Resubmissions

01/02/2022, 09:10

220201-k4279scee5 10

15/01/2022, 13:42

220115-qztyzsefhn 10

12/01/2022, 12:30

220112-ppk3nacfbl 10

10/01/2022, 10:49

220110-mwsd7sebe3 10

07/01/2022, 20:35

220107-zc2jzsdaeq 10

07/01/2022, 10:05

220107-l4rxzacba8 10

06/01/2022, 22:46

220106-2qch5abff5 10

06/01/2022, 19:07

220106-xsnxqabhfl 10

06/01/2022, 15:26

220106-svedvabda5 10

06/01/2022, 15:25

220106-st3p2sbgcq 10

Analysis

  • max time kernel
    347s
  • max time network
    632s
  • platform
    windows7_x64
  • resource
    win7-ja-20211208
  • submitted
    07/01/2022, 20:35

General

  • Target

    4446186b0133b453f35a839b841ba453377c9a5638c1d81ee2313bb3adc22aaf.exe

  • Size

    339KB

  • MD5

    b75726b4b619811b4c50d917822a4083

  • SHA1

    ed8b418d7357609ce03c4f7123c0bb711b9d227d

  • SHA256

    4446186b0133b453f35a839b841ba453377c9a5638c1d81ee2313bb3adc22aaf

  • SHA512

    59516fdf6334f4005c7881322eb9a057939804e18ba8f13d0cb48fdc460aab19570c482e87700c6884807e1c885864ed422646f3150d9df731a10ecf5a7e05c9

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

http://srtuiyhuali.at/

http://fufuiloirtu.com/

http://amogohuigotuli.at/

http://novohudosovu.com/

http://brutuilionust.com/

http://bubushkalioua.com/

http://dumuilistrati.at/

http://verboliatsiaeeees.com/

rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family

tofsee

C2

patmushta.info

parubey.info

Signatures

  • Arkei

    Arkei is an infostealer written in C++.

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Windows security bypass 2 TTPs
  • suricata: ET MALWARE Fake Software Download Redirect Leading to Malware M3

