1687e010bd8a023900000001902861628ac39f76cf2a0b3dfaca0b701d1f56d36ab0f99bbd2b819dfca9d746314a7cafd481894e9ede7e07fc377350d3646766c5815d5c22042e34aa7c2ac50b83088bffb5cfb99243e9fe5fd626ab10b55d7e4b0aefd302839b6ab4808abc383985a4d36d46c3b54825a0c1de581c11e28d50f38418baa1d9c26090e5b6a3d921752171fd1749e413469135e94c440000000892a119f146ec1f6136accc79ac237ced74f8a1eaa4ce5bdf03c2eaa3b6fa85f13b348bea40eb6f6664d164d7a51197ec2922342f3c6a515456cee7176fd2f1f	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6E50A818-60F8-11EC-9231-EEE0EE18725B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8db62ff13956941acf514a4778508d70000000002000000000010660000000100002000000005bbe29a677011c9061998464f56f4dd58be470ca657f3507726b3080fd7592e000000000e8000000002000020000000379ee1cd4bb9a7d9415d5826be1ac5653d72029a24556bc345caf7c7c4cca56f900000004fbfac71a3cd8e0daeccadf98b42a40220a1e0aaf20f7a671d5388d70630d0c926245bc679644be307159e0ac15bbbf900956539c6a2348f5d7faa566ab0601608b832e146d913544e373e68d8782bb79f7675eeff35ca61577a18b73016906f68dd6d00c65d38de505ba80332dc9463bcb5576ca36169b46906b8bad85f5928ef9abb6c39d2560a9088910bca05db1d400000009e2c178ce60260dd900c83d1980e0d502b32bf46d1495c96f8d6fa385a5578d743caef9eb049bd966ffd0f49486eab4d2fa274635a9e39a1375acccdae2fc9f7	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "6"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "115"	IEXPLORE.EXE

Modifies data under HKEY_USERS 13 IoCs

Processes:

SppExtComObj.exeAutoPico.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\55c92734-d682-4d71-983e-d6ec3f16059f	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\55c92734-d682-4d71-983e-d6ec3f16059f\2de67392-b7a7-462a-b1ca-108dd189f588	SppExtComObj.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\55c92734-d682-4d71-983e-d6ec3f16059f\2de67392-b7a7-462a-b1ca-108dd189f588\DiscoveredKeyManagementServiceIpAddress	AutoPico.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\55c92734-d682-4d71-983e-d6ec3f16059f\2de67392-b7a7-462a-b1ca-108dd189f588	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663\d450596f-894d-49e0-966a-fd39ed4c4c64	SppExtComObj.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\55c92734-d682-4d71-983e-d6ec3f16059f\2de67392-b7a7-462a-b1ca-108dd189f588\DiscoveredKeyManagementServiceIpAddress = "10.198.229.63"	SppExtComObj.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663\d450596f-894d-49e0-966a-fd39ed4c4c64\DiscoveredKeyManagementServiceIpAddress = "fe80::291f:14ef:6ff3:d935%3"	SppExtComObj.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663\d450596f-894d-49e0-966a-fd39ed4c4c64\DiscoveredKeyManagementServiceIpAddress	AutoPico.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform	SppExtComObj.exe

Modifies registry class 2 IoCs

Processes:

chrome.execontrol.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings	control.exe

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

4920 NOTEPAD.EXE

pid	process
4920	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

chrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exeSetup.exechrome.exeKMSpico.tmpSECOH-QAD.exeKMSELDI.exetaskmgr.exeAutoPico.exe

pid	process
1208	chrome.exe
1208	chrome.exe
1360	chrome.exe
1360	chrome.exe
2008	chrome.exe
2008	chrome.exe
196	chrome.exe
196	chrome.exe
4320	chrome.exe
4320	chrome.exe
4396	chrome.exe
4396	chrome.exe
4496	chrome.exe
4496	chrome.exe
4672	chrome.exe
4672	chrome.exe
4720	chrome.exe
4720	chrome.exe
5060	Setup.exe
5060	Setup.exe
4132	chrome.exe
4132	chrome.exe
4132	chrome.exe
4132	chrome.exe
5116	KMSpico.tmp
5116	KMSpico.tmp
596	SECOH-QAD.exe
596	SECOH-QAD.exe
596	SECOH-QAD.exe
596	SECOH-QAD.exe
596	SECOH-QAD.exe
596	SECOH-QAD.exe
4864	KMSELDI.exe
4864	KMSELDI.exe
4864	KMSELDI.exe
4864	KMSELDI.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
5028	AutoPico.exe
5028	AutoPico.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

taskmgr.exe

pid process

4824 taskmgr.exe

pid	process
4824	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

Processes:

chrome.exe

pid	process
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

Processes:

KMSELDI.exesvchost.exeNETSTAT.EXEKMSELDI.exeAutoPico.exesvchost.exetaskmgr.execontrol.exe[email protected]

description	pid	process
Token: SeSystemtimePrivilege	2500	KMSELDI.exe
Token: SeSystemtimePrivilege	1168	svchost.exe
Token: SeSystemtimePrivilege	1168	svchost.exe
Token: SeIncBasePriorityPrivilege	1168	svchost.exe
Token: SeDebugPrivilege	4920	NETSTAT.EXE
Token: SeDebugPrivilege	4864	KMSELDI.exe
Token: SeSystemtimePrivilege	1168	svchost.exe
Token: SeSystemtimePrivilege	5028	AutoPico.exe
Token: SeSystemtimePrivilege	4864	KMSELDI.exe
Token: SeSystemtimePrivilege	3064	svchost.exe
Token: SeSystemtimePrivilege	3064	svchost.exe
Token: SeIncBasePriorityPrivilege	3064	svchost.exe
Token: SeDebugPrivilege	4824	taskmgr.exe
Token: SeSystemProfilePrivilege	4824	taskmgr.exe
Token: SeCreateGlobalPrivilege	4824	taskmgr.exe
Token: SeDebugPrivilege	5028	AutoPico.exe
Token: SeShutdownPrivilege	4424	control.exe
Token: SeCreatePagefilePrivilege	4424	control.exe
Token: 33	4824	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4824	taskmgr.exe
Token: SeShutdownPrivilege	4304	[email protected]

