Resubmissions

24-01-2022 18:12

220124-ws75xsgcf6 1

14-01-2022 15:34

220114-szqyfahceq 10

08-01-2022 19:45

220108-ygvfssdbh9 10

08-01-2022 19:45

220108-ygvfssdbh8 10

08-01-2022 19:34

220108-x95xkadbh3 8

07-01-2022 14:28

220107-rsy5sscda4 10

06-01-2022 19:07

220106-xszdfsbee2 10

Analysis

  • max time kernel
    1797s
  • max time network
    1793s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    31-12-2021 20:06

General

Malware Config

Extracted

Family

cryptbot

C2

hevcdt57.top

moridn05.top

Attributes
  • payload_url

    http://kyromu07.top/download.php?file=suanam.exe

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

  • CryptBot

    A C++ stealer distributed widely in bundle with other software.

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 15 IoCs
  • Checks BIOS information in registry 2 TTPs 10 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file 1 IoCs
  • Loads dropped DLL 11 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 20 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 3 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 7 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 9 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 17 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 3 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
  • Modifies data under HKEY_USERS 16 IoCs
  • Modifies registry class 27 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 3 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 28 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 15 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s BITS
    1⤵
    • Suspicious use of SetThreadContext
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:3740
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k SystemNetworkService
      2⤵
      • Drops file in System32 directory
      • Checks processor information in registry
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      PID:5948
  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" https://youtube.com
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3240
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xd0,0xd4,0xd8,0xcc,0xdc,0x7ffc057c4f50,0x7ffc057c4f60,0x7ffc057c4f70
      2⤵
        PID:4084
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1476 /prefetch:2
        2⤵
          PID:1236
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1920 /prefetch:8
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:2244
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2080 /prefetch:8
          2⤵
            PID:1532
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2664 /prefetch:1
            2⤵
              PID:1788
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2896 /prefetch:1
              2⤵
                PID:1624
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4084 /prefetch:8
                2⤵
                  PID:2896
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:1
                  2⤵
                    PID:1284
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
                    2⤵
                      PID:2464
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
                      2⤵
                        PID:3496
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3232 /prefetch:8
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:4052
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
                        2⤵
                          PID:3644
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4080 /prefetch:8
                          2⤵
                            PID:3660
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5232 /prefetch:8
                            2⤵
                              PID:3628
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5480 /prefetch:8
                              2⤵
                                PID:2756
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5432 /prefetch:8
                                2⤵
                                  PID:3872
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5844 /prefetch:8
                                  2⤵
                                    PID:1064
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5988 /prefetch:8
                                    2⤵
                                      PID:2692
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5712 /prefetch:8
                                      2⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:1660
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5760 /prefetch:8
                                      2⤵
                                        PID:1252
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5652 /prefetch:8
                                        2⤵
                                          PID:684
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5884 /prefetch:8
                                          2⤵
                                            PID:616
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5024 /prefetch:8
                                            2⤵
                                              PID:3636
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5232 /prefetch:8
                                              2⤵
                                                PID:3216
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4576 /prefetch:8
                                                2⤵
                                                  PID:2680
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4560 /prefetch:1
                                                  2⤵
                                                    PID:3844
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
                                                    2⤵
                                                      PID:2896
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3064 /prefetch:1
                                                      2⤵
                                                        PID:1232
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
                                                        2⤵
                                                          PID:3652
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4524 /prefetch:1
                                                          2⤵
                                                            PID:1780
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
                                                            2⤵
                                                              PID:3820
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
                                                              2⤵
                                                                PID:2964
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4104 /prefetch:1
                                                                2⤵
                                                                  PID:3248
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 /prefetch:8
                                                                  2⤵
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:2280
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5708 /prefetch:8
                                                                  2⤵
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:668
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3168 /prefetch:8
                                                                  2⤵
                                                                    PID:1008
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4960 /prefetch:8
                                                                    2⤵
                                                                      PID:444
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2532 /prefetch:8
                                                                      2⤵
                                                                        PID:1228
                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\96.276.200\software_reporter_tool.exe
                                                                        "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\96.276.200\software_reporter_tool.exe" --engine=2 --scan-locations=1,2,3,4,5,6,7,8,10 --disabled-locations=9,11 --session-id=jeI7FXG5Wi7QINm78f7pwXhjq1ycU7LSk+JBs6X2 --registry-suffix=ESET --enable-crash-reporting --srt-field-trial-group-name=NewCleanerUIExperiment
                                                                        2⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:1648
                                                                        • \??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\96.276.200\software_reporter_tool.exe
                                                                          "c:\users\admin\appdata\local\google\chrome\user data\swreporter\96.276.200\software_reporter_tool.exe" --crash-handler "--database=c:\users\admin\appdata\local\Google\Software Reporter Tool" --url=https://clients2.google.com/cr/report --annotation=plat=Win32 --annotation=prod=ChromeFoil --annotation=ver=96.276.200 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff6da54f510,0x7ff6da54f520,0x7ff6da54f530
                                                                          3⤵
                                                                          • Executes dropped EXE
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:3616
                                                                        • \??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\96.276.200\software_reporter_tool.exe
                                                                          "c:\users\admin\appdata\local\google\chrome\user data\swreporter\96.276.200\software_reporter_tool.exe" --enable-crash-reporting --use-crash-handler-with-id="\\.\pipe\crashpad_1648_HIXHAUDIXQUBYLSI" --sandboxed-process-id=2 --init-done-notifier=720 --sandbox-mojo-pipe-token=5457621658684777265 --mojo-platform-channel-handle=696 --engine=2
                                                                          3⤵
                                                                          • Executes dropped EXE
                                                                          • Loads dropped DLL
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:728
                                                                        • \??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\96.276.200\software_reporter_tool.exe
                                                                          "c:\users\admin\appdata\local\google\chrome\user data\swreporter\96.276.200\software_reporter_tool.exe" --enable-crash-reporting --use-crash-handler-with-id="\\.\pipe\crashpad_1648_HIXHAUDIXQUBYLSI" --sandboxed-process-id=3 --init-done-notifier=924 --sandbox-mojo-pipe-token=13081435193850367023 --mojo-platform-channel-handle=920
                                                                          3⤵
                                                                          • Executes dropped EXE
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:3716
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4612 /prefetch:8
                                                                        2⤵
                                                                          PID:2752
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3132 /prefetch:8
                                                                          2⤵
                                                                            PID:2288
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3436 /prefetch:8
                                                                            2⤵
                                                                              PID:1680
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2584 /prefetch:8
                                                                              2⤵
                                                                                PID:1412
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4288 /prefetch:1
                                                                                2⤵
                                                                                  PID:1756
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4212 /prefetch:8
                                                                                  2⤵
                                                                                    PID:2072
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4728 /prefetch:8
                                                                                    2⤵
                                                                                      PID:2756
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3504 /prefetch:8
                                                                                      2⤵
                                                                                        PID:3844
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4212 /prefetch:8
                                                                                        2⤵
                                                                                          PID:3216
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1828 /prefetch:2
                                                                                          2⤵
                                                                                            PID:2752
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4680 /prefetch:8
                                                                                            2⤵
                                                                                              PID:3868
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3184 /prefetch:8
                                                                                              2⤵
                                                                                                PID:1712
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3188 /prefetch:8
                                                                                                2⤵
                                                                                                  PID:2484
                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4136 /prefetch:8
                                                                                                  2⤵
                                                                                                    PID:3212
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
                                                                                                    2⤵
                                                                                                      PID:2216
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
                                                                                                      2⤵
                                                                                                        PID:1232
                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5840 /prefetch:8
                                                                                                        2⤵
                                                                                                          PID:2844
                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4924 /prefetch:8
                                                                                                          2⤵
                                                                                                            PID:2780
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4508 /prefetch:8
                                                                                                            2⤵
                                                                                                              PID:1192
                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4864 /prefetch:8
                                                                                                              2⤵
                                                                                                                PID:196
                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6424 /prefetch:1
                                                                                                                2⤵
                                                                                                                  PID:1924
                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6248 /prefetch:1
                                                                                                                  2⤵
                                                                                                                    PID:1520
                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
                                                                                                                    2⤵
                                                                                                                      PID:4412
                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6684 /prefetch:1
                                                                                                                      2⤵
                                                                                                                        PID:4480
                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6672 /prefetch:8
                                                                                                                        2⤵
                                                                                                                          PID:4600
                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6744 /prefetch:1
                                                                                                                          2⤵
                                                                                                                            PID:4680
                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
                                                                                                                            2⤵
                                                                                                                              PID:4744
                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
                                                                                                                              2⤵
                                                                                                                                PID:4800
                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4540 /prefetch:8
                                                                                                                                2⤵