    suricata: ET MALWARE Fake Software Download Redirect Leading to Malware M3

  • suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01

    suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01

  • suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload

    suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload

  • suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

    suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

  • suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

    suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

  • suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern

    suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Arkei Stealer Payload 3 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • XMRig Miner Payload 2 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 43 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Sets service image path in registry 2 TTPs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 8 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 15 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 4 IoCs
  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Kills process with taskkill 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 16 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: MapViewOfSection 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4446186b0133b453f35a839b841ba453377c9a5638c1d81ee2313bb3adc22aaf.exe
    "C:\Users\Admin\AppData\Local\Temp\4446186b0133b453f35a839b841ba453377c9a5638c1d81ee2313bb3adc22aaf.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:432
    • C:\Users\Admin\AppData\Local\Temp\4446186b0133b453f35a839b841ba453377c9a5638c1d81ee2313bb3adc22aaf.exe
      "C:\Users\Admin\AppData\Local\Temp\4446186b0133b453f35a839b841ba453377c9a5638c1d81ee2313bb3adc22aaf.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:1840
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1924
  • C:\Users\Admin\AppData\Local\Temp\3BF7.exe
    C:\Users\Admin\AppData\Local\Temp\3BF7.exe
    1⤵
    • Executes dropped EXE
    • Checks SCSI registry key(s)
    • Suspicious behavior: MapViewOfSection
    PID:1636
  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    1⤵
    • Enumerates system info in registry
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1696
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef67a4f50,0x7fef67a4f60,0x7fef67a4f70
      2⤵
        PID:1428
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1212,18182463243157748508,2485837386691206697,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1220 /prefetch:2
        2⤵
          PID:568
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1212,18182463243157748508,2485837386691206697,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1276 /prefetch:8
          2⤵
            PID:580
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1212,18182463243157748508,2485837386691206697,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1640 /prefetch:8
            2⤵
              PID:604
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1212,18182463243157748508,2485837386691206697,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2100 /prefetch:1
              2⤵
                PID:524
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1212,18182463243157748508,2485837386691206697,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2108 /prefetch:1
                2⤵
                  PID:1600
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1212,18182463243157748508,2485837386691206697,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
                  2⤵
                    PID:2120
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1212,18182463243157748508,2485837386691206697,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3064 /prefetch:2
                    2⤵
                      PID:2156
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1212,18182463243157748508,2485837386691206697,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2992 /prefetch:1
                      2⤵
                        PID:2232
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1212,18182463243157748508,2485837386691206697,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3144 /prefetch:8
                        2⤵
                          PID:2296
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1212,18182463243157748508,2485837386691206697,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3220 /prefetch:8
                          2⤵
                            PID:2304
                          • C:\Windows\system32\IME\IMEJP10\imjppdmg.exe
                            /Migration
                            2⤵
                              PID:2416
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1212,18182463243157748508,2485837386691206697,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4000 /prefetch:8
                              2⤵
                                PID:2604
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1212,18182463243157748508,2485837386691206697,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4104 /prefetch:1
                                2⤵
                                  PID:2920
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1212,18182463243157748508,2485837386691206697,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2416 /prefetch:1
                                  2⤵
                                    PID:2956
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1212,18182463243157748508,2485837386691206697,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2120 /prefetch:8
                                    2⤵
                                      PID:3056
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1212,18182463243157748508,2485837386691206697,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4140 /prefetch:8
                                      2⤵
                                        PID:2168
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1212,18182463243157748508,2485837386691206697,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4104 /prefetch:8
                                        2⤵
                                          PID:2308
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1212,18182463243157748508,2485837386691206697,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4112 /prefetch:8
                                          2⤵
                                            PID:2328
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1212,18182463243157748508,2485837386691206697,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3700 /prefetch:8
                                            2⤵
                                              PID:2336
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1212,18182463243157748508,2485837386691206697,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3512 /prefetch:8
                                              2⤵
                                                PID:2436
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1212,18182463243157748508,2485837386691206697,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4112 /prefetch:8
                                                2⤵
                                                  PID:2480
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1212,18182463243157748508,2485837386691206697,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4200 /prefetch:8
                                                  2⤵
                                                    PID:2536
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1212,18182463243157748508,2485837386691206697,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3484 /prefetch:8
                                                    2⤵
                                                      PID:2616
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1212,18182463243157748508,2485837386691206697,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3148 /prefetch:1
                                                      2⤵
                                                        PID:2736
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1212,18182463243157748508,2485837386691206697,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
                                                        2⤵
                                                          PID:2748
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1212,18182463243157748508,2485837386691206697,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
                                                          2⤵
                                                            PID:2916
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1212,18182463243157748508,2485837386691206697,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3556 /prefetch:1
                                                            2⤵
                                                              PID:308
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1212,18182463243157748508,2485837386691206697,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
                                                              2⤵
                                                                PID:1640
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1212,18182463243157748508,2485837386691206697,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3264 /prefetch:8
                                                                2⤵
                                                                  PID:2952
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1212,18182463243157748508,2485837386691206697,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3236 /prefetch:8
                                                                  2⤵
                                                                    PID:1080
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1212,18182463243157748508,2485837386691206697,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=532 /prefetch:8
                                                                    2⤵
                                                                      PID:1608
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1212,18182463243157748508,2485837386691206697,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3636 /prefetch:8
                                                                      2⤵
