Resubmissions
29-12-2021 12:45
211229-py8v3sdddn 1029-12-2021 11:51
211229-n1lb5addbm 829-12-2021 11:50
211229-nzsptaegg6 129-12-2021 11:24
211229-nh59ksege9 128-12-2021 11:54
211228-n21s7sdgg2 828-12-2021 11:53
211228-n2tpwscdbj 128-12-2021 11:51
211228-nz82sscdaq 128-12-2021 11:38
211228-nryk4acdal 1028-12-2021 11:37
211228-nq735sdge9 1Analysis
-
max time kernel
370s -
max time network
408s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
28-12-2021 11:38
General
-
Target
https://www.youtube.com/channel/UCn2OJocEFxegDrjKZMIfnLw
Score
10/10
Malware Config
Extracted
Family
vidar
Version
49.2
Botnet
915
C2
https://mstdn.social/@kipriauk9
https://qoto.org/@kipriauk8
Attributes
-
profile_id
915
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 1 IoCs
-
Registers COM server for autorun 1 TTPs
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
suricata: ET MALWARE Fake Software Download Redirect Leading to Malware M3
suricata: ET MALWARE Fake Software Download Redirect Leading to Malware M3
-
NirSoft WebBrowserPassView 1 IoCs
Password recovery tool for various web browsers
-
Nirsoft 1 IoCs
-
Vidar Stealer 2 IoCs
-
Downloads MZ/PE file
-
Executes dropped EXE 53 IoCs
-
Sets file execution options in registry 2 TTPs
-
VMProtect packed file 1 IoCs
Detects executables packed with VMProtect commercial packer.
-
Loads dropped DLL 37 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Drops file in System32 directory 14 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 10 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 12 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 6 IoCs
-
Modifies data under HKEY_USERS 19 IoCs
-
Modifies registry class 64 IoCs
-
Modifies system certificate store 2 TTPs 2 IoCs
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: LoadsDriver 12 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 29 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 25 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/channel/UCn2OJocEFxegDrjKZMIfnLw1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xd0,0xd4,0xd8,0xac,0xdc,0x7ffbf2374f50,0x7ffbf2374f60,0x7ffbf2374f702⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1516,2869393384838357965,422427696186662551,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2212 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1516,2869393384838357965,422427696186662551,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1524 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1516,2869393384838357965,422427696186662551,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2244 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1516,2869393384838357965,422427696186662551,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2924 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1516,2869393384838357965,422427696186662551,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2912 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1516,2869393384838357965,422427696186662551,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4044 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1516,2869393384838357965,422427696186662551,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4276 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1516,2869393384838357965,422427696186662551,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1516,2869393384838357965,422427696186662551,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1516,2869393384838357965,422427696186662551,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5036 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1516,2869393384838357965,422427696186662551,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5160 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1516,2869393384838357965,422427696186662551,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5324 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1516,2869393384838357965,422427696186662551,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5312 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1516,2869393384838357965,422427696186662551,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3024 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1516,2869393384838357965,422427696186662551,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5828 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1516,2869393384838357965,422427696186662551,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5992 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\setup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\setup.exe" --reenable-autoupdates --system-level2⤵
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\setup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff758cda890,0x7ff758cda8a0,0x7ff758cda8b03⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1516,2869393384838357965,422427696186662551,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5992 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1516,2869393384838357965,422427696186662551,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5180 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1516,2869393384838357965,422427696186662551,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5248 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1516,2869393384838357965,422427696186662551,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2956 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1516,2869393384838357965,422427696186662551,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5476 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1516,2869393384838357965,422427696186662551,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5860 