                                                                                                                                  PID:4592
                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5940 /prefetch:8
                                                                                                                                  2⤵
                                                                                                                                    PID:1156
                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5708 /prefetch:8
                                                                                                                                    2⤵
                                                                                                                                      PID:5244
                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=70 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
                                                                                                                                      2⤵
                                                                                                                                        PID:3212
                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=71 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3000 /prefetch:1
                                                                                                                                        2⤵
                                                                                                                                          PID:5660
                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5976 /prefetch:8
                                                                                                                                          2⤵
                                                                                                                                            PID:5800
                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6388 /prefetch:8
                                                                                                                                            2⤵
                                                                                                                                              PID:5296
                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4092 /prefetch:8
                                                                                                                                              2⤵
                                                                                                                                                PID:596
                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7012 /prefetch:8
                                                                                                                                                2⤵
                                                                                                                                                  PID:5548
                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6076 /prefetch:8
                                                                                                                                                  2⤵
                                                                                                                                                    PID:5656
                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=77 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6944 /prefetch:1
                                                                                                                                                    2⤵
                                                                                                                                                      PID:3552
                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=78 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4540 /prefetch:1
                                                                                                                                                      2⤵
                                                                                                                                                        PID:4584
                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1464,4000979364319839029,18439453281964269028,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=79 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6484 /prefetch:1
                                                                                                                                                        2⤵
                                                                                                                                                          PID:5460
                                                                                                                                                      • c:\windows\system32\svchost.exe
                                                                                                                                                        c:\windows\system32\svchost.exe -k netsvcs -s Browser
                                                                                                                                                        1⤵
                                                                                                                                                          PID:2712
                                                                                                                                                        • c:\windows\system32\svchost.exe
                                                                                                                                                          c:\windows\system32\svchost.exe -k netsvcs -s WpnService
                                                                                                                                                          1⤵
                                                                                                                                                            PID:2652
                                                                                                                                                          • c:\windows\system32\svchost.exe
                                                                                                                                                            c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
                                                                                                                                                            1⤵
                                                                                                                                                              PID:2644
                                                                                                                                                            • c:\windows\system32\svchost.exe
                                                                                                                                                              c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
                                                                                                                                                              1⤵
                                                                                                                                                              • Modifies registry class
                                                                                                                                                              PID:2376
                                                                                                                                                            • c:\windows\system32\svchost.exe
                                                                                                                                                              c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
                                                                                                                                                              1⤵
                                                                                                                                                                PID:2356
                                                                                                                                                              • c:\windows\system32\svchost.exe
                                                                                                                                                                c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:1864
                                                                                                                                                                • c:\windows\system32\svchost.exe
                                                                                                                                                                  c:\windows\system32\svchost.exe -k netsvcs -s SENS
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:1384
                                                                                                                                                                  • c:\windows\system32\svchost.exe
                                                                                                                                                                    c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:1308
                                                                                                                                                                    • c:\windows\system32\svchost.exe
                                                                                                                                                                      c:\windows\system32\svchost.exe -k netsvcs -s Themes
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:1220
                                                                                                                                                                      • c:\windows\system32\svchost.exe
                                                                                                                                                                        c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                                                                                                                                                                        1⤵
                                                                                                                                                                          PID:1116
                                                                                                                                                                        • c:\windows\system32\svchost.exe
                                                                                                                                                                          c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                                                                                                                                                                          1⤵
                                                                                                                                                                            PID:388
                                                                                                                                                                          • C:\Windows\system32\taskmgr.exe
                                                                                                                                                                            "C:\Windows\system32\taskmgr.exe" /4
                                                                                                                                                                            1⤵
                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                            • Checks SCSI registry key(s)
                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                            • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                                                                                            • Suspicious use of SendNotifyMessage
                                                                                                                                                                            PID:1740
                                                                                                                                                                          • C:\Windows\System32\rundll32.exe
                                                                                                                                                                            C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                                                                                            1⤵
                                                                                                                                                                              PID:3868
                                                                                                                                                                            • C:\Windows\system32\NOTEPAD.EXE
                                                                                                                                                                              "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_Bandicam-Crack-.zip\Bandicam-Crack-5331893-With-Full-Version-Download-Latest\61cf634772be061cf634-Passw0rd.txt
                                                                                                                                                                              1⤵
                                                                                                                                                                                PID:1924
                                                                                                                                                                              • C:\Users\Admin\Desktop\p7.exe
                                                                                                                                                                                "C:\Users\Admin\Desktop\p7.exe"
                                                                                                                                                                                1⤵
                                                                                                                                                                                • Checks BIOS information in registry
                                                                                                                                                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                • Checks processor information in registry
                                                                                                                                                                                PID:3652
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\File.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\File.exe"
                                                                                                                                                                                  2⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • Checks BIOS information in registry
                                                                                                                                                                                  • Checks whether UAC is enabled
                                                                                                                                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                  PID:4156
                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\NCH Software\DrawPad\DpEditor.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\NCH Software\DrawPad\DpEditor.exe"
                                                                                                                                                                                    3⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Checks BIOS information in registry
                                                                                                                                                                                    • Drops startup file
                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                    • Checks whether UAC is enabled
                                                                                                                                                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                    • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                                                    PID:4536
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  "C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\vFHyrikXUX & timeout 4 & del /f /q "C:\Users\Admin\Desktop\p7.exe"
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:4168
                                                                                                                                                                                    • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                      timeout 4
                                                                                                                                                                                      3⤵
                                                                                                                                                                                      • Delays execution with timeout.exe
                                                                                                                                                                                      PID:4252
                                                                                                                                                                                • C:\Users\Admin\Desktop\p7.exe