                                                                        PID:2720
                                                                    • C:\Users\Admin\AppData\Local\Temp\4FE9.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\4FE9.exe
                                                                      1⤵
                                                                      • Executes dropped EXE
                                                                      • Loads dropped DLL
                                                                      • Suspicious use of SetThreadContext
                                                                      PID:1640
                                                                      • C:\Users\Admin\AppData\Local\Temp\4FE9.exe
                                                                        C:\Users\Admin\AppData\Local\Temp\4FE9.exe
                                                                        2⤵
                                                                        • Executes dropped EXE
                                                                        • Checks SCSI registry key(s)
                                                                        • Suspicious behavior: MapViewOfSection
                                                                        PID:1560
                                                                    • C:\Users\Admin\AppData\Local\Temp\66D4.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\66D4.exe
                                                                      1⤵
                                                                      • Executes dropped EXE
                                                                      • Loads dropped DLL
                                                                      • Checks processor information in registry
                                                                      PID:2368
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\66D4.exe" & exit
                                                                        2⤵
                                                                          PID:2628
                                                                          • C:\Windows\SysWOW64\timeout.exe
                                                                            timeout /t 5
                                                                            3⤵
                                                                            • Delays execution with timeout.exe
                                                                            PID:2012
                                                                      • C:\Users\Admin\AppData\Local\Temp\7324.exe
                                                                        C:\Users\Admin\AppData\Local\Temp\7324.exe
                                                                        1⤵
                                                                        • Executes dropped EXE
                                                                        PID:2444
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\rptmldfj\
                                                                          2⤵
                                                                            PID:2496
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\ndrbdhql.exe" C:\Windows\SysWOW64\rptmldfj\
                                                                            2⤵
                                                                              PID:2536
                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                              "C:\Windows\System32\sc.exe" create rptmldfj binPath= "C:\Windows\SysWOW64\rptmldfj\ndrbdhql.exe /d\"C:\Users\Admin\AppData\Local\Temp\7324.exe\"" type= own start= auto DisplayName= "wifi support"
                                                                              2⤵
                                                                                PID:2612
                                                                              • C:\Windows\SysWOW64\sc.exe
                                                                                "C:\Windows\System32\sc.exe" description rptmldfj "wifi internet conection"
                                                                                2⤵
                                                                                  PID:2684
                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                  "C:\Windows\System32\sc.exe" start rptmldfj
                                                                                  2⤵
                                                                                    PID:2720
                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                                                                                    2⤵
                                                                                      PID:2772
                                                                                  • C:\Users\Admin\AppData\Local\Temp\7DB0.exe
                                                                                    C:\Users\Admin\AppData\Local\Temp\7DB0.exe
                                                                                    1⤵
                                                                                    • Executes dropped EXE
                                                                                    • Loads dropped DLL
                                                                                    • Suspicious use of SetThreadContext
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:2568
                                                                                    • C:\Users\Admin\AppData\Local\Temp\7DB0.exe
                                                                                      C:\Users\Admin\AppData\Local\Temp\7DB0.exe
                                                                                      2⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:2800
                                                                                    • C:\Users\Admin\AppData\Local\Temp\7DB0.exe
                                                                                      C:\Users\Admin\AppData\Local\Temp\7DB0.exe
                                                                                      2⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:2188
                                                                                    • C:\Users\Admin\AppData\Local\Temp\7DB0.exe
                                                                                      C:\Users\Admin\AppData\Local\Temp\7DB0.exe
                                                                                      2⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:2880
                                                                                    • C:\Users\Admin\AppData\Local\Temp\7DB0.exe
                                                                                      C:\Users\Admin\AppData\Local\Temp\7DB0.exe
                                                                                      2⤵
                                                                                      • Executes dropped EXE
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:1892
                                                                                  • C:\Windows\SysWOW64\rptmldfj\ndrbdhql.exe
                                                                                    C:\Windows\SysWOW64\rptmldfj\ndrbdhql.exe /d"C:\Users\Admin\AppData\Local\Temp\7324.exe"
                                                                                    1⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of SetThreadContext
                                                                                    PID:2756
                                                                                    • C:\Windows\SysWOW64\svchost.exe
                                                                                      svchost.exe
                                                                                      2⤵
                                                                                      • Drops file in System32 directory
                                                                                      • Suspicious use of SetThreadContext
                                                                                      • Modifies data under HKEY_USERS
                                                                                      PID:2840
                                                                                      • C:\Windows\SysWOW64\svchost.exe
                                                                                        svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
                                                                                        3⤵
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:2580
                                                                                  • C:\Windows\SysWOW64\explorer.exe
                                                                                    C:\Windows\SysWOW64\explorer.exe
                                                                                    1⤵
                                                                                    • Accesses Microsoft Outlook profiles
                                                                                    • outlook_office_path
                                                                                    • outlook_win_path
                                                                                    PID:2336
                                                                                  • C:\Windows\explorer.exe
                                                                                    C:\Windows\explorer.exe
                                                                                    1⤵
                                                                                      PID:2436
                                                                                    • C:\Users\Admin\AppData\Local\Temp\E76B.exe