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1516,2869393384838357965,422427696186662551,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5888 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1516,2869393384838357965,422427696186662551,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5932 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1516,2869393384838357965,422427696186662551,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4092 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1516,2869393384838357965,422427696186662551,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3528 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1516,2869393384838357965,422427696186662551,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4100 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1516,2869393384838357965,422427696186662551,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4632 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1516,2869393384838357965,422427696186662551,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4572 /prefetch:12⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4EB962AA\Tue112399042edee163a.exeTue112399042edee163a.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,2869393384838357965,422427696186662551,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5352 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,2869393384838357965,422427696186662551,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5860 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1516,2869393384838357965,422427696186662551,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4368 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,2869393384838357965,422427696186662551,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4864 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,2869393384838357965,422427696186662551,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5488 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1516,2869393384838357965,422427696186662551,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4136 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1516,2869393384838357965,422427696186662551,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6096 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1516,2869393384838357965,422427696186662551,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6024 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\Downloads\HeavyLoad-x64-Setup.exe"C:\Users\Admin\Downloads\HeavyLoad-x64-Setup.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-F0BSU.tmp\HeavyLoad-x64-Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-F0BSU.tmp\HeavyLoad-x64-Setup.tmp" /SL5="$90230,14724492,798208,C:\Users\Admin\Downloads\HeavyLoad-x64-Setup.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\JAM Software\HeavyLoad\HeavyLoad.exe"C:\Program Files\JAM Software\HeavyLoad\HeavyLoad.exe" /nogui /installcertificate4⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\JAM Software\HeavyLoad\HeavyLoad.exe"C:\Program Files\JAM Software\HeavyLoad\HeavyLoad.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1516,2869393384838357965,422427696186662551,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2424 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1516,2869393384838357965,422427696186662551,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1520 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Drops file in System32 directory
- Drops file in Windows directory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffbf2374f50,0x7ffbf2374f60,0x7ffbf2374f702⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1504,5639113309881989063,9673409304843776312,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1512 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1504,5639113309881989063,9673409304843776312,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2112 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1504,5639113309881989063,9673409304843776312,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2524 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1504,5639113309881989063,9673409304843776312,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2508 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1504,5639113309881989063,9673409304843776312,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1504,5639113309881989063,9673409304843776312,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1888 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1504,5639113309881989063,9673409304843776312,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3580 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1504,5639113309881989063,9673409304843776312,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3876 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1504,5639113309881989063,9673409304843776312,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4020 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1504,5639113309881989063,9673409304843776312,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3968 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1504,5639113309881989063,9673409304843776312,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3876 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1504,5639113309881989063,9673409304843776312,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4632 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1504,5639113309881989063,9673409304843776312,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3648 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1504,5639113309881989063,9673409304843776312,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4008 