                                                                                                                                                                                  "C:\Users\Admin\Desktop\p7.exe"
                                                                                                                                                                                  1⤵
                                                                                                                                                                                  • Checks BIOS information in registry
                                                                                                                                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                  • Checks processor information in registry
                                                                                                                                                                                  PID:828
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\utIWugBZRVg & timeout 4 & del /f /q "C:\Users\Admin\Desktop\p7.exe"
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:4296
                                                                                                                                                                                      • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                        timeout 4
                                                                                                                                                                                        3⤵
                                                                                                                                                                                        • Delays execution with timeout.exe
                                                                                                                                                                                        PID:4372
                                                                                                                                                                                  • C:\Users\Admin\Desktop\p7.exe
                                                                                                                                                                                    "C:\Users\Admin\Desktop\p7.exe"
                                                                                                                                                                                    1⤵
                                                                                                                                                                                    • Checks BIOS information in registry
                                                                                                                                                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                    • Checks processor information in registry
                                                                                                                                                                                    PID:4052
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      "C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\qmbotJpnjuaI & timeout 4 & del /f /q "C:\Users\Admin\Desktop\p7.exe"
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:1616
                                                                                                                                                                                        • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                          timeout 4
                                                                                                                                                                                          3⤵
                                                                                                                                                                                          • Delays execution with timeout.exe
                                                                                                                                                                                          PID:1904
                                                                                                                                                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                      "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                                                                                                                                                      1⤵
                                                                                                                                                                                        PID:4860
                                                                                                                                                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                          "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                                                                                                                                                          2⤵
                                                                                                                                                                                          • Checks processor information in registry
                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                          PID:4880
                                                                                                                                                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4880.0.1219505094\1878584542" -parentBuildID 20200403170909 -prefsHandle 1304 -prefMapHandle 1296 -prefsLen 1 -prefMapSize 219680 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4880 "\\.\pipe\gecko-crash-server-pipe.4880" 1632 gpu
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:5072
                                                                                                                                                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4880.3.222046362\955350972" -childID 1 -isForBrowser -prefsHandle 2288 -prefMapHandle 2284 -prefsLen 122 -prefMapSize 219680 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4880 "\\.\pipe\gecko-crash-server-pipe.4880" 2296 tab
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:3952
                                                                                                                                                                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4880.13.526107899\1047940320" -childID 2 -isForBrowser -prefsHandle 3408 -prefMapHandle 3400 -prefsLen 6979 -prefMapSize 219680 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4880 "\\.\pipe\gecko-crash-server-pipe.4880" 3420 tab
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:1168
                                                                                                                                                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4880.20.1684693324\1718869729" -childID 3 -isForBrowser -prefsHandle 4488 -prefMapHandle 4512 -prefsLen 7750 -prefMapSize 219680 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4880 "\\.\pipe\gecko-crash-server-pipe.4880" 4472 tab
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:4588
                                                                                                                                                                                              • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                                "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                • Modifies Internet Explorer Phishing Filter
                                                                                                                                                                                                • Modifies Internet Explorer settings
                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                PID:3412
                                                                                                                                                                                                • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                                                                                                                                                  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3412 CREDAT:82945 /prefetch:2
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                  • Modifies Internet Explorer settings
                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                  PID:4456
                                                                                                                                                                                                • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                                                                                                                                                  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3412 CREDAT:148481 /prefetch:2
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                  • Modifies Internet Explorer settings
                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                  PID:1912
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Temp2_Promt.XT.Office.gigant.XT.keygen.by.ViKiNG.zip\Promt.XT.Office.gigant.XT.keygen.by.ViKiNG.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Temp2_Promt.XT.Office.gigant.XT.keygen.by.ViKiNG.zip\Promt.XT.Office.gigant.XT.keygen.by.ViKiNG.exe"
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                  PID:4508
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:5008
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
                                                                                                                                                                                                        keygen-pr.exe -p83fsase3Ge
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        PID:2188
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"
                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          PID:5364
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.dat
                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                              PID:5552
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
                                                                                                                                                                                                          keygen-step-1.exe
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          PID:4664
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-5.exe
                                                                                                                                                                                                          keygen-step-5.exe
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                          PID:4124
                                                                                                                                                                                                          • C:\Windows\SysWOW64\control.exe
                                                                                                                                                                                                            "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\B~CoQMOT.cpL",
                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                              PID:5400
                                                                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\B~CoQMOT.cpL",
                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                PID:5476
                                                                                                                                                                                                                • C:\Windows\system32\RunDll32.exe
                                                                                                                                                                                                                  C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\B~CoQMOT.cpL",
                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                    PID:6116
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                      "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\B~CoQMOT.cpL",
                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                                                                      PID:5000
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-6.exe
                                                                                                                                                                                                              keygen-step-6.exe
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              PID:5288
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-6.exe" >> NUL
                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                  PID:4012
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                                                                                    ping 127.0.0.1
                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                    • Runs ping.exe
                                                                                                                                                                                                                    PID:4628
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe
                                                                                                                                                                                                                keygen-step-4.exe
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                PID:5440
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\RarSFX2\Crack.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\RarSFX2\Crack.exe"
                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  PID:5540
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\RarSFX2\Crack.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\RarSFX2\Crack.exe" -u
                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    PID:5600
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\RarSFX2\md1_1eaf.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\RarSFX2\md1_1eaf.exe"
                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • Checks whether UAC is enabled
                                                                                                                                                                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                  PID:5616
                                                                                                                                                                                                          • C:\Windows\system32\taskmgr.exe
                                                                                                                                                                                                            "C:\Windows\system32\taskmgr.exe" /4
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                              PID:5372
                                                                                                                                                                                                            • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                              rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                              PID:5824
                                                                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                PID:5848
                                                                                                                                                                                                            • C:\Windows\system32\taskmgr.exe
                                                                                                                                                                                                              "C:\Windows\system32\taskmgr.exe" /4
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                              • Checks SCSI registry key(s)
                                                                                                                                                                                                              • Checks processor information in registry
                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                              PID:5124
                                                                                                                                                                                                            • C:\Windows\system32\taskmgr.exe
                                                                                                                                                                                                              "C:\Windows\system32\taskmgr.exe" /4
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                              • Checks SCSI registry key(s)
                                                                                                                                                                                                              • Checks processor information in registry
                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                              • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                              PID:3768
                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                PID:5512
                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffc057c4f50,0x7ffc057c4f60,0x7ffc057c4f70
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:6012
                                                                                                                                                                                                                • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                  "C:\Windows\System32\WScript.exe" "C:\Windows\System32\SyncAppvPublishingServer.vbs"
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:5228