                                                                                      C:\Users\Admin\AppData\Local\Temp\E76B.exe
                                                                                      1⤵
                                                                                      • Executes dropped EXE
                                                                                      • Loads dropped DLL
                                                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                      • Checks processor information in registry
                                                                                      PID:2688
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\E76B.exe" & exit
                                                                                        2⤵
                                                                                          PID:2724
                                                                                          • C:\Windows\SysWOW64\timeout.exe
                                                                                            timeout /t 5
                                                                                            3⤵
                                                                                            • Delays execution with timeout.exe
                                                                                            PID:1280
                                                                                      • C:\Users\Admin\AppData\Local\Temp\FD7C.exe
                                                                                        C:\Users\Admin\AppData\Local\Temp\FD7C.exe
                                                                                        1⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:2920
                                                                                      • C:\Users\Admin\AppData\Local\Temp\1F05.exe
                                                                                        C:\Users\Admin\AppData\Local\Temp\1F05.exe
                                                                                        1⤵
                                                                                        • Executes dropped EXE
                                                                                        • Checks BIOS information in registry
                                                                                        • Checks whether UAC is enabled
                                                                                        • Suspicious use of SetThreadContext
                                                                                        PID:1832
                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                                                                                          2⤵
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:1544
                                                                                      • C:\Users\Admin\AppData\Local\Temp\70BD.exe
                                                                                        C:\Users\Admin\AppData\Local\Temp\70BD.exe
                                                                                        1⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:2636
                                                                                      • C:\Windows\system32\taskmgr.exe
                                                                                        "C:\Windows\system32\taskmgr.exe" /4
                                                                                        1⤵
                                                                                        • Suspicious behavior: GetForegroundWindowSpam
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:2680
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                        1⤵
                                                                                        • Enumerates system info in registry
                                                                                        PID:1620
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef67a4f50,0x7fef67a4f60,0x7fef67a4f70
                                                                                          2⤵
                                                                                            PID:1216
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1096,17735184043441812630,3257516693038403385,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1112 /prefetch:2
                                                                                            2⤵
                                                                                              PID:2244
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1096,17735184043441812630,3257516693038403385,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1444 /prefetch:8
                                                                                              2⤵
                                                                                                PID:2412
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1096,17735184043441812630,3257516693038403385,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1940 /prefetch:1
                                                                                                2⤵
                                                                                                  PID:548
                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1096,17735184043441812630,3257516693038403385,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1888 /prefetch:1
                                                                                                  2⤵
                                                                                                    PID:1708
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1096,17735184043441812630,3257516693038403385,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1876 /prefetch:1
                                                                                                    2⤵
                                                                                                      PID:2184
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1096,17735184043441812630,3257516693038403385,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1824 /prefetch:8
                                                                                                      2⤵
                                                                                                        PID:3032
                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1096,17735184043441812630,3257516693038403385,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2424 /prefetch:2
                                                                                                        2⤵
                                                                                                          PID:2308
                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1096,17735184043441812630,3257516693038403385,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
                                                                                                          2⤵
                                                                                                            PID:1516
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1096,17735184043441812630,3257516693038403385,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3352 /prefetch:8
                                                                                                            2⤵
                                                                                                              PID:1668
                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1096,17735184043441812630,3257516693038403385,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3452 /prefetch:8
                                                                                                              2⤵
                                                                                                                PID:1488
                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1096,17735184043441812630,3257516693038403385,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3980 /prefetch:8
                                                                                                                2⤵
                                                                                                                  PID:2028
                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1096,17735184043441812630,3257516693038403385,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3860 /prefetch:8
                                                                                                                  2⤵
                                                                                                                    PID:1028
                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1096,17735184043441812630,3257516693038403385,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2116 /prefetch:1
                                                                                                                    2⤵
                                                                                                                      PID:1956
                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1096,17735184043441812630,3257516693038403385,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3964 /prefetch:8
                                                                                                                      2⤵
                                                                                                                        PID:1936
                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1096,17735184043441812630,3257516693038403385,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1724 /prefetch:1
                                                                                                                        2⤵
                                                                                                                          PID:2684