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

iexplore.exechrome.exeKMSpico.tmptaskmgr.exe

pid	process
2688	iexplore.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
5116	KMSpico.tmp
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

chrome.exetaskmgr.exe

pid	process
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
1360	chrome.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe
4824	taskmgr.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXESystemSettings.exe[email protected]

pid process

2688 iexplore.exe
2688 iexplore.exe
576 IEXPLORE.EXE
576 IEXPLORE.EXE
4896 SystemSettings.exe
4304 [email protected]

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

iexplore.exechrome.exe

description	pid	process	target process
PID 2688 wrote to memory of 576	2688	iexplore.exe	IEXPLORE.EXE
PID 2688 wrote to memory of 576	2688	iexplore.exe	IEXPLORE.EXE
PID 2688 wrote to memory of 576	2688	iexplore.exe	IEXPLORE.EXE
PID 1360 wrote to memory of 2272	1360	chrome.exe	chrome.exe
PID 1360 wrote to memory of 2272	1360	chrome.exe	chrome.exe
PID 1360 wrote to memory of 1204	1360	chrome.exe	chrome.exe
PID 1360 wrote to memory of 1204	1360	chrome.exe	chrome.exe
PID 1360 wrote to memory of 1204	1360	chrome.exe	chrome.exe
PID 1360 wrote to memory of 1204	1360	chrome.exe	chrome.exe
PID 1360 wrote to memory of 1204	1360	chrome.exe	chrome.exe
PID 1360 wrote to memory of 1204	1360	chrome.exe	chrome.exe
PID 1360 wrote to memory of 1204	1360	chrome.exe	chrome.exe
PID 1360 wrote to memory of 1204	1360	chrome.exe	chrome.exe
PID 1360 wrote to memory of 1204	1360	chrome.exe	chrome.exe
PID 1360 wrote to memory of 1204	1360	chrome.exe	chrome.exe
PID 1360 wrote to memory of 1204	1360	chrome.exe	chrome.exe
PID 1360 wrote to memory of 1204	1360	chrome.exe	chrome.exe
PID 1360 wrote to memory of 1204	1360	chrome.exe	chrome.exe
PID 1360 wrote to memory of 1204	1360	chrome.exe	chrome.exe
PID 1360 wrote to memory of 1204	1360	chrome.exe	chrome.exe
PID 1360 wrote to memory of 1204	1360	chrome.exe	chrome.exe
PID 1360 wrote to memory of 1204	1360	chrome.exe	chrome.exe
PID 1360 wrote to memory of 1204	1360	chrome.exe	chrome.exe
PID 1360 wrote to memory of 1204	1360	chrome.exe	chrome.exe
PID 1360 wrote to memory of 1204	1360	chrome.exe	chrome.exe
PID 1360 wrote to memory of 1204	1360	chrome.exe	chrome.exe
PID 1360 wrote to memory of 1204	1360	chrome.exe	chrome.exe
PID 1360 wrote to memory of 1204	1360	chrome.exe	chrome.exe
PID 1360 wrote to memory of 1204	1360	chrome.exe	chrome.exe
PID 1360 wrote to memory of 1204	1360	chrome.exe	chrome.exe
PID 1360 wrote to memory of 1204	1360	chrome.exe	chrome.exe
PID 1360 wrote to memory of 1204	1360	chrome.exe	chrome.exe
PID 1360 wrote to memory of 1204	1360	chrome.exe	chrome.exe
PID 1360 wrote to memory of 1204	1360	chrome.exe	chrome.exe
PID 1360 wrote to memory of 1204	1360	chrome.exe	chrome.exe
PID 1360 wrote to memory of 1204	1360	chrome.exe	chrome.exe
PID 1360 wrote to memory of 1204	1360	chrome.exe	chrome.exe
PID 1360 wrote to memory of 1204	1360	chrome.exe	chrome.exe
PID 1360 wrote to memory of 1204	1360	chrome.exe	chrome.exe
PID 1360 wrote to memory of 1204	1360	chrome.exe	chrome.exe
PID 1360 wrote to memory of 1204	1360	chrome.exe	chrome.exe
PID 1360 wrote to memory of 1204	1360	chrome.exe	chrome.exe
PID 1360 wrote to memory of 1204	1360	chrome.exe	chrome.exe
PID 1360 wrote to memory of 1204	1360	chrome.exe	chrome.exe
PID 1360 wrote to memory of 1204	1360	chrome.exe	chrome.exe
PID 1360 wrote to memory of 1208	1360	chrome.exe	chrome.exe
PID 1360 wrote to memory of 1208	1360	chrome.exe	chrome.exe
PID 1360 wrote to memory of 2828	1360	chrome.exe	chrome.exe
PID 1360 wrote to memory of 2828	1360	chrome.exe	chrome.exe
PID 1360 wrote to memory of 2828	1360	chrome.exe	chrome.exe
PID 1360 wrote to memory of 2828	1360	chrome.exe	chrome.exe
PID 1360 wrote to memory of 2828	1360	chrome.exe	chrome.exe
PID 1360 wrote to memory of 2828	1360	chrome.exe	chrome.exe
PID 1360 wrote to memory of 2828	1360	chrome.exe	chrome.exe
PID 1360 wrote to memory of 2828	1360	chrome.exe	chrome.exe
PID 1360 wrote to memory of 2828	1360	chrome.exe	chrome.exe
PID 1360 wrote to memory of 2828	1360	chrome.exe	chrome.exe
PID 1360 wrote to memory of 2828	1360	chrome.exe	chrome.exe
PID 1360 wrote to memory of 2828	1360	chrome.exe	chrome.exe
PID 1360 wrote to memory of 2828	1360	chrome.exe	chrome.exe
PID 1360 wrote to memory of 2828	1360	chrome.exe	chrome.exe
PID 1360 wrote to memory of 2828	1360	chrome.exe	chrome.exe
PID 1360 wrote to memory of 2828	1360	chrome.exe	chrome.exe
PID 1360 wrote to memory of 2828	1360	chrome.exe	chrome.exe