                                                                                                                                                                                                                  Network

                                                                                                                                                                                                                  MITRE ATT&CK Matrix ATT&CK v6

                                                                                                                                                                                                                  Persistence

                                                                                                                                                                                                                  Registry Run Keys / Startup Folder

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1060

                                                                                                                                                                                                                  Defense Evasion

                                                                                                                                                                                                                  Virtualization/Sandbox Evasion

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1497

                                                                                                                                                                                                                  Modify Registry

                                                                                                                                                                                                                  3
                                                                                                                                                                                                                  T1112

                                                                                                                                                                                                                  Credential Access

                                                                                                                                                                                                                  Credentials in Files

                                                                                                                                                                                                                  2
                                                                                                                                                                                                                  T1081

                                                                                                                                                                                                                  Discovery

                                                                                                                                                                                                                  Query Registry

                                                                                                                                                                                                                  6
                                                                                                                                                                                                                  T1012

                                                                                                                                                                                                                  Virtualization/Sandbox Evasion

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1497

                                                                                                                                                                                                                  System Information Discovery

                                                                                                                                                                                                                  6
                                                                                                                                                                                                                  T1082

                                                                                                                                                                                                                  Peripheral Device Discovery

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1120

                                                                                                                                                                                                                  Remote System Discovery

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1018

                                                                                                                                                                                                                  Collection

                                                                                                                                                                                                                  Data from Local System

                                                                                                                                                                                                                  2
                                                                                                                                                                                                                  T1005

                                                                                                                                                                                                                  Command and Control

                                                                                                                                                                                                                  Web Service

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1102

                                                                                                                                                                                                                  Replay Monitor

                                                                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                                                                  Downloads

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\96.276.200\software_reporter_tool.exe
                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    75ea9cd845ff0a9b46043972dfed4368

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    e672a812c729a88c94d4a43dfecbdffb12337fc9

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    40aa60810b802c5d68c3c105414fed22ad7481c34eed213fec4da5d59a125673

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    b58d83663c0bfcd916e25f17215892f80d3511e4905c7348a45be3cdc80557c83ba6f2d1933a1db8f1d369d4cd02d2066cafb2d48c9a538054ce6d5fff97cdba

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\96.276.200\software_reporter_tool.exe
                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    75ea9cd845ff0a9b46043972dfed4368

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    e672a812c729a88c94d4a43dfecbdffb12337fc9

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    40aa60810b802c5d68c3c105414fed22ad7481c34eed213fec4da5d59a125673

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    b58d83663c0bfcd916e25f17215892f80d3511e4905c7348a45be3cdc80557c83ba6f2d1933a1db8f1d369d4cd02d2066cafb2d48c9a538054ce6d5fff97cdba