                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1096,17735184043441812630,3257516693038403385,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2176 /prefetch:1
                                                                                                                          2⤵
                                                                                                                            PID:1808
                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1096,17735184043441812630,3257516693038403385,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2172 /prefetch:1
                                                                                                                            2⤵
                                                                                                                              PID:2108
                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1096,17735184043441812630,3257516693038403385,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
                                                                                                                              2⤵
                                                                                                                                PID:1668
                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1096,17735184043441812630,3257516693038403385,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2396 /prefetch:1
                                                                                                                                2⤵
                                                                                                                                  PID:2288
                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1096,17735184043441812630,3257516693038403385,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=732 /prefetch:1
                                                                                                                                  2⤵
                                                                                                                                    PID:2444
                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1096,17735184043441812630,3257516693038403385,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3640 /prefetch:8
                                                                                                                                    2⤵
                                                                                                                                      PID:1768
                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1096,17735184043441812630,3257516693038403385,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1624 /prefetch:8
                                                                                                                                      2⤵
                                                                                                                                        PID:3004
                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1096,17735184043441812630,3257516693038403385,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3660 /prefetch:8
                                                                                                                                        2⤵
                                                                                                                                          PID:1644
                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1096,17735184043441812630,3257516693038403385,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
                                                                                                                                          2⤵
                                                                                                                                            PID:988
                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1096,17735184043441812630,3257516693038403385,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1072 /prefetch:8
                                                                                                                                            2⤵
                                                                                                                                              PID:2856
                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1096,17735184043441812630,3257516693038403385,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
                                                                                                                                              2⤵
                                                                                                                                                PID:2640
                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1096,17735184043441812630,3257516693038403385,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3664 /prefetch:8
                                                                                                                                                2⤵
                                                                                                                                                  PID:2524
                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1096,17735184043441812630,3257516693038403385,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3612 /prefetch:8
                                                                                                                                                  2⤵
                                                                                                                                                    PID:2688
                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1096,17735184043441812630,3257516693038403385,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1624 /prefetch:8
                                                                                                                                                    2⤵
                                                                                                                                                      PID:2452
                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1096,17735184043441812630,3257516693038403385,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3528 /prefetch:8
                                                                                                                                                      2⤵
                                                                                                                                                        PID:2204
                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1096,17735184043441812630,3257516693038403385,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1264 /prefetch:1
                                                                                                                                                        2⤵
                                                                                                                                                          PID:2664
                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1096,17735184043441812630,3257516693038403385,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4232 /prefetch:8
                                                                                                                                                          2⤵
                                                                                                                                                            PID:2176
                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1096,17735184043441812630,3257516693038403385,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1068 /prefetch:1
                                                                                                                                                            2⤵
                                                                                                                                                              PID:3004
                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1096,17735184043441812630,3257516693038403385,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4292 /prefetch:8
                                                                                                                                                              2⤵
                                                                                                                                                                PID:2276
                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1096,17735184043441812630,3257516693038403385,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4512 /prefetch:8
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:456
                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1096,17735184043441812630,3257516693038403385,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4400 /prefetch:8
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:1112
                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1096,17735184043441812630,3257516693038403385,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4368 /prefetch:8
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:3928
                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1096,17735184043441812630,3257516693038403385,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4376 /prefetch:1
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:4068
                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\jgwgscr
                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\jgwgscr
                                                                                                                                                                      1⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Checks SCSI registry key(s)
                                                                                                                                                                      • Suspicious behavior: MapViewOfSection