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1504,5639113309881989063,9673409304843776312,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2736 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1504,5639113309881989063,9673409304843776312,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2688 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1504,5639113309881989063,9673409304843776312,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3416 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1504,5639113309881989063,9673409304843776312,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5276 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1504,5639113309881989063,9673409304843776312,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1504,5639113309881989063,9673409304843776312,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1504,5639113309881989063,9673409304843776312,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1504,5639113309881989063,9673409304843776312,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5544 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1504,5639113309881989063,9673409304843776312,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3208 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1504,5639113309881989063,9673409304843776312,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5796 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1504,5639113309881989063,9673409304843776312,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6012 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1504,5639113309881989063,9673409304843776312,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6000 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1504,5639113309881989063,9673409304843776312,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3216 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\Downloads\OCCT.exe"C:\Users\Admin\Downloads\OCCT.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1504,5639113309881989063,9673409304843776312,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6068 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1504,5639113309881989063,9673409304843776312,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6084 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1504,5639113309881989063,9673409304843776312,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6232 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1504,5639113309881989063,9673409304843776312,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3880 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1504,5639113309881989063,9673409304843776312,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1580 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1504,5639113309881989063,9673409304843776312,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5228 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1504,5639113309881989063,9673409304843776312,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5024 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1504,5639113309881989063,9673409304843776312,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1504,5639113309881989063,9673409304843776312,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3964 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1504,5639113309881989063,9673409304843776312,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4972 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1504,5639113309881989063,9673409304843776312,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4964 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1504,5639113309881989063,9673409304843776312,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6804 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1504,5639113309881989063,9673409304843776312,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6200 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1504,5639113309881989063,9673409304843776312,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3712 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1504,5639113309881989063,9673409304843776312,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3776 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1504,5639113309881989063,9673409304843776312,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1504,5639113309881989063,9673409304843776312,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1504,5639113309881989063,9673409304843776312,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5560 /prefetch:82⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4EB962AA\Tue116b0a7643.exeTue116b0a7643.exe3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1504,5639113309881989063,9673409304843776312,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4532 /prefetch:12⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4EB962AA\Tue11119e53660048.exeTue11119e53660048.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1504,5639113309881989063,9673409304843776312,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1504,5639113309881989063,9673409304843776312,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1504,5639113309881989063,9673409304843776312,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4008 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1504,5639113309881989063,9673409304843776312,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1504,5639113309881989063,9673409304843776312,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6840 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1504,5639113309881989063,9673409304843776312,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4576 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1504,5639113309881989063,9673409304843776312,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6608 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1504,5639113309881989063,9673409304843776312,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6832 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"1⤵