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\96.276.200\software_reporter_tool.exe
                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    75ea9cd845ff0a9b46043972dfed4368

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    e672a812c729a88c94d4a43dfecbdffb12337fc9

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    40aa60810b802c5d68c3c105414fed22ad7481c34eed213fec4da5d59a125673

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    b58d83663c0bfcd916e25f17215892f80d3511e4905c7348a45be3cdc80557c83ba6f2d1933a1db8f1d369d4cd02d2066cafb2d48c9a538054ce6d5fff97cdba

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\96.276.200\software_reporter_tool.exe
                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    75ea9cd845ff0a9b46043972dfed4368

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    e672a812c729a88c94d4a43dfecbdffb12337fc9

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    40aa60810b802c5d68c3c105414fed22ad7481c34eed213fec4da5d59a125673

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    b58d83663c0bfcd916e25f17215892f80d3511e4905c7348a45be3cdc80557c83ba6f2d1933a1db8f1d369d4cd02d2066cafb2d48c9a538054ce6d5fff97cdba

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Software Reporter Tool\software_reporter_tool-sandbox.log
                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    4a44cb2e51642c8a5851c7a6e46d265b

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    f852c473c6f9006eb343df17140af23d57483c0f

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    654be681349ef646c96f6634617406477998321250b7274f0fa1ac65fdfbf0cf

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    ffa470be41116c00b94e11142d129d95343f18e9f95264cb7e44ca710781c57e60ef7765ca1f6049112abd3a084a147aca0ac4c5f7e0b9d5d31b814d16beb7bb

                                                                                                                                                                                                                  • \??\c:\users\admin\appdata\local\Google\Software Reporter Tool\settings.dat
                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    d41d8cd98f00b204e9800998ecf8427e

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                                                                                                                                                  • \??\c:\users\admin\appdata\local\Google\Software Reporter Tool\settings.dat
                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    7a5051c0a82eb3cc4df3a32d52307e23

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    8ab9f9f3c28398190da432cf02add1012182d4ae

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    5bb38fec42e16c8571cca3cdf080599d985bcc194b9e4c4f8862170483837ef6

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    6aaf10440846cf1ac95e9029017aeb3ff125ec3969ed9ed63013f559f0441906b8aceddd554b4616a021592870a06253b0e20fff40331168556a51557d0deeb2

                                                                                                                                                                                                                  • \??\c:\users\admin\appdata\local\Google\Software Reporter Tool\settings.dat
                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    7a5051c0a82eb3cc4df3a32d52307e23

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    8ab9f9f3c28398190da432cf02add1012182d4ae

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    5bb38fec42e16c8571cca3cdf080599d985bcc194b9e4c4f8862170483837ef6

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    6aaf10440846cf1ac95e9029017aeb3ff125ec3969ed9ed63013f559f0441906b8aceddd554b4616a021592870a06253b0e20fff40331168556a51557d0deeb2

                                                                                                                                                                                                                  • \??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\96.276.200\em000_64.dll
                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    d0cf72186dbaea05c5a5bf6594225fc3

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    0e69efd78dc1124122dd8b752be92cb1cbc067a1

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    225d4f7e3ab4687f05f817435b883f6c3271b6c4d4018d94fe4398a350d74907

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    8122a9a9205cfa67ff87cb4755089e5ed1acf8f807467216c98f09f94704f98497f7aa57ad29e255efa4d7206c577c4cf7fed140afb046499fc2e57e03f55285

                                                                                                                                                                                                                  • \??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\96.276.200\em001_64.dll
                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    7adcb76ec34d774d1435b477e8625c47

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    ec4ba0ad028c45489608c6822f3cabb683a07064

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    a55be2be943078157b7d1cfb52febd4a95e4c7a37995bb75b19b079cc1ee5b9d

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    c1af669ee971b4f4a3bb057fe423a63376cfc19026650036b29d77fed73458d235889a662ac5e12c871c3e77f6fbdb1fa29c0dfa488a4a40fa045d79eb61e7c4

                                                                                                                                                                                                                  • \??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\96.276.200\em002_64.dll
                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    8398e65877faf2f60a611aed37c7d638

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    b21222cda1590ead5e07f9253ac08ea4796a0031

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    f8ae1f73552c0881660fc4c1c6690a73097e535f6b93b3d9d263c03fe309183f

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    3ac54c58bab7a78164e2f536d02349ba36c83e904807a20889f0203de29ae217e4d7a12e4be40bf37f5757a329753475e30ebe720791afdc8f84251f5f159767

                                                                                                                                                                                                                  • \??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\96.276.200\em003_64.dll
                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    3c4af468709f2d586ab4c2819633616c

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    965fb6969acadcec77cc9918153b01f56fc209cd

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    16bc60d0297ffff802d1b270bca8fded4339ac2f255f50e2a632dffbf369a6c8

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    ef2808b02700dc70ecaed4aed3056b196ae38028c9caebace88da058b51c81b264343d045be76cd592737117c1cb1ab6d5291fb344783213f34609ce7ea6970a

                                                                                                                                                                                                                  • \??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\96.276.200\em004_64.dll
                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    68258a5cff71fdaf66bc1ef5da5ac004

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    aed0bd7481c36175b3f8267caeab0b3c0fc06520

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    9737130b8f090a39e27dd71685315dc5e7c1b6b8a251ac0b9788871d574d7710

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    6c4ca70593f83703db1cfb2f24465939a27e771e1e465dee27baf04b202e42653f26ed8713092fabc5b2f82394644295a597c5cb38a1db49eb1a7f0a7f67d8c6

                                                                                                                                                                                                                  • \??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\96.276.200\em005_64.dll
                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    169a2ef320119891cf3189aa3fd23b0e

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    de51c936101ef79bbc0f1d3c800cf832d221eef8

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    1072d49da0a70640fb9716cb894f4834ff621ca96d4aea1f478754edf4d0f780