                                                                                                                                                                      PID:2968
                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\rbwgscr
                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\rbwgscr
                                                                                                                                                                      1⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                      PID:3036
                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\rbwgscr
                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\rbwgscr
                                                                                                                                                                        2⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        PID:1796
                                                                                                                                                                    • C:\Windows\system32\AUDIODG.EXE
                                                                                                                                                                      C:\Windows\system32\AUDIODG.EXE 0x550
                                                                                                                                                                      1⤵
                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                      PID:1892
                                                                                                                                                                    • C:\Users\Admin\Desktop\139_setupInstaller.exe
                                                                                                                                                                      "C:\Users\Admin\Desktop\139_setupInstaller.exe"
                                                                                                                                                                      1⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                      PID:2204
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
                                                                                                                                                                        2⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                        PID:1704
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS8A6F57CA\setup_install.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7zS8A6F57CA\setup_install.exe"
                                                                                                                                                                          3⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                          PID:2896
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
                                                                                                                                                                            4⤵
                                                                                                                                                                              PID:2284
                                                                                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
                                                                                                                                                                                5⤵
                                                                                                                                                                                  PID:1676
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
                                                                                                                                                                                4⤵
                                                                                                                                                                                  PID:2532
                                                                                                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
                                                                                                                                                                                    5⤵
                                                                                                                                                                                      PID:3016
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c 61d89f45721ba_Fri201af093785.exe
                                                                                                                                                                                    4⤵
                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                    PID:2944
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS8A6F57CA\61d89f45721ba_Fri201af093785.exe
                                                                                                                                                                                      61d89f45721ba_Fri201af093785.exe
                                                                                                                                                                                      5⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      • Checks BIOS information in registry
                                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                                      • Checks whether UAC is enabled
                                                                                                                                                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                      • Checks processor information in registry
                                                                                                                                                                                      PID:932
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        "C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\oqotQEiQZ & timeout 4 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zS8A6F57CA\61d89f45721ba_Fri201af093785.exe"
                                                                                                                                                                                        6⤵
                                                                                                                                                                                          PID:3492
                                                                                                                                                                                          • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                            timeout 4
                                                                                                                                                                                            7⤵
                                                                                                                                                                                            • Delays execution with timeout.exe
                                                                                                                                                                                            PID:3548
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c 61d89f45c11b1_Fri200b541c849c.exe
                                                                                                                                                                                      4⤵
                                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                                      PID:988
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS8A6F57CA\61d89f45c11b1_Fri200b541c849c.exe
                                                                                                                                                                                        61d89f45c11b1_Fri200b541c849c.exe
                                                                                                                                                                                        5⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                        PID:2336
                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\53E.tmp.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\53E.tmp.exe"
                                                                                                                                                                                          6⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          PID:3668
                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\F0F.tmp.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\F0F.tmp.exe"
                                                                                                                                                                                          6⤵
                                                                                                                                                                                            PID:3744
                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\1660.tmp.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\1660.tmp.exe"
                                                                                                                                                                                            6⤵
                                                                                                                                                                                              PID:3796
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\7zS8A6F57CA\61d89f45c11b1_Fri200b541c849c.exe" >> NUL