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://youtube.com
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2688

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2688 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:576

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1360

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xd0,0xd4,0xd8,0xac,0xdc,0x7fff21f84f50,0x7fff21f84f60,0x7fff21f84f70
2⤵
PID:2272

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1504,4751583338882711434,3893084112202147150,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1648 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1208

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1504,4751583338882711434,3893084112202147150,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1600 /prefetch:2
2⤵
PID:1204

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1504,4751583338882711434,3893084112202147150,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2396 /prefetch:1
2⤵
PID:3920

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1504,4751583338882711434,3893084112202147150,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
2⤵
PID:852

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1504,4751583338882711434,3893084112202147150,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2384 /prefetch:1
2⤵
PID:2828

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1504,4751583338882711434,3893084112202147150,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3636 /prefetch:1
2⤵
PID:832

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1504,4751583338882711434,3893084112202147150,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4316 /prefetch:8
2⤵
PID:936

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1504,4751583338882711434,3893084112202147150,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4372 /prefetch:8
2⤵
PID:2516

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1504,4751583338882711434,3893084112202147150,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4488 /prefetch:8
2⤵
PID:3712

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1504,4751583338882711434,3893084112202147150,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4376 /prefetch:8
2⤵
PID:2252

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1504,4751583338882711434,3893084112202147150,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4720 /prefetch:8
2⤵
PID:2216

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1504,4751583338882711434,3893084112202147150,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4716 /prefetch:8
2⤵
PID:3880

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1504,4751583338882711434,3893084112202147150,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4784 /prefetch:8
2⤵
PID:1668

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1504,4751583338882711434,3893084112202147150,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4980 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2008

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1504,4751583338882711434,3893084112202147150,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
2⤵
PID:2684

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1504,4751583338882711434,3893084112202147150,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2636 /prefetch:8
2⤵
PID:3964

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1504,4751583338882711434,3893084112202147150,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4880 /prefetch:8
2⤵
PID:2128

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1504,4751583338882711434,3893084112202147150,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4708 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:196

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1504,4751583338882711434,3893084112202147150,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4572 /prefetch:8
2⤵
PID:3996

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1504,4751583338882711434,3893084112202147150,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4672 /prefetch:8
2⤵
PID:676

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1504,4751583338882711434,3893084112202147150,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4864 /prefetch:8
2⤵
PID:1708

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1504,4751583338882711434,3893084112202147150,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5512 /prefetch:8
2⤵
PID:3800

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1504,4751583338882711434,3893084112202147150,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
2⤵
PID:3628

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1504,4751583338882711434,3893084112202147150,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4540 /prefetch:8
2⤵
PID:1424

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1504,4751583338882711434,3893084112202147150,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4424 /prefetch:8
2⤵
PID:3024

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1504,4751583338882711434,3893084112202147150,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
2⤵
PID:3964

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1504,4751583338882711434,3893084112202147150,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
2⤵
PID:1488

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1504,4751583338882711434,3893084112202147150,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
2⤵
PID:580

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1504,4751583338882711434,3893084112202147150,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
2⤵
PID:2848

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1504,4751583338882711434,3893084112202147150,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2040 /prefetch:1
2⤵
PID:1952

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1504,4751583338882711434,3893084112202147150,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5368 /prefetch:8
2⤵
PID:584

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1504,4751583338882711434,3893084112202147150,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2696 /prefetch:1
2⤵
PID:3092

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1504,4751583338882711434,3893084112202147150,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6184 /prefetch:1
2⤵
PID:1308

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1504,4751583338882711434,3893084112202147150,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6428 /prefetch:8
2⤵
PID:1080

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1504,4751583338882711434,3893084112202147150,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6472 /prefetch:8
2⤵
PID:3920

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1504,4751583338882711434,3893084112202147150,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4684 /prefetch:8
2⤵
PID:388

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1504,4751583338882711434,3893084112202147150,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6588 /prefetch:8
2⤵
PID:900

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1504,4751583338882711434,3893084112202147150,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6672 /prefetch:8
2⤵
PID:4108

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1504,4751583338882711434,3893084112202147150,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4620 /prefetch:1
2⤵
PID:4196

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1504,4751583338882711434,3893084112202147150,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
2⤵
PID:4204

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1504,4751583338882711434,3893084112202147150,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6192 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4320

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1504,4751583338882711434,3893084112202147150,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5640 /prefetch:8
2⤵
PID:4388

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1504,4751583338882711434,3893084112202147150,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2664 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4396

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1504,4751583338882711434,3893084112202147150,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4708 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4496

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1504,4751583338882711434,3893084112202147150,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5660 /prefetch:8
2⤵
PID:4532