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    7fe27d360bbf6d410ea9d33d6003ab455cd8b9e5521c00db9bb6c44a7472ccf2083d51034bab5ffc5aef85db36fc758c76b02fa31f0d0024c9d532548a2bf9ca

                                                                                                                                                                                                                  • \??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\96.276.200\software_reporter_tool.exe
                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    75ea9cd845ff0a9b46043972dfed4368

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    e672a812c729a88c94d4a43dfecbdffb12337fc9

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    40aa60810b802c5d68c3c105414fed22ad7481c34eed213fec4da5d59a125673

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    b58d83663c0bfcd916e25f17215892f80d3511e4905c7348a45be3cdc80557c83ba6f2d1933a1db8f1d369d4cd02d2066cafb2d48c9a538054ce6d5fff97cdba

                                                                                                                                                                                                                  • \??\pipe\crashpad_1648_HIXHAUDIXQUBYLSI
                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    d41d8cd98f00b204e9800998ecf8427e

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                                                                                                                                                  • \??\pipe\crashpad_3240_MOWKMKTCTHDQOVZF
                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    d41d8cd98f00b204e9800998ecf8427e

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                                                                                                                                                  • \Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\96.276.200\edls_64.dll
                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    e9a7c44d7bda10b5b7a132d46fcdaf35

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    5217179f094c45ba660777cfa25c7eb00b5c8202

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    35351366369a7774f9f30f38dc8aa3cd5e087acd8eae79e80c24526cd40e95a1

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    e76308eee65bf0bf31e58d754e07b63092a4109ef3d44df7b746da99d44be6112bc5f970123c4e82523b6d301392e09c2cfc490e304550b42d152cdb0757e774

                                                                                                                                                                                                                  • \Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\96.276.200\em000_64.dll
                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    d0cf72186dbaea05c5a5bf6594225fc3

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    0e69efd78dc1124122dd8b752be92cb1cbc067a1

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    225d4f7e3ab4687f05f817435b883f6c3271b6c4d4018d94fe4398a350d74907

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    8122a9a9205cfa67ff87cb4755089e5ed1acf8f807467216c98f09f94704f98497f7aa57ad29e255efa4d7206c577c4cf7fed140afb046499fc2e57e03f55285

                                                                                                                                                                                                                  • \Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\96.276.200\em001_64.dll
                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    7adcb76ec34d774d1435b477e8625c47

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    ec4ba0ad028c45489608c6822f3cabb683a07064

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    a55be2be943078157b7d1cfb52febd4a95e4c7a37995bb75b19b079cc1ee5b9d

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    c1af669ee971b4f4a3bb057fe423a63376cfc19026650036b29d77fed73458d235889a662ac5e12c871c3e77f6fbdb1fa29c0dfa488a4a40fa045d79eb61e7c4

                                                                                                                                                                                                                  • \Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\96.276.200\em002_64.dll
                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    8398e65877faf2f60a611aed37c7d638

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    b21222cda1590ead5e07f9253ac08ea4796a0031

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    f8ae1f73552c0881660fc4c1c6690a73097e535f6b93b3d9d263c03fe309183f

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    3ac54c58bab7a78164e2f536d02349ba36c83e904807a20889f0203de29ae217e4d7a12e4be40bf37f5757a329753475e30ebe720791afdc8f84251f5f159767

                                                                                                                                                                                                                  • \Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\96.276.200\em003_64.dll
                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    3c4af468709f2d586ab4c2819633616c

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    965fb6969acadcec77cc9918153b01f56fc209cd

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    16bc60d0297ffff802d1b270bca8fded4339ac2f255f50e2a632dffbf369a6c8

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    ef2808b02700dc70ecaed4aed3056b196ae38028c9caebace88da058b51c81b264343d045be76cd592737117c1cb1ab6d5291fb344783213f34609ce7ea6970a

                                                                                                                                                                                                                  • \Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\96.276.200\em004_64.dll
                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    68258a5cff71fdaf66bc1ef5da5ac004

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    aed0bd7481c36175b3f8267caeab0b3c0fc06520

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    9737130b8f090a39e27dd71685315dc5e7c1b6b8a251ac0b9788871d574d7710

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    6c4ca70593f83703db1cfb2f24465939a27e771e1e465dee27baf04b202e42653f26ed8713092fabc5b2f82394644295a597c5cb38a1db49eb1a7f0a7f67d8c6

                                                                                                                                                                                                                  • \Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\96.276.200\em005_64.dll
                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    169a2ef320119891cf3189aa3fd23b0e

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    de51c936101ef79bbc0f1d3c800cf832d221eef8

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    1072d49da0a70640fb9716cb894f4834ff621ca96d4aea1f478754edf4d0f780

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    7fe27d360bbf6d410ea9d33d6003ab455cd8b9e5521c00db9bb6c44a7472ccf2083d51034bab5ffc5aef85db36fc758c76b02fa31f0d0024c9d532548a2bf9ca

                                                                                                                                                                                                                  • memory/388-442-0x0000029F0C130000-0x0000029F0C1A2000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    456KB

                                                                                                                                                                                                                  • memory/388-355-0x0000029F0C040000-0x0000029F0C0B2000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    456KB

                                                                                                                                                                                                                  • memory/728-131-0x00007FFC10AA0000-0x00007FFC10AA1000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                  • memory/728-132-0x00007FFC11480000-0x00007FFC11481000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                  • memory/728-130-0x000001F46AEC0000-0x000001F46AEC2000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                  • memory/728-129-0x000001F46AEC0000-0x000001F46AEC2000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                  • memory/728-127-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                  • memory/728-126-0x000001F46AF33000-0x000001F46AF34000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                  • memory/728-157-0x000001F46B270000-0x000001F46B271000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                  • memory/728-158-0x000001F46B270000-0x000001F46B2B0000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    256KB

                                                                                                                                                                                                                  • memory/828-171-0x00000000001B0000-0x00000000008A7000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    7.0MB