- Drops file in Program Files directory
-
C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir4512_1693533153\ChromeRecovery.exe"C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir4512_1693533153\ChromeRecovery.exe" --appguid={8A69D345-D564-463c-AFF1-A69D9E530F96} --browser-version=89.0.4389.114 --sessionid={5104f577-5b00-422b-b1aa-c41fb4e21592} --system2⤵
- Executes dropped EXE
-
C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir4512_1693533153\GoogleUpdateSetup.exe"C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir4512_1693533153\GoogleUpdateSetup.exe" /install "runtime=true&needsadmin=true" /installsource chromerecovery /silent3⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files (x86)\Google\Temp\GUM255D.tmp\GoogleUpdate.exe"C:\Program Files (x86)\Google\Temp\GUM255D.tmp\GoogleUpdate.exe" /install "runtime=true&needsadmin=true" /installsource chromerecovery /silent4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regsvc5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regserver5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
C:\Program Files (x86)\Google\Update\1.3.36.111\GoogleUpdateComRegisterShell64.exe"C:\Program Files (x86)\Google\Update\1.3.36.111\GoogleUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
C:\Program Files (x86)\Google\Update\1.3.36.111\GoogleUpdateComRegisterShell64.exe"C:\Program Files (x86)\Google\Update\1.3.36.111\GoogleUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
C:\Program Files (x86)\Google\Update\1.3.36.111\GoogleUpdateComRegisterShell64.exe"C:\Program Files (x86)\Google\Update\1.3.36.111\GoogleUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4xMTEiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4xMTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OEUxMTNDQzctREIwNi00Nzc3LUFDQzEtMTFGNjlBRTRCQTU2fSIgdXNlcmlkPSJ7NEM0MkZBMTUtRjkwQy00NkVBLUFCQ0YtRTlCNEMyQzgxRkU4fSIgaW5zdGFsbHNvdXJjZT0iY2hyb21lcmVjb3ZlcnkiIHJlcXVlc3RpZD0iezRDMjI5MDE5LUM2RDctNDA4OS1CMTcxLTJGREQ0M0JGOTM2Mn0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iNCIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xNTA2My4wIiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7NDMwRkQ0RDAtQjcyOS00RjYxLUFBMzQtOTE1MjY0ODE3OTlEfSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMS4zLjM2LjExMSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgaW5zdGFsbF90aW1lX21zPSIxMTExIi8-PC9hcHA-PC9yZXF1ZXN0Pg5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ua /machine /installsource chromerecovery3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Google\Update\Install\{915D2872-3088-42B2-AADA-E638556CCEF6}\GoogleUpdateSetup.exe"C:\Program Files (x86)\Google\Update\Install\{915D2872-3088-42B2-AADA-E638556CCEF6}\GoogleUpdateSetup.exe" /update /sessionid "{A1D55F03-6B1A-44EA-A0BC-741830E6302E}"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files (x86)\Google\Temp\GUM75FD.tmp\GoogleUpdate.exe"C:\Program Files (x86)\Google\Temp\GUM75FD.tmp\GoogleUpdate.exe" /update /sessionid "{A1D55F03-6B1A-44EA-A0BC-741830E6302E}"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regsvc4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regserver4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
C:\Program Files (x86)\Google\Update\1.3.36.112\GoogleUpdateComRegisterShell64.exe"C:\Program Files (x86)\Google\Update\1.3.36.112\GoogleUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
C:\Program Files (x86)\Google\Update\1.3.36.112\GoogleUpdateComRegisterShell64.exe"C:\Program Files (x86)\Google\Update\1.3.36.112\GoogleUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
C:\Program Files (x86)\Google\Update\1.3.36.112\GoogleUpdateComRegisterShell64.exe"C:\Program Files (x86)\Google\Update\1.3.36.112\GoogleUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4xMTIiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4xMTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QTFENTVGMDMtNkIxQS00NEVBLUEwQkMtNzQxODMwRTYzMDJFfSIgdXNlcmlkPSJ7NEM0MkZBMTUtRjkwQy00NkVBLUFCQ0YtRTlCNEMyQzgxRkU4fSIgaW5zdGFsbHNvdXJjZT0ic2VsZnVwZGF0ZSIgcmVxdWVzdGlkPSJ7M0I2RjI1NTctNTVCRi00RDg3LUIwMTUtMjRBNTI1OUFFQkM5fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBwaHlzbWVtb3J5PSI0IiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE1MDYzLjAiIHNwPSIiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9Ins0MzBGRDREMC1CNzI5LTRGNjEtQUEzNC05MTUyNjQ4MTc5OUR9IiB2ZXJzaW9uPSIxLjMuMzYuMTExIiBuZXh0dmVyc2lvbj0iMS4zLjM2LjExMiIgbGFuZz0iIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjaHJvbWVyZWMzPTIwMjE1MlIiIGluc3RhbGxhZ2U9IjE5IiBpbnN0YWxsZGF0ZT0iNTQ3NCIgY29ob3J0PSIxOjljbzoiIGNvaG9ydG5hbWU9IkV2ZXJ5b25lIEVsc2UiPjxldmVudCBldmVudHR5cGU9IjMiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48L2FwcD48L3JlcXVlc3Q-4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Google\Update\1.3.36.111\GoogleCrashHandler.exe"C:\Program Files (x86)\Google\Update\1.3.36.111\GoogleCrashHandler.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Google\Update\1.3.36.111\GoogleCrashHandler64.exe"C:\Program Files (x86)\Google\Update\1.3.36.111\GoogleCrashHandler64.