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1504,4751583338882711434,3893084112202147150,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
2⤵
PID:4604

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1504,4751583338882711434,3893084112202147150,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4672

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1504,4751583338882711434,3893084112202147150,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5484 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4720

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1504,4751583338882711434,3893084112202147150,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6556 /prefetch:8
2⤵
PID:4812

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1504,4751583338882711434,3893084112202147150,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4480 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4132

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1504,4751583338882711434,3893084112202147150,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1416 /prefetch:8
2⤵
PID:3140

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1504,4751583338882711434,3893084112202147150,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
2⤵
PID:5060

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1504,4751583338882711434,3893084112202147150,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6840 /prefetch:1
2⤵
PID:3172

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1504,4751583338882711434,3893084112202147150,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6296 /prefetch:1
2⤵
PID:5116

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1504,4751583338882711434,3893084112202147150,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7080 /prefetch:8
2⤵
PID:5012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1504,4751583338882711434,3893084112202147150,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6620 /prefetch:1
2⤵
PID:4324

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1504,4751583338882711434,3893084112202147150,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6900 /prefetch:1
2⤵
PID:1408

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1504,4751583338882711434,3893084112202147150,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6908 /prefetch:1
2⤵
PID:4936

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1504,4751583338882711434,3893084112202147150,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6436 /prefetch:1
2⤵
PID:4896

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1504,4751583338882711434,3893084112202147150,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6620 /prefetch:8
2⤵
PID:4512

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1504,4751583338882711434,3893084112202147150,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5132 /prefetch:8
2⤵
PID:4368

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1504,4751583338882711434,3893084112202147150,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3880 /prefetch:1
2⤵
PID:2684

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1504,4751583338882711434,3893084112202147150,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7140 /prefetch:8
2⤵
PID:4164

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1504,4751583338882711434,3893084112202147150,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6296 /prefetch:8
2⤵
PID:592

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4788

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_KMSpico.zip\PASSWORD.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4920

C:\Users\Admin\Desktop\KMSpico.exe
"C:\Users\Admin\Desktop\KMSpico.exe"
1⤵
PID:5004

C:\Program Files (x86)\ulmous1\Setup.exe
"C:\Program Files (x86)\ulmous1\Setup.exe"
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:5060

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\KwQNWiufMFweW & timeout 4 & del /f /q "C:\Program Files (x86)\ulmous1\Setup.exe"
3⤵
PID:4024

C:\Windows\SysWOW64\timeout.exe
timeout 4
4⤵
- Delays execution with timeout.exe
PID:4324

C:\Program Files (x86)\ulmous1\KMSpico.exe
"C:\Program Files (x86)\ulmous1\KMSpico.exe"
2⤵
- Executes dropped EXE
PID:5076

C:\Users\Admin\AppData\Local\Temp\is-ES6JC.tmp\KMSpico.tmp
"C:\Users\Admin\AppData\Local\Temp\is-ES6JC.tmp\KMSpico.tmp" /SL5="$A007E,2952592,69120,C:\Program Files (x86)\ulmous1\KMSpico.exe"
3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer Phishing Filter
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:5116

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /C ""C:\Program Files\KMSpico\scripts\Install_Service.cmd""
4⤵
PID:1212

C:\Windows\system32\sc.exe
sc create "Service KMSELDI" binPath= "C:\Program Files\KMSpico\Service_KMS.exe" type= own error= normal start= auto DisplayName= "Service KMSELDI"
5⤵
PID:3672

C:\Program Files\KMSpico\UninsHs.exe
"C:\Program Files\KMSpico\UninsHs.exe" /r0=KMSpico,default,C:\Program Files (x86)\ulmous1\KMSpico.exe
4⤵
- Executes dropped EXE
PID:3092

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /C ""C:\Program Files\KMSpico\scripts\Install_Task.cmd""
4⤵
PID:1404

C:\Windows\system32\schtasks.exe
SCHTASKS /Create /TN "AutoPico Daily Restart" /TR "'C:\Program Files\KMSpico\AutoPico.exe' /silent" /SC DAILY /ST 23:59:59 /RU "NT AUTHORITY\SYSTEM" /RL Highest /F
5⤵
- Creates scheduled task(s)
PID:3688

C:\Program Files\KMSpico\KMSELDI.exe
"C:\Program Files\KMSpico\KMSELDI.exe" /silent /backup
4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2500

C:\Program Files\KMSpico\AutoPico.exe
"C:\Program Files\KMSpico\AutoPico.exe" /silent
4⤵
- Executes dropped EXE
- Modifies Control Panel
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1168

C:\Windows\SECOH-QAD.exe
C:\Windows\SECOH-QAD.exe C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:596

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
2⤵
- Modifies data under HKEY_USERS
PID:3996

C:\Windows\System32\SLUI.exe
"C:\Windows\System32\SLUI.exe" RuleId=eeba1977-569e-4571-b639-7623d8bfecc0;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=2de67392-b7a7-462a-b1ca-108dd189f588;NotificationInterval=1440;Trigger=TimerEvent
3⤵
PID:4768

C:\Windows\System32\SLUI.exe
"C:\Windows\System32\SLUI.exe" RuleId=379cccfb-d4e0-48fe-b0f2-0136097be147;Action=CleanupState;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=2de67392-b7a7-462a-b1ca-108dd189f588;Trigger=TimerEvent
3⤵
PID:4892

C:\Program Files\KMSpico\KMSELDI.exe
"C:\Program Files\KMSpico\KMSELDI.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4864

C:\Windows\System32\NETSTAT.EXE
"C:\Windows\System32\NETSTAT.EXE" -ano
2⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:4920