                                                                                                                                                                                                                  • memory/828-177-0x00000000001B0000-0x00000000008A7000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    7.0MB

                                                                                                                                                                                                                  • memory/828-172-0x00000000001B0000-0x00000000008A7000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    7.0MB

                                                                                                                                                                                                                  • memory/828-176-0x00000000001B0000-0x00000000008A7000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    7.0MB

                                                                                                                                                                                                                  • memory/828-173-0x00000000770E0000-0x000000007726E000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    1.6MB

                                                                                                                                                                                                                  • memory/1116-364-0x0000014D55760000-0x0000014D557D2000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    456KB

                                                                                                                                                                                                                  • memory/1116-441-0x0000014D55EE0000-0x0000014D55F52000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    456KB

                                                                                                                                                                                                                  • memory/1220-382-0x000001DAC06B0000-0x000001DAC0722000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    456KB

                                                                                                                                                                                                                  • memory/1220-445-0x000001DAC0730000-0x000001DAC07A2000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    456KB

                                                                                                                                                                                                                  • memory/1308-383-0x000001ADA1900000-0x000001ADA1972000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    456KB

                                                                                                                                                                                                                  • memory/1308-446-0x000001ADA1D30000-0x000001ADA1DA2000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    456KB

                                                                                                                                                                                                                  • memory/1384-362-0x00000220EFA00000-0x00000220EFA72000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    456KB

                                                                                                                                                                                                                  • memory/1384-443-0x00000220EFAF0000-0x00000220EFB62000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    456KB

                                                                                                                                                                                                                  • memory/1616-169-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                  • memory/1648-116-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                  • memory/1648-119-0x00000253A54A0000-0x00000253A54A2000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                  • memory/1648-118-0x00000253A54A0000-0x00000253A54A2000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                  • memory/1864-444-0x0000027B23230000-0x0000027B232A2000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    456KB

                                                                                                                                                                                                                  • memory/1864-366-0x0000027B231B0000-0x0000027B23222000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    456KB

                                                                                                                                                                                                                  • memory/1904-170-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                  • memory/1912-261-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                  • memory/2188-290-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                  • memory/2356-437-0x000001D265830000-0x000001D2658A2000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    456KB

                                                                                                                                                                                                                  • memory/2356-360-0x000001D265740000-0x000001D2657B2000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    456KB

                                                                                                                                                                                                                  • memory/2376-439-0x0000025655FB0000-0x0000025656022000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    456KB

                                                                                                                                                                                                                  • memory/2376-361-0x0000025655A60000-0x0000025655AD2000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    456KB

                                                                                                                                                                                                                  • memory/2644-384-0x000001990DA10000-0x000001990DA82000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    456KB

                                                                                                                                                                                                                  • memory/2644-436-0x000001990DD00000-0x000001990DD72000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    456KB

                                                                                                                                                                                                                  • memory/2652-385-0x000001EF6E7A0000-0x000001EF6E812000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    456KB

                                                                                                                                                                                                                  • memory/2652-440-0x000001EF6ED40000-0x000001EF6EDB2000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    456KB

                                                                                                                                                                                                                  • memory/2712-435-0x000001F251AB0000-0x000001F251B22000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    456KB

                                                                                                                                                                                                                  • memory/2712-356-0x000001F251560000-0x000001F2515D2000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    456KB

                                                                                                                                                                                                                  • memory/3412-193-0x00007FFBF4130000-0x00007FFBF419B000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    428KB

                                                                                                                                                                                                                  • memory/3412-210-0x00007FFBF4130000-0x00007FFBF419B000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    428KB

                                                                                                                                                                                                                  • memory/3412-222-0x00007FFBF4130000-0x00007FFBF419B000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    428KB

                                                                                                                                                                                                                  • memory/3412-221-0x00007FFBF4130000-0x00007FFBF419B000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    428KB

                                                                                                                                                                                                                  • memory/3412-219-0x00007FFBF4130000-0x00007FFBF419B000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    428KB

                                                                                                                                                                                                                  • memory/3412-218-0x00007FFBF4130000-0x00007FFBF419B000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    428KB

                                                                                                                                                                                                                  • memory/3412-215-0x00007FFBF4130000-0x00007FFBF419B000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    428KB

                                                                                                                                                                                                                  • memory/3412-214-0x00007FFBF4130000-0x00007FFBF419B000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    428KB

                                                                                                                                                                                                                  • memory/3412-213-0x00007FFBF4130000-0x00007FFBF419B000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    428KB

                                                                                                                                                                                                                  • memory/3412-192-0x00007FFBF4130000-0x00007FFBF419B000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    428KB

                                                                                                                                                                                                                  • memory/3412-212-0x00007FFBF4130000-0x00007FFBF419B000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    428KB

                                                                                                                                                                                                                  • memory/3412-194-0x00007FFBF4130000-0x00007FFBF419B000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    428KB

                                                                                                                                                                                                                  • memory/3412-196-0x00007FFBF4130000-0x00007FFBF419B000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    428KB

                                                                                                                                                                                                                  • memory/3412-198-0x00007FFBF4130000-0x00007FFBF419B000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    428KB

                                                                                                                                                                                                                  • memory/3412-197-0x00007FFBF4130000-0x00007FFBF419B000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    428KB

                                                                                                                                                                                                                  • memory/3412-199-0x00007FFBF4130000-0x00007FFBF419B000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    428KB

                                                                                                                                                                                                                  • memory/3412-200-0x00007FFBF4130000-0x00007FFBF419B000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    428KB

                                                                                                                                                                                                                  • memory/3412-201-0x00007FFBF4130000-0x00007FFBF419B000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    428KB

                                                                                                                                                                                                                  • memory/3412-202-0x00007FFBF4130000-0x00007FFBF419B000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    428KB

                                                                                                                                                                                                                  • memory/3412-204-0x00007FFBF4130000-0x00007FFBF419B000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    428KB