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4xMTEiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4xMTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QTFENTVGMDMtNkIxQS00NEVBLUEwQkMtNzQxODMwRTYzMDJFfSIgdXNlcmlkPSJ7NEM0MkZBMTUtRjkwQy00NkVBLUFCQ0YtRTlCNEMyQzgxRkU4fSIgaW5zdGFsbHNvdXJjZT0iY2hyb21lcmVjb3ZlcnkiIHJlcXVlc3RpZD0ie0IxODRFN0U5LTc3MkMtNEJBQi04NjRBLUJCQjYxRUUxOENCQ30iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iNCIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xNTA2My4wIiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7NDMwRkQ0RDAtQjcyOS00RjYxLUFBMzQtOTE1MjY0ODE3OTlEfSIgdmVyc2lvbj0iMS4zLjM2LjExMSIgbmV4dHZlcnNpb249IjEuMy4zNi4xMTIiIGxhbmc9IiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY2hyb21lcmVjMz0yMDIxNTJSIiBpbnN0YWxsYWdlPSIxOSIgaWlkPSJ7OEQ4QjE0NjAtMzA3NS00RjI3LUQ4MzEtOEMwMTU3QkIzNjYwfSIgY29ob3J0PSIxOjljbzoiIGNvaG9ydG5hbWU9IkV2ZXJ5b25lIEVsc2UiPjxldmVudCBldmVudHR5cGU9IjEyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTMiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vZWRnZWRsLm1lLmd2dDEuY29tL2VkZ2VkbC9yZWxlYXNlMi91cGRhdGUyL2FkeG1vbWZ0cmtvaW9kazdhd3l2YTNtejZ1dGFfMS4zLjM2LjExMi9Hb29nbGVVcGRhdGVTZXR1cC5leGUiIGRvd25sb2FkZWQ9IjEzNDEyNzIiIHRvdGFsPSIxMzQxMjcyIiBkb3dubG9hZF90aW1lX21zPSI0OTkiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjE1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PC9hcHA-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzQy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249Ijg5LjAuNDM4OS4xMTQiIG5leHR2ZXJzaW9uPSIiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjaHJvbWVyZWMzPTIwMjE1MlIiIGluc3RhbGxhZ2U9IjE5IiBpaWQ9Ins4RDhCMTQ2MC0zMDc1LTRGMjctRDgzMS04QzAxNTdCQjM2NjB9Ij48ZXZlbnQgZXZlbnR0eXBlPSIzIiBldmVudHJlc3VsdD0iOSIgZXJyb3Jjb2RlPSItMTYwNjIxOTc0OCIgZXh0cmFjb2RlMT0iMCIvPjwvYXBwPjwvcmVxdWVzdD42⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservice -s fdPHost1⤵
-
C:\Users\Admin\Desktop\setup_installx86-x64.exe"C:\Users\Admin\Desktop\setup_installx86-x64.exe"1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\7zS4EB962AA\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS4EB962AA\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue11613d9e9315.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4EB962AA\Tue11613d9e9315.exeTue11613d9e9315.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /stab C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue11171c1f250c59ea.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4EB962AA\Tue11171c1f250c59ea.exeTue11171c1f250c59ea.exe5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue110d5a53e57.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4EB962AA\Tue110d5a53e57.exeTue110d5a53e57.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue1181d1ee600618.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4EB962AA\Tue1181d1ee600618.exeTue1181d1ee600618.exe5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\635acfe2-0f18-4475-8d22-b0b77b85c6f8.exe"C:\Users\Admin\AppData\Local\635acfe2-0f18-4475-8d22-b0b77b85c6f8.exe"6⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\40c42a4e-0ab7-4cca-8ecc-20c34e73c096.exe"C:\Users\Admin\AppData\Local\40c42a4e-0ab7-4cca-8ecc-20c34e73c096.exe"6⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\1d2495dd-46a7-4d2e-89c9-2af73ed7917e.exe"C:\Users\Admin\AppData\Local\1d2495dd-46a7-4d2e-89c9-2af73ed7917e.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue113f25663d02bda9.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4EB962AA\Tue113f25663d02bda9.exeTue113f25663d02bda9.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue11e2f08af432365bf.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4EB962AA\Tue11e2f08af432365bf.exeTue11e2f08af432365bf.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\control.exe"C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\UDZC3.CPL",6⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\UDZC3.CPL",7⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue117c930640992.exe /mixtwo4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4EB962AA\Tue117c930640992.exeTue117c930640992.exe /mixtwo5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\7zS4EB962AA\Tue117c930640992.exeTue117c930640992.exe /mixtwo6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue116ece1bdb4f8.exe4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue112399042edee163a.exe4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue11ea5e6d491.exe4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue11119e53660048.exe4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue1175225f38ae9334b.exe4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue116b0a7643.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4EB962AA\Tue1175225f38ae9334b.exeTue1175225f38ae9334b.exe1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-TCH70.tmp\Tue1175225f38ae9334b.tmp"C:\Users\Admin\AppData\Local\Temp\is-TCH70.tmp\Tue1175225f38ae9334b.tmp" /SL5="$903AC,1570064,56832,C:\Users\Admin\AppData\Local\Temp\7zS4EB962AA\Tue1175225f38ae9334b.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\7zS4EB962AA\Tue1175225f38ae9334b.exe"C:\Users\Admin\AppData\Local\Temp\7zS4EB962AA\Tue1175225f38ae9334b.exe" /SILENT3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-VGJ83.tmp\Tue1175225f38ae9334b.tmp"C:\Users\Admin\AppData\Local\Temp\is-VGJ83.tmp\Tue1175225f38ae9334b.tmp" /SL5="$503AE,1570064,56832,C:\Users\Admin\AppData\Local\Temp\7zS4EB962AA\Tue1175225f38ae9334b.exe" /SILENT4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-7I02G.tmp\windllhost.exe"C:\Users\Admin\AppData\Local\Temp\is-7I02G.tmp\windllhost.exe" 775⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\7zS4EB962AA\Tue11119e53660048.exe"C:\Users\Admin\AppData\Local\Temp\7zS4EB962AA\Tue11119e53660048.exe" -u1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\7zS4EB962AA\Tue11ea5e6d491.exeTue11ea5e6d491.exe1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" -U /s .\yLCL~._2⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zS4EB962AA\Tue116ece1bdb4f8.exeTue116ece1bdb4f8.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\7zS4EB962AA\Tue116ece1bdb4f8.exeC:\Users\Admin\AppData\Local\Temp\7zS4EB962AA\Tue116ece1bdb4f8.exe2⤵
- Executes dropped EXE