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3064

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4824

C:\Windows\ImmersiveControlPanel\SystemSettings.exe
"C:\Windows\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanel
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
PID:4896

C:\Windows\system32\control.exe
"C:\Windows\system32\control.exe" SYSTEM
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4424

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:4364

C:\Users\Admin\Desktop\[email protected]
"C:\Users\Admin\Desktop\[email protected]"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4304

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Command-Line Interface

T1059

Persistence

New Service

T1050

Registry Run Keys / Startup Folder

T1060

Bootkit

T1067

Scheduled Task

T1053

Privilege Escalation

New Service

T1050

Scheduled Task

T1053

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\ulmous1\Setup.exe
MD5
4b1185a9b391004aaeee7480d359cf0d

SHA1
30885d1b438d0322886f8215e48d3d7ba4ed09d1

SHA256
f3fe0d892978245d08f3adcc2f4a1984382accef8cbe51c35c47d5d23aedb769

SHA512
021af29b840172acf91db4ddf7e884402d84a3f1ae7ac7b09c39377ed5b3fdc1da7c92ead5f900c67caf41ebb5eaab2ffcb3f0a1972d624ff5539d888d9f4e3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
MD5
3f35a3844e16f03b5a60b7d276e887f1

SHA1
612a6a3b3ae655c18c85dfd2d0dcb7f4ee3a305f

SHA256
cc318426da54dc585faa68d9f6b7d29f1ae2ae1572e86ce7053df5dfcae09d94

SHA512
f29b740f5422f25187d72ee492a0e9f1414bbca010f868eb6bab27d73e45e0d19e5ab9ad3f10a1068c6810c0ae54f50866d9ccb7fe149b7afb60464e630165d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_76F26EDEF7C1087F80A272B48769819E
MD5
da9e2a6ff6021a01b9994f954c0c3b38

SHA1
511262ecb22a96d48e9db54f6c3ecd943e076f10

SHA256
873c7a0f931466ed1745f887e1090177e9ee5b837b8795749386ccf8e99eddb4

SHA512
ebddb6578cce49b806db2e8583460dd4f6b80ab9d2eeb59ed3f0da32602673cc97a4b56bbdc51bed113feaae0f5de24e440cdfa04c918915a1bb98fa10d20c57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_0AE9B8959CC6B5E55E9855B0CD3DEAFA
MD5
96ebfb7a47c307b5979aff346170247a

SHA1
214fd811cbc80ab83aa0a082d8f33b2881b81ada

SHA256
1015320a62f1468ac8cee74eb418b9afb785ba40d2e6f3d04e86ecd51d67caf5

SHA512
61486fe34d88910cc3aebc9f1532303682a641a7132097fe6f44837cc81628a97c372fc38748e292951b84feb2ae11168cd1e57bd8383d3408a5182ef4de17a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_30F32374BEBB4A72181B36E407396E90
MD5
810acb1cda9a9171078c57f6f1569413

SHA1
3ce341fdafd6af03f935780bfe9dfcf7226232b7

SHA256
9e59fedee59905f90a2d7ef18c09a59f661bce98f747c878bfb92d1f38f43418

SHA512
1d945acb14202ffbc346e1f5f6abbc5ceb470170ab23cf0887a0abfa0461271c112a68c21862191c3ef359a98b4f272fb2585ef6723730e52e23e381e1ee78fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
MD5
64e9b8bb98e2303717538ce259bec57d

SHA1
2b07bf8e0d831da42760c54feff484635009c172

SHA256
76bd459ec8e467efc3e3fb94cb21b9c77a2aa73c9d4c0f3faf823677be756331

SHA512
8980af4a87a009f1ae165182d1edd4ccbd12b40a5890de5dbaea4dbf3aeb86edffd58b088b1e35e12d6b1197cc0db658a9392283583b3cb24a516ebc1f736c56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_9641559E442FE3E0D68934A8083C5D76
MD5
901c296fbb83dfe266931aeb4b3bfb8c

SHA1
c10153d43d11a28e91a08c25d151b67332378a92

SHA256
f86a74540a21e46eabe03e2c0914f99e8bce78108530b8108c327a947dddff8f

SHA512
c46a1c0e189fd3e93fc9ff909956e020d19f1913630faf9b89159a020fbe78c0ac5db2350a959036a2d780b7a5a450bec1b2373f8d8b21a8d31abea785ab2ebb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
MD5
e235e8dd9172519afd4b21965c0bca0f

SHA1
e1d3e5abd18b4ff33b8f1f0777917893c422aae6

SHA256
2ac999e7aba245cce60bae11d4f1dc0481bc07b0dd6d2e69a83ad768b5926aa1

SHA512
f70e0987dba83bafb5e7a9d14e8aee5275fec8fddd7230689160cef15bf57ceca4730afc093ba71a437f1c2f7cd885e8b04493b4a0c70d6b157f7c5c983b81d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_76F26EDEF7C1087F80A272B48769819E
MD5
aef3ba91ceda82ef2968c668d2df4353

SHA1
7757c1b19601ec9020a6404955417cc9188f1c4b

SHA256
64921cd31fdf66896b2eec6336702471a3b8e3e9847f9817af0b786231c173f3

SHA512
e9e4facbe5d40535ed6d0a7bef17e093360218bf0644e296e1a6d9fbba6bca29cbf8c426e4d38cf150f9cb1310158628e373f0a94e5d3c64a7c85f1733604d08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_0AE9B8959CC6B5E55E9855B0CD3DEAFA
MD5
651cb2bc70b9e24bd862e98bf46a976d