                                                                                                                                                                                                                  • memory/3412-205-0x00007FFBF4130000-0x00007FFBF419B000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    428KB

                                                                                                                                                                                                                  • memory/3412-207-0x00007FFBF4130000-0x00007FFBF419B000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    428KB

                                                                                                                                                                                                                  • memory/3412-208-0x00007FFBF4130000-0x00007FFBF419B000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    428KB

                                                                                                                                                                                                                  • memory/3412-211-0x00007FFBF4130000-0x00007FFBF419B000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    428KB

                                                                                                                                                                                                                  • memory/3616-123-0x000002F02B5A0000-0x000002F02B5A2000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                  • memory/3616-120-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                  • memory/3616-122-0x000002F02B5A0000-0x000002F02B5A2000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                  • memory/3652-160-0x00000000770E0000-0x000000007726E000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    1.6MB

                                                                                                                                                                                                                  • memory/3652-161-0x00000000001B0000-0x00000000008A7000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    7.0MB

                                                                                                                                                                                                                  • memory/3652-163-0x00000000001B0000-0x00000000008A7000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    7.0MB

                                                                                                                                                                                                                  • memory/3652-159-0x00000000001B0000-0x00000000008A7000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    7.0MB

                                                                                                                                                                                                                  • memory/3652-162-0x00000000001B0000-0x00000000008A7000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    7.0MB

                                                                                                                                                                                                                  • memory/3716-148-0x000001F9CF8A7000-0x000001F9CF8A8000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                  • memory/3716-149-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                  • memory/3716-151-0x000001F9800E0000-0x000001F9800E2000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                  • memory/3716-152-0x000001F9800E0000-0x000001F9800E2000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                  • memory/3740-337-0x00000212C7710000-0x00000212C775D000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    308KB

                                                                                                                                                                                                                  • memory/3740-354-0x00000212C7820000-0x00000212C7892000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    456KB

                                                                                                                                                                                                                  • memory/4012-513-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                  • memory/4052-164-0x00000000770E0000-0x000000007726E000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    1.6MB

                                                                                                                                                                                                                  • memory/4052-165-0x00000000001B0000-0x00000000008A7000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    7.0MB

                                                                                                                                                                                                                  • memory/4052-166-0x00000000001B0000-0x00000000008A7000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    7.0MB

                                                                                                                                                                                                                  • memory/4052-167-0x00000000001B0000-0x00000000008A7000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    7.0MB

                                                                                                                                                                                                                  • memory/4052-168-0x00000000001B0000-0x00000000008A7000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    7.0MB

                                                                                                                                                                                                                  • memory/4124-292-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                  • memory/4156-174-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                  • memory/4156-180-0x00000000010A0000-0x000000000178B000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    6.9MB

                                                                                                                                                                                                                  • memory/4156-178-0x00000000010A0000-0x000000000178B000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    6.9MB

                                                                                                                                                                                                                  • memory/4156-182-0x00000000010A0000-0x000000000178B000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    6.9MB

                                                                                                                                                                                                                  • memory/4156-179-0x00000000010A0000-0x000000000178B000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    6.9MB

                                                                                                                                                                                                                  • memory/4156-181-0x00000000770E0000-0x000000007726E000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    1.6MB

                                                                                                                                                                                                                  • memory/4168-175-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                  • memory/4252-183-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                  • memory/4296-184-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                  • memory/4372-185-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                  • memory/4456-217-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                  • memory/4536-187-0x0000000000F60000-0x000000000164B000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    6.9MB

                                                                                                                                                                                                                  • memory/4536-190-0x0000000000F60000-0x000000000164B000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    6.9MB

                                                                                                                                                                                                                  • memory/4536-189-0x0000000000F60000-0x000000000164B000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    6.9MB

                                                                                                                                                                                                                  • memory/4536-191-0x00000000770E0000-0x000000007726E000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    1.6MB

                                                                                                                                                                                                                  • memory/4536-188-0x0000000000F60000-0x000000000164B000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    6.9MB

                                                                                                                                                                                                                  • memory/4536-186-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                  • memory/4628-514-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                  • memory/4664-291-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                  • memory/5000-324-0x00000000048E0000-0x0000000004997000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    732KB

                                                                                                                                                                                                                  • memory/5000-322-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                  • memory/5008-289-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                  • memory/5288-295-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                  • memory/5364-306-0x0000000002830000-0x00000000029CC000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    1.6MB

                                                                                                                                                                                                                  • memory/5364-299-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                  • memory/5400-300-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                  • memory/5440-301-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                  • memory/5476-304-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                  • memory/5476-309-0x0000000004C50000-0x0000000004D07000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    732KB

                                                                                                                                                                                                                  • memory/5476-311-0x0000000005150000-0x0000000005207000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    732KB

                                                                                                                                                                                                                  • memory/5540-305-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                  • memory/5600-307-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                  • memory/5616-317-0x0000000000400000-0x0000000000AE8000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    6.9MB

                                                                                                                                                                                                                  • memory/5616-308-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                  • memory/5848-333-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                  • memory/5848-334-0x0000000000C26000-0x0000000000D27000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    1.0MB

                                                                                                                                                                                                                  • memory/5848-335-0x0000000004540000-0x000000000459D000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    372KB

                                                                                                                                                                                                                  • memory/5948-390-0x000002158C830000-0x000002158C859000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    164KB

                                                                                                                                                                                                                  • memory/5948-341-0x00007FF7C6AF4060-mapping.dmp
                                                                                                                                                                                                                  • memory/5948-358-0x000002158AE40000-0x000002158AEB2000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    456KB

                                                                                                                                                                                                                  • memory/5948-389-0x000002158AEC0000-0x000002158AEDB000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    108KB

                                                                                                                                                                                                                  • memory/5948-391-0x000002158D900000-0x000002158DA05000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    1.0MB

                                                                                                                                                                                                                  • memory/6116-321-0x0000000000000000-mapping.dmp