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x0 /state0:0xa3a93055 /state1:0x41c64e6d1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\JAM Software\HeavyLoad\HeavyLoad.exeMD5
9f28ccb0a1ed1374dd59d24b639c7cbf
SHA164b741be8898906ad38f81a729a134900f4a5da0
SHA25648487a6a371505414beef5d28116eebdc7446e6cfa8bb984d491ad8498f98974
SHA512d6b87adb9b29fc3a97a82c26b8ee0f86f0312a26140a9675c06570403918b843b44ec9172c6e94198eb2afa5aa5f4349d3655b186405505d5b56c17fb8e2806e
-
C:\Program Files\JAM Software\HeavyLoad\HeavyLoad.exeMD5
9f28ccb0a1ed1374dd59d24b639c7cbf
SHA164b741be8898906ad38f81a729a134900f4a5da0
SHA25648487a6a371505414beef5d28116eebdc7446e6cfa8bb984d491ad8498f98974
SHA512d6b87adb9b29fc3a97a82c26b8ee0f86f0312a26140a9675c06570403918b843b44ec9172c6e94198eb2afa5aa5f4349d3655b186405505d5b56c17fb8e2806e
-
C:\Program Files\JAM Software\HeavyLoad\HeavyLoad.exeMD5
9f28ccb0a1ed1374dd59d24b639c7cbf
SHA164b741be8898906ad38f81a729a134900f4a5da0
SHA25648487a6a371505414beef5d28116eebdc7446e6cfa8bb984d491ad8498f98974
SHA512d6b87adb9b29fc3a97a82c26b8ee0f86f0312a26140a9675c06570403918b843b44ec9172c6e94198eb2afa5aa5f4349d3655b186405505d5b56c17fb8e2806e
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.datMD5
9d9fbd528242d845d92a84b3832b22b0
SHA18e8b2e12d281651cfe90fe741c5780be01cbc661
SHA256059c5b62c4cd41f9abe7c0dcfec55d9baff3484e4a51e2bb239a0c681d9fef8c
SHA512de12be6a2218823ba811e2b190b1497549168358e7543003655f518ae43bae08dead71c76e270f6634262d89b18a0ae3a0744778b3922e966af108654f7aa7d6
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\FaviconsMD5
77fdeaae7568fe42dc675d881a5cdd52
SHA12629db00917e8aa19da91135a212bb6b92471d57
SHA2564d25850a9c6de85ca3ad2d5eddfb22691a19db3e545873b63ebe3dc4601617dd
SHA5127042c2a8caf3fdc5076f1c9e8c9da0b0ddbfbe4282f0405cdadd25971ce6ff28cf394e7613e3539452953ab7601e59aae6d6c0cd40e54068a643bdbf109968c4
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\HistoryMD5
c58fdd0d1ebd619b8cd2aee769f4308b
SHA1473debc65443526f5d9514efa9781769c3ea11a7
SHA2568117c70e7002d01950d78d704896d8de1f57d2daea76a17528a4c9ba6bf083e0
SHA5122a3ef980406fc8dc11d7328b2e726d81de3e6c1e5dadc0653628e1757b2368aa017de8d2c3809263841dd1c00a5c23c39229d2f5f800d0ef78720a01edf4ccfd
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesMD5
4483872adc0ecd69831433d63c1e0323
SHA1bc814ac414507bdd8f8a00a5ea012728d0151f38
SHA2564729efa9d5050c8c951fe843d3962e8ec7df96bdaa2cfc3afde9e90d4127f9ff
SHA5128298a73296aa0f402c35be75f636871793bf33c27345d4a8815a151c845a06dbebdd0af2b7a86f5ece37ed24a08832e4ec726d6a192a44009ec87244eabff6d3
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure PreferencesMD5
cd179d7059543c45ec387f5cf09dc01b
SHA1aa3472040d7bf74b5a5db7561e9aeb9c6abbdbdc
SHA2566760a747522a7da7789602f374f48b7b24db5b92403a509d670e9fdadb4bb8cd
SHA512cedf778448899d2b03773c3c4b115d38e17619a3afac72abaefa5effb62cd3088e138584844832147db670c61cfa3d2399a2c0eb90cabd2787c7deffcf0ae4bc
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOGMD5
4738a317ebb7d3dc9c9e8400ce0917c5
SHA1c916e551f0a9308edd9d5eb2a38f9af86f215f2c
SHA256ed60965bd92e2f52adc696453eaaf3cb005b0d9de62b772c426df7826a975d9c
SHA51252001653013d872e9974ba162dff8c9b36751d12b26234a3b74ac8f8a94960de7e9edff127b642d6a0a3af0a038a6d9fc6e23f370b50d9b56776a900f4ea70f5
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Visited LinksMD5
05aea0ec7ae2dfc8168be47673b58a97
SHA1037d0a14967739a27e8e76b13e80707e7d5af98a
SHA256a158a7017fb3d3d2db28c6f5896c39225dae6cb5f1862b2342ea5435e3447166
SHA512654e6cb8d2bb726002875466589201ccef512f32bf36bf329cea0b0ffcdd052c888c7b7f2d8bd25205a833ca8546eafa5a6d618a05832694895ad5214b9b9aae
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last VersionMD5
b63048c4e7e52c52053d25da30d9c5ab
SHA1679a44d402f5ec24605719e06459f5a707989187
SHA256389caa40ea458e84bc624a9af1e0dec60fa652b2db2b81c09b1dfe22822cc3d1
SHA512e86c58c5a25e24f21ad79ed526a90c120a09c115f4820663bd2ebbc59e7bb1c4c418267eb77645522aa20b2c1b53fba8e31690db7bae9b21e4eff3db06316359
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateMD5
b26651718c22b71e14a241b9ede7b4ee
SHA1c613807b6b9e36b9f1ca688665b4b21105518383
SHA256827c98d08d1e4ad646d23860b0a92b7faeb51cc50c728774eacf60d26c2ce448
SHA5123271517cc64fde5868e3cf8394f6a82afc93bd9850efb2e3e8a6c54274349954123afe433e8ef6f23304b9af94e09931f45e573e35d9a3e2731bcc97264edf15
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_1MD5
7fbfb8eec9d65d9021f4b2bf928f2a1f
SHA199bb7a6ea9f53c9f7595b841faba30ff1f1030e9
SHA2564a10932a8b5dc49a4f6706500af1b713ed9f2bc6574c6c30baa024cac7dee035
SHA512d27ccb698da6ba35f6d228fc26a4f5a397205c10f8c23618bfbf584f94157d797d725cbd9ce612a342772d9a10348bf5f0d1a8fa988b4d712f8bdbb2232a78c5
-
C:\Users\Admin\AppData\Local\Temp\is-F0BSU.tmp\HeavyLoad-x64-Setup.tmpMD5
f0c680f168da13ad7424a9cb85b64cc9
SHA1cd375842acf9a45284b1dc304d4c6d40e6c88723
SHA256219b91ea3fce249cd2264e45da0e6fd106e2cf3ee8b437fdc900a7de7e1c6cd3
SHA5120a6fd5c9961e5c4a223c8a6b127fccdc32ba99af6d99a7e44d61e93a8ead957e43446be0f2efec2466dac1f25335d8605e85093d0a53b3b8ba01aefa4fd8e59d
-
C:\Users\Admin\AppData\Local\Temp\is-F0BSU.tmp\HeavyLoad-x64-Setup.tmpMD5
f0c680f168da13ad7424a9cb85b64cc9
SHA1cd375842acf9a45284b1dc304d4c6d40e6c88723
SHA256219b91ea3fce249cd2264e45da0e6fd106e2cf3ee8b437fdc900a7de7e1c6cd3
SHA5120a6fd5c9961e5c4a223c8a6b127fccdc32ba99af6d99a7e44d61e93a8ead957e43446be0f2efec2466dac1f25335d8605e85093d0a53b3b8ba01aefa4fd8e59d
-
C:\Users\Admin\Downloads\HeavyLoad-x64-Setup.exeMD5
ba7dd0c15f5ce2431035a4b4e1bbaae5
SHA1a368248b55f8ee9a75becd4339e938ee31f391f9
SHA256d4ce244ddb5ef7dfce3e650a2adb3b63964992de8088df6716e26b7d440001c8
SHA5123ee2552815528e04e992339bd8ac216b42432f2d2727e4483a734082a3716bd4559dcbeeca132b49be1ce6fca2378b03137a801f9ca554a1f5104522eb1f7c6c
-
C:\Users\Admin\Downloads\HeavyLoad-x64-Setup.exeMD5
ba7dd0c15f5ce2431035a4b4e1bbaae5
SHA1a368248b55f8ee9a75becd4339e938ee31f391f9