SHA1
7c834cada95f6a68897b487f1bf0126847aeca17

SHA256
e42c3fe9270afbf9795ae23d7bbceb2c6c8d5f90effa85bd4df683f592f7f154

SHA512
653b23a4d89efd599ea4d3e4b22237aa25f7e2bbd0bdf0612e8ee4cf7f2dd49941b116ce36b917b39628eb77d745302d491b8be96786b1ba6bde4676e6e487dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_30F32374BEBB4A72181B36E407396E90
MD5
7ab77946b40481274948d3bac4583225

SHA1
5a029e2b982f13400a584ec4b0dd6645aa61518c

SHA256
c71fd72e33cfa4c9d695dfebcf824d8a53fcf4313db2e02618eec601e5bf264e

SHA512
02914beb9a5ecfc5d45ecc81f11b4fd630a3187e8a01b7557fae20259bc411fef4737d9320c9a1d82b0c270f1af91dd6dfe8274171297a0ed77f9b3df5f56e7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
MD5
6e8dfb9707bb965e6a1a2a27baa43c3f

SHA1
a94d9936b4dd72bff172a9773cef83de2a1673e1

SHA256
770673a9edceb7b14848da83de8c6986cea2ad69af239967bb61a5da9ed1cfa6

SHA512
3d717f964cfe0b5cf47e82c1047e43dfb76baa69d57fe720762be6b565d14600d5870ee16f45b65fa40968b30c7283ca4f1ae3d28432c51a55edb80d489982b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_9641559E442FE3E0D68934A8083C5D76
MD5
5812ad70758e11f2311fd7fa32c80fee

SHA1
ede42803d61cc60354a00b37ffb1d5aafebe8122

SHA256
949529675a489c3d972af6a88f4c29e6f8f1e69e27cd11e811843b18843b375d

SHA512
e4173bb5c9a978c9d455161a66f0ca7ce9c534ec6180da5add4b276131a02985a0c25fed514677aa309a8c2b8679e9ca052f78f88930a2b936f527d4852a4f6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\0NYHFRKO.cookie
MD5
bf240eef8b4780b1c8e08a69cb1874e0

SHA1
b5ad441aa1ff221d2ea34fbe78640eeaf8b61fdb

SHA256
27fe41b7b1640c9735af20a8321659f9ba9cf75d8665707aaa92be986ca58ce8

SHA512
bc2847770b9a0d57807c8923fb89a16925fb5f335ceb7540a896a666a2f6c68338ef52665a1c2c3c157782e01101768c29cd0dd62e6ae30b117ce0a4f19589b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\9E0543Q2.cookie
MD5
ee6eda278676f8efe202efbaa631fde6

SHA1
2129d506e0e11074077d3d3a28eec9ff65852e5c

SHA256
fd94ee3d5908f4ca8bbb46080df5cdd1d72d9f398a1485317a3a0c760ff32028

SHA512
4895f022da80c7f9987a0b89196d2e6cd7d57dc924531a6d38d7723c79ed8cd0f9e9786da4951c42bc868f2aff997fd407af2dfccbd348ba8346afd20ec76b6a

Download Submit
\??\pipe\crashpad_1360_MKNDRQSGMOACEOCO
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/576-140-0x0000000000000000-mapping.dmp