SHA256d4ce244ddb5ef7dfce3e650a2adb3b63964992de8088df6716e26b7d440001c8
SHA5123ee2552815528e04e992339bd8ac216b42432f2d2727e4483a734082a3716bd4559dcbeeca132b49be1ce6fca2378b03137a801f9ca554a1f5104522eb1f7c6c
-
\??\pipe\crashpad_3336_XLQDSXKWAEEXEOUNMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\pipe\crashpad_612_WTQBTPDHNCJVOVTWMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/164-247-0x0000000000000000-mapping.dmp
-
memory/200-183-0x0000000000000000-mapping.dmp
-
memory/416-227-0x0000000000000000-mapping.dmp
-
memory/432-177-0x000002C44F320000-0x000002C44F370000-memory.dmpFilesize
320KB
-
memory/432-174-0x000002C44FBD0000-0x000002C450334000-memory.dmpFilesize
7.4MB
-
memory/432-167-0x000002C431780000-0x000002C432DEC000-memory.dmpFilesize
22.4MB
-
memory/432-175-0x000002C44E300000-0x000002C44E310000-memory.dmpFilesize
64KB
-
memory/432-168-0x000002C431780000-0x000002C432DEC000-memory.dmpFilesize
22.4MB
-
memory/432-169-0x000002C44D300000-0x000002C44D302000-memory.dmpFilesize
8KB
-
memory/432-170-0x000002C44E030000-0x000002C44E0A6000-memory.dmpFilesize
472KB
-
memory/432-171-0x000002C44E390000-0x000002C44E440000-memory.dmpFilesize
704KB
-
memory/432-172-0x000002C44F3C0000-0x000002C44F452000-memory.dmpFilesize
584KB
-
memory/432-173-0x000002C44E320000-0x000002C44E33E000-memory.dmpFilesize
120KB
-
memory/432-166-0x0000000000000000-mapping.dmp
-
memory/432-176-0x000002C44E300000-0x000002C44E310000-memory.dmpFilesize
64KB
-
memory/680-182-0x0000000000000000-mapping.dmp
-
memory/696-119-0x0000000000000000-mapping.dmp
-
memory/696-120-0x000001CFC7D00000-0x000001CFC7D02000-memory.dmpFilesize
8KB
-
memory/696-121-0x000001CFC7D00000-0x000001CFC7D02000-memory.dmpFilesize
8KB
-
memory/844-135-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/844-132-0x0000000000000000-mapping.dmp
-
memory/844-137-0x00000000096A0000-0x00000000096A1000-memory.dmpFilesize
4KB
-
memory/844-136-0x0000000009410000-0x0000000009411000-memory.dmpFilesize
4KB
-
memory/1004-204-0x0000000000000000-mapping.dmp
-
memory/1060-261-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1060-251-0x0000000000000000-mapping.dmp
-
memory/1268-230-0x0000000000000000-mapping.dmp
-
memory/1280-326-0x0000000000C90000-0x0000000000C91000-memory.dmpFilesize
4KB
-
memory/1280-342-0x0000000071920000-0x00000000719A0000-memory.dmpFilesize
512KB
-
memory/1280-338-0x0000000077550000-0x0000000077641000-memory.dmpFilesize
964KB
-
memory/1280-336-0x00000000767B0000-0x0000000076972000-memory.dmpFilesize
1.8MB
-
memory/1280-323-0x00000000000B0000-0x0000000000212000-memory.dmpFilesize
1.4MB
-
memory/1428-130-0x0000000000800000-0x0000000000801000-memory.dmpFilesize
4KB
-
memory/1428-128-0x0000000000000000-mapping.dmp
-
memory/1516-294-0x0000000000400000-0x000000000082F000-memory.dmpFilesize
4.2MB
-
memory/1516-215-0x0000000000000000-mapping.dmp
-
memory/1516-291-0x0000000000030000-0x0000000000038000-memory.dmpFilesize
32KB
-
memory/1516-292-0x0000000000910000-0x0000000000A5A000-memory.dmpFilesize
1.3MB
-
memory/1668-188-0x0000000000000000-mapping.dmp
-
memory/1864-181-0x0000000000000000-mapping.dmp
-
memory/1988-241-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1988-232-0x0000000000000000-mapping.dmp
-
memory/2008-260-0x00000000027F0000-0x00000000027F1000-memory.dmpFilesize
4KB
-
memory/2008-165-0x0000000000000000-mapping.dmp
-
memory/2008-252-0x0000000000000000-mapping.dmp
-
memory/2008-256-0x00000000027F0000-0x00000000027F1000-memory.dmpFilesize
4KB
-
memory/2096-283-0x0000000000A10000-0x0000000000A11000-memory.dmpFilesize
4KB
-
memory/2096-284-0x0000000000A30000-0x0000000000A31000-memory.dmpFilesize
4KB
-
memory/2096-239-0x0000000000000000-mapping.dmp
-
memory/2096-281-0x0000000000A00000-0x0000000000A01000-memory.dmpFilesize
4KB
-
memory/2096-290-0x0000000000DC0000-0x0000000001967000-memory.dmpFilesize
11.7MB
-
memory/2096-289-0x0000000000A80000-0x0000000000A81000-memory.dmpFilesize
4KB
-
memory/2096-287-0x0000000000A60000-0x0000000000A61000-memory.dmpFilesize
4KB
-
memory/2096-296-0x0000000000A70000-0x0000000000A71000-memory.dmpFilesize
4KB
-
memory/2096-285-0x0000000000A40000-0x0000000000A41000-memory.dmpFilesize
4KB
-
memory/2096-286-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/2348-246-0x0000015169580000-0x0000015169586000-memory.dmpFilesize
24KB
-
memory/2348-250-0x00000151696C0000-0x00000151696F4000-memory.dmpFilesize
208KB
-
memory/2348-262-0x000001516B850000-0x000001516B852000-memory.dmpFilesize
8KB
-
memory/2348-244-0x0000015169250000-0x000001516929A000-memory.dmpFilesize
296KB
-
memory/2348-242-0x0000015169250000-0x000001516929A000-memory.dmpFilesize
296KB
-
memory/2348-254-0x00000151696F0000-0x00000151696F6000-memory.dmpFilesize
24KB
-
memory/2348-220-0x0000000000000000-mapping.dmp
-
memory/2516-187-0x0000000000000000-mapping.dmp
-
memory/2540-320-0x0000000004E20000-0x000000002F8AF000-memory.dmpFilesize
682.6MB
-
memory/2596-214-0x0000000000000000-mapping.dmp
-
memory/2608-225-0x0000000000000000-mapping.dmp
-
memory/2628-216-0x0000000002620000-0x0000000002621000-memory.dmpFilesize
4KB
-
memory/2628-235-0x0000000006D50000-0x0000000007378000-memory.dmpFilesize
6.2MB
-
memory/2628-275-0x0000000007480000-0x00000000074E6000-memory.dmpFilesize
408KB
-
memory/2628-267-0x0000000006B10000-0x0000000006B32000-memory.dmpFilesize
136KB
-
memory/2628-308-0x0000000002620000-0x0000000002621000-memory.dmpFilesize
4KB
-
memory/2628-231-0x0000000006710000-0x0000000006711000-memory.dmpFilesize
4KB
-
memory/2628-207-0x0000000000000000-mapping.dmp
-
memory/2628-280-0x00000000074F0000-0x0000000007840000-memory.dmpFilesize
3.3MB
-
memory/2628-228-0x0000000004050000-0x0000000004086000-memory.dmpFilesize
216KB
-
memory/2628-278-0x0000000006BB0000-0x0000000006C16000-memory.dmpFilesize
408KB
-
memory/2628-243-0x0000000006712000-0x0000000006713000-memory.dmpFilesize
4KB
-
memory/2628-219-0x0000000002620000-0x0000000002621000-memory.dmpFilesize
4KB
-
memory/2660-161-0x0000000000000000-mapping.dmp
-
memory/2676-141-0x0000000005B10000-0x0000000005B11000-memory.dmpFilesize
4KB
-
memory/2676-140-0x0000000003C50000-0x0000000003C51000-memory.dmpFilesize
4KB
-
memory/2676-142-0x0000000005B30000-0x0000000005B31000-memory.dmpFilesize
4KB
-
memory/2676-208-0x0000000000000000-mapping.dmp
-
memory/2676-138-0x0000000000000000-mapping.dmp
-
memory/2704-259-0x0000000000000000-mapping.dmp
-
memory/2712-222-0x0000000000000000-mapping.dmp
-
memory/2744-265-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/2744-274-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/2744-178-0x0000000000000000-mapping.dmp
-
memory/2744-268-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/2960-122-0x0000000000000000-mapping.dmp
-
memory/2960-126-0x0000000000400000-0x00000000004D1000-memory.dmpFilesize
836KB
-
memory/2988-206-0x0000000000000000-mapping.dmp
-
memory/3044-189-0x0000000000000000-mapping.dmp
-
memory/3080-179-0x0000000000000000-mapping.dmp
-
memory/3236-209-0x0000000000000000-mapping.dmp
-
memory/3328-158-0x0000000000000000-mapping.dmp
-
memory/3420-309-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/3540-264-0x0000000000712000-0x000000000078E000-memory.dmpFilesize
496KB
-
memory/3540-223-0x0000000000000000-mapping.dmp
-
memory/3540-272-0x0000000000800000-0x00000000008D5000-memory.dmpFilesize
852KB
-
memory/3540-273-0x0000000000400000-0x0000000000541000-memory.dmpFilesize
1.3MB
-
memory/3700-212-0x0000000000000000-mapping.dmp
-
memory/3784-298-0x0000000000400000-0x000000000047C000-memory.dmpFilesize
496KB
-
memory/3804-211-0x0000000000000000-mapping.dmp
-
memory/3864-203-0x0000000000000000-mapping.dmp
-
memory/3868-224-0x0000000000000000-mapping.dmp
-
memory/3952-306-0x0000000004D10000-0x000000002F728000-memory.dmpFilesize
682.1MB
-
memory/3960-229-0x0000000000000000-mapping.dmp
-
memory/4068-249-0x0000000000000000-mapping.dmp
-
memory/4228-217-0x0000000000000000-mapping.dmp
-
memory/4256-156-0x0000000000000000-mapping.dmp
-
memory/4296-185-0x0000000000000000-mapping.dmp
-
memory/4348-162-0x0000000000000000-mapping.dmp
-
memory/4416-186-0x0000000000000000-mapping.dmp
-
memory/4472-159-0x0000000000000000-mapping.dmp
-
memory/4512-154-0x00000234B7150000-0x00000234B7152000-memory.dmpFilesize
8KB
-
memory/4512-155-0x00000234B7150000-0x00000234B7152000-memory.dmpFilesize
8KB
-
memory/4532-213-0x0000000000000000-mapping.dmp
-
memory/4576-205-0x0000000000000000-mapping.dmp
-
memory/4840-266-0x0000000000000000-mapping.dmp
-
memory/4840-279-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/4868-118-0x000001DCF4D10000-0x000001DCF4D12000-memory.dmpFilesize
8KB
-
memory/4868-116-0x0000000000000000-mapping.dmp
-
memory/4868-117-0x000001DCF4D10000-0x000001DCF4D12000-memory.dmpFilesize
8KB
-
memory/4880-295-0x00000000055E0000-0x00000000055FE000-memory.dmpFilesize
120KB
-
memory/4880-271-0x0000000000D80000-0x0000000000E0A000-memory.dmpFilesize
552KB
-
memory/4880-269-0x0000000000D80000-0x0000000000E0A000-memory.dmpFilesize
552KB
-
memory/4880-276-0x0000000005640000-0x00000000056B6000-memory.dmpFilesize
472KB
-
memory/4880-282-0x0000000003000000-0x0000000003001000-memory.dmpFilesize
4KB
-
memory/4880-300-0x0000000005CA0000-0x000000000619E000-memory.dmpFilesize
5.0MB
-
memory/4880-277-0x0000000005790000-0x0000000005791000-memory.dmpFilesize
4KB
-
memory/4880-263-0x0000000000000000-mapping.dmp
-
memory/4892-221-0x0000000002D60000-0x0000000002D61000-memory.dmpFilesize
4KB
-
memory/4892-270-0x0000000007B60000-0x0000000007EB0000-memory.dmpFilesize
3.3MB
-
memory/4892-255-0x0000000007AB0000-0x0000000007B16000-memory.dmpFilesize
408KB
-
memory/4892-248-0x0000000007040000-0x0000000007062000-memory.dmpFilesize
136KB
-
memory/4892-253-0x0000000007A40000-0x0000000007AA6000-memory.dmpFilesize
408KB
-
memory/4892-218-0x0000000002D60000-0x0000000002D61000-memory.dmpFilesize
4KB
-
memory/4892-310-0x0000000002D60000-0x0000000002D61000-memory.dmpFilesize
4KB
-
memory/4892-226-0x0000000004A10000-0x0000000004A46000-memory.dmpFilesize
216KB
-
memory/4892-234-0x0000000004C02000-0x0000000004C03000-memory.dmpFilesize
4KB
-
memory/4892-238-0x0000000004C00000-0x0000000004C01000-memory.dmpFilesize
4KB
-
memory/4892-237-0x00000000072C0000-0x00000000078E8000-memory.dmpFilesize
6.2MB
-
memory/4892-210-0x0000000000000000-mapping.dmp
-
memory/4892-164-0x0000000000000000-mapping.dmp
-
memory/4892-299-0x0000000007910000-0x000000000792C000-memory.dmpFilesize
112KB
-
memory/4920-236-0x0000000000000000-mapping.dmp
-
memory/4932-233-0x0000000000000000-mapping.dmp
-
memory/4944-160-0x0000000000000000-mapping.dmp
-
memory/4960-157-0x0000000000000000-mapping.dmp
-
memory/4988-202-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/4988-200-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/4988-196-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/4988-195-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/4988-194-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/4988-193-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/4988-201-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/4988-198-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/4988-192-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/4988-197-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/4988-191-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/4988-190-0x0000000000000000-mapping.dmp
-
memory/4988-199-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/5012-180-0x0000000000000000-mapping.dmp
-
memory/5012-257-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/5012-245-0x0000000000000000-mapping.dmp
-
memory/5020-184-0x0000000000000000-mapping.dmp
-
memory/5024-163-0x0000000000000000-mapping.dmp