Download
memory/1212-219-0x0000000000000000-mapping.dmp

Download
memory/1404-220-0x0000000000000000-mapping.dmp

Download
memory/2500-223-0x0000000000000000-mapping.dmp

Download
memory/2500-230-0x000000001C350000-0x000000001C352000-memory.dmp

Filesize
8KB

Download
memory/2500-231-0x000000001C352000-0x000000001C354000-memory.dmp

Filesize
8KB

Download
memory/2500-232-0x000000001C354000-0x000000001C355000-memory.dmp

Filesize
4KB

Download
memory/2500-233-0x000000001C357000-0x000000001C359000-memory.dmp

Filesize
8KB

Download
memory/2500-234-0x000000001C355000-0x000000001C357000-memory.dmp

Filesize
8KB

Download
memory/2500-235-0x000000001C359000-0x000000001C35F000-memory.dmp

Filesize
24KB

Download
memory/2688-165-0x00007FFF21FC0000-0x00007FFF2202B000-memory.dmp

Filesize
428KB

Download
memory/2688-136-0x00007FFF21FC0000-0x00007FFF2202B000-memory.dmp

Filesize
428KB

Download
memory/2688-151-0x00007FFF21FC0000-0x00007FFF2202B000-memory.dmp

Filesize
428KB

Download
memory/2688-155-0x00007FFF21FC0000-0x00007FFF2202B000-memory.dmp

Filesize
428KB

Download
memory/2688-156-0x00007FFF21FC0000-0x00007FFF2202B000-memory.dmp

Filesize
428KB

Download
memory/2688-157-0x00007FFF21FC0000-0x00007FFF2202B000-memory.dmp

Filesize
428KB

Download
memory/2688-163-0x00007FFF21FC0000-0x00007FFF2202B000-memory.dmp

Filesize
428KB

Download
memory/2688-164-0x00007FFF21FC0000-0x00007FFF2202B000-memory.dmp

Filesize
428KB

Download
memory/2688-115-0x00007FFF21FC0000-0x00007FFF2202B000-memory.dmp

Filesize
428KB

Download
memory/2688-166-0x00007FFF21FC0000-0x00007FFF2202B000-memory.dmp

Filesize
428KB

Download
memory/2688-167-0x00007FFF21FC0000-0x00007FFF2202B000-memory.dmp

Filesize
428KB

Download
memory/2688-168-0x00007FFF21FC0000-0x00007FFF2202B000-memory.dmp

Filesize
428KB

Download
memory/2688-169-0x00007FFF21FC0000-0x00007FFF2202B000-memory.dmp

Filesize
428KB

Download
memory/2688-149-0x00007FFF21FC0000-0x00007FFF2202B000-memory.dmp

Filesize
428KB

Download
memory/2688-173-0x00007FFF21FC0000-0x00007FFF2202B000-memory.dmp

Filesize
428KB

Download
memory/2688-176-0x00007FFF21FC0000-0x00007FFF2202B000-memory.dmp

Filesize
428KB

Download
memory/2688-179-0x00007FFF21FC0000-0x00007FFF2202B000-memory.dmp

Filesize
428KB

Download
memory/2688-180-0x00007FFF21FC0000-0x00007FFF2202B000-memory.dmp

Filesize
428KB

Download
memory/2688-147-0x00007FFF21FC0000-0x00007FFF2202B000-memory.dmp

Filesize
428KB

Download
memory/2688-145-0x00007FFF21FC0000-0x00007FFF2202B000-memory.dmp

Filesize
428KB

Download
memory/2688-144-0x00007FFF21FC0000-0x00007FFF2202B000-memory.dmp

Filesize
428KB

Download
memory/2688-142-0x00007FFF21FC0000-0x00007FFF2202B000-memory.dmp

Filesize
428KB

Download
memory/2688-141-0x00007FFF21FC0000-0x00007FFF2202B000-memory.dmp

Filesize
428KB

Download
memory/2688-138-0x00007FFF21FC0000-0x00007FFF2202B000-memory.dmp

Filesize
428KB

Download
memory/2688-137-0x00007FFF21FC0000-0x00007FFF2202B000-memory.dmp

Filesize
428KB

Download
memory/2688-119-0x00007FFF21FC0000-0x00007FFF2202B000-memory.dmp

Filesize
428KB

Download
memory/2688-135-0x00007FFF21FC0000-0x00007FFF2202B000-memory.dmp

Filesize
428KB

Download
memory/2688-133-0x00007FFF21FC0000-0x00007FFF2202B000-memory.dmp

Filesize
428KB

Download
memory/2688-132-0x00007FFF21FC0000-0x00007FFF2202B000-memory.dmp

Filesize
428KB

Download
memory/2688-131-0x00007FFF21FC0000-0x00007FFF2202B000-memory.dmp

Filesize
428KB

Download
memory/2688-129-0x00007FFF21FC0000-0x00007FFF2202B000-memory.dmp

Filesize
428KB

Download
memory/2688-128-0x00007FFF21FC0000-0x00007FFF2202B000-memory.dmp

Filesize
428KB

Download
memory/2688-127-0x00007FFF21FC0000-0x00007FFF2202B000-memory.dmp

Filesize
428KB

Download
memory/2688-120-0x00007FFF21FC0000-0x00007FFF2202B000-memory.dmp

Filesize
428KB

Download
memory/2688-150-0x00007FFF21FC0000-0x00007FFF2202B000-memory.dmp

Filesize
428KB

Download
memory/2688-121-0x00007FFF21FC0000-0x00007FFF2202B000-memory.dmp

Filesize
428KB

Download
memory/2688-122-0x00007FFF21FC0000-0x00007FFF2202B000-memory.dmp

Filesize
428KB

Download
memory/2688-116-0x00007FFF21FC0000-0x00007FFF2202B000-memory.dmp

Filesize
428KB

Download
memory/2688-117-0x00007FFF21FC0000-0x00007FFF2202B000-memory.dmp

Filesize
428KB

Download
memory/2688-125-0x00007FFF21FC0000-0x00007FFF2202B000-memory.dmp

Filesize
428KB

Download
memory/2688-123-0x00007FFF21FC0000-0x00007FFF2202B000-memory.dmp

Filesize
428KB

Download
memory/2688-124-0x00007FFF21FC0000-0x00007FFF2202B000-memory.dmp

Filesize
428KB

Download
memory/3092-222-0x0000000000000000-mapping.dmp

Download
memory/3672-227-0x0000000000000000-mapping.dmp

Download
memory/3688-228-0x0000000000000000-mapping.dmp

Download
memory/3996-236-0x0000000000000000-mapping.dmp

Download
memory/4024-221-0x0000000000000000-mapping.dmp

Download
memory/4304-301-0x00000000001E0000-0x00000000001F2000-memory.dmp

Filesize
72KB

Download
memory/4324-224-0x0000000000000000-mapping.dmp

Download
memory/4768-239-0x0000000000000000-mapping.dmp

Download
memory/4864-243-0x000000001C4D0000-0x000000001C4D2000-memory.dmp

Filesize
8KB

Download
memory/4864-273-0x00000000205C0000-0x00000000205D0000-memory.dmp

Filesize
64KB

Download
memory/4864-299-0x00000000205C0000-0x00000000205D0000-memory.dmp

Filesize
64KB

Download
memory/4864-298-0x00000000205C0000-0x00000000205D0000-memory.dmp

Filesize
64KB

Download
memory/4864-297-0x00000000205C0000-0x00000000205D0000-memory.dmp

Filesize
64KB

Download
memory/4864-296-0x00000000205C0000-0x00000000205D0000-memory.dmp

Filesize
64KB

Download
memory/4864-244-0x000000001C4D2000-0x000000001C4D4000-memory.dmp

Filesize
8KB

Download
memory/4864-295-0x000000001FC70000-0x000000001FC80000-memory.dmp

Filesize
64KB

Download
memory/4864-294-0x00000000205C0000-0x00000000205D0000-memory.dmp

Filesize
64KB

Download
memory/4864-265-0x00000000205C0000-0x00000000205D0000-memory.dmp

Filesize
64KB

Download
memory/4864-250-0x000000001C4D4000-0x000000001C4D5000-memory.dmp

Filesize
4KB

Download
memory/4864-251-0x00000000205C0000-0x00000000205D0000-memory.dmp

Filesize
64KB

Download
memory/4864-252-0x00000000205E0000-0x00000000205F0000-memory.dmp

Filesize
64KB

Download
memory/4864-253-0x00000000205C0000-0x00000000205D0000-memory.dmp

Filesize
64KB

Download
memory/4864-254-0x00000000205C0000-0x00000000205D0000-memory.dmp

Filesize
64KB

Download
memory/4864-256-0x00000000205C0000-0x00000000205D0000-memory.dmp

Filesize
64KB

Download
memory/4864-257-0x00000000205C0000-0x00000000205D0000-memory.dmp

Filesize
64KB

Download
memory/4864-258-0x00000000205C0000-0x00000000205D0000-memory.dmp

Filesize
64KB

Download
memory/4864-255-0x00000000205C0000-0x00000000205D0000-memory.dmp

Filesize
64KB

Download
memory/4864-259-0x00000000205C0000-0x00000000205D0000-memory.dmp

Filesize
64KB

Download
memory/4864-260-0x00000000205C0000-0x00000000205D0000-memory.dmp

Filesize
64KB

Download
memory/4864-261-0x00000000205C0000-0x00000000205D0000-memory.dmp

Filesize
64KB

Download
memory/4864-262-0x00000000205C0000-0x00000000205D0000-memory.dmp

Filesize
64KB

Download
memory/4864-263-0x00000000205C0000-0x00000000205D0000-memory.dmp

Filesize
64KB

Download
memory/4864-264-0x00000000205C0000-0x00000000205D0000-memory.dmp

Filesize
64KB

Download
memory/4864-266-0x00000000205C0000-0x00000000205D0000-memory.dmp

Filesize
64KB

Download
memory/4864-267-0x00000000205C0000-0x00000000205D0000-memory.dmp

Filesize
64KB

Download
memory/4864-268-0x0000000020690000-0x00000000206A0000-memory.dmp

Filesize
64KB

Download
memory/4864-269-0x00000000205C0000-0x00000000205D0000-memory.dmp

Filesize
64KB

Download
memory/4864-270-0x00000000205C0000-0x00000000205D0000-memory.dmp

Filesize
64KB

Download
memory/4864-272-0x00000000205C0000-0x00000000205D0000-memory.dmp

Filesize
64KB

Download
memory/4864-271-0x00000000205C0000-0x00000000205D0000-memory.dmp

Filesize
64KB

Download
memory/4864-274-0x0000000020690000-0x00000000206A0000-memory.dmp

Filesize
64KB

Download
memory/4864-277-0x00000000205C0000-0x00000000205D0000-memory.dmp

Filesize
64KB

Download
memory/4864-276-0x00000000205C0000-0x00000000205D0000-memory.dmp

Filesize
64KB

Download
memory/4864-278-0x00000000205C0000-0x00000000205D0000-memory.dmp

Filesize
64KB

Download
memory/4864-279-0x00000000205C0000-0x00000000205D0000-memory.dmp

Filesize
64KB

Download
memory/4864-280-0x00000000206A0000-0x00000000206B0000-memory.dmp

Filesize
64KB

Download
memory/4864-284-0x00000000205C0000-0x00000000205D0000-memory.dmp

Filesize
64KB

Download
memory/4864-283-0x00000000205C0000-0x00000000205D0000-memory.dmp

Filesize
64KB

Download
memory/4864-285-0x00000000205C0000-0x00000000205D0000-memory.dmp

Filesize
64KB

Download
memory/4864-286-0x00000000209A0000-0x00000000209B0000-memory.dmp

Filesize
64KB

Download
memory/4864-288-0x00000000205C0000-0x00000000205D0000-memory.dmp

Filesize
64KB

Download
memory/4864-290-0x00000000205C0000-0x00000000205D0000-memory.dmp

Filesize
64KB

Download
memory/4864-291-0x000000001C4D7000-0x000000001C4D9000-memory.dmp

Filesize
8KB

Download
memory/4864-292-0x000000001C4D5000-0x000000001C4D7000-memory.dmp

Filesize
8KB

Download
memory/4864-293-0x000000001C4D9000-0x000000001C4DF000-memory.dmp

Filesize
24KB

Download
memory/4864-289-0x00000000205C0000-0x00000000205D0000-memory.dmp

Filesize
64KB

Download
memory/4864-287-0x00000000205C0000-0x00000000205D0000-memory.dmp

Filesize
64KB

Download
memory/4864-282-0x00000000205C0000-0x00000000205D0000-memory.dmp

Filesize
64KB

Download
memory/4864-281-0x00000000205C0000-0x00000000205D0000-memory.dmp

Filesize
64KB

Download
memory/4864-275-0x00000000205C0000-0x00000000205D0000-memory.dmp

Filesize
64KB

Download
memory/4892-300-0x0000000000000000-mapping.dmp

Download
memory/4920-245-0x0000000000000000-mapping.dmp

Download
memory/5028-249-0x000000001BCF0000-0x000000001BCF2000-memory.dmp

Filesize
8KB

Download
memory/5028-246-0x0000000000000000-mapping.dmp

Download
memory/5060-213-0x00000000777F0000-0x000000007797E000-memory.dmp

Filesize
1.6MB

Download
memory/5060-206-0x0000000000000000-mapping.dmp

Download
memory/5076-208-0x0000000000000000-mapping.dmp

Download
memory/5076-212-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/5116-214-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/5116-211-0x0000000000000000-mapping.dmp

Download