                                                                                                                                                                                              6⤵
                                                                                                                                                                                                PID:3948
                                                                                                                                                                                                • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                                                                  ping 127.0.0.1
                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                  PID:3960
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c 61d89f47a4200_Fri20e6bc70ba49.exe
                                                                                                                                                                                            4⤵
                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                            PID:2776
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS8A6F57CA\61d89f47a4200_Fri20e6bc70ba49.exe
                                                                                                                                                                                              61d89f47a4200_Fri20e6bc70ba49.exe
                                                                                                                                                                                              5⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                              • Modifies system certificate store
                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                              PID:1948
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                cmd.exe /c taskkill /f /im chrome.exe
                                                                                                                                                                                                6⤵
                                                                                                                                                                                                  PID:3504
                                                                                                                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                    taskkill /f /im chrome.exe
                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                    • Kills process with taskkill
                                                                                                                                                                                                    PID:3564
                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                    PID:3884
                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef67a4f50,0x7fef67a4f60,0x7fef67a4f70
                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                        PID:3972
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c 61d89f487aec0_Fri20b83dc510.exe
                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                                  PID:1592
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS8A6F57CA\61d89f487aec0_Fri20b83dc510.exe
                                                                                                                                                                                                    61d89f487aec0_Fri20b83dc510.exe
                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                                    PID:2788
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\942b7f22-eac2-48de-8278-1b334c7077d9.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\942b7f22-eac2-48de-8278-1b334c7077d9.exe"
                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                        PID:3380
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\e8030e09-4db1-458c-96c4-2dd88247490a.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\e8030e09-4db1-458c-96c4-2dd88247490a.exe"
                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                          PID:3092
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ed6017c8-60de-4d50-9c61-246f46f9c97c.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ed6017c8-60de-4d50-9c61-246f46f9c97c.exe"
                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                            PID:2612
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6bf2f42c-fa0f-4902-bd39-96817cfb5a80.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6bf2f42c-fa0f-4902-bd39-96817cfb5a80.exe"
                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                              PID:1760
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ab28edb4-524c-4175-a2ff-1807541bfa2f.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ab28edb4-524c-4175-a2ff-1807541bfa2f.exe"
                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                PID:3980
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\8848233.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\8848233.exe"
                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                    PID:4088
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\control.exe
                                                                                                                                                                                                                      "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\50jiI6D.cpL",
                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                        PID:2412
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                          "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\50jiI6D.cpL",
                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                            PID:1028
                                                                                                                                                                                                                            • C:\Windows\system32\RunDll32.exe
                                                                                                                                                                                                                              C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\50jiI6D.cpL",
                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                PID:3084
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                  "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\50jiI6D.cpL",
                                                                                                                                                                                                                                  11⤵
                                                                                                                                                                                                                                    PID:4000
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c 61d89f49b6199_Fri20c94001.exe
                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                        PID:1800
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS8A6F57CA\61d89f49b6199_Fri20c94001.exe
                                                                                                                                                                                                                          61d89f49b6199_Fri20c94001.exe
                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                            PID:3500
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c 61d89f4a9e74a_Fri20448fd755.exe
                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                                                          PID:920
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS8A6F57CA\61d89f4a9e74a_Fri20448fd755.exe
                                                                                                                                                                                                                            61d89f4a9e74a_Fri20448fd755.exe
                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                                                            PID:2220
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\5255376997.exe"
                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                PID:3852
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\5255376997.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\5255376997.exe"
                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                    PID:3312
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c taskkill /im 5255376997.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\5255376997.exe" & del C:\ProgramData\*.dll & exit
                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                        PID:3356
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                          taskkill /im 5255376997.exe /f
                                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                                          • Kills process with taskkill
                                                                                                                                                                                                                                          PID:2348
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                                                          timeout /t 6
                                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                                          • Delays execution with timeout.exe
                                                                                                                                                                                                                                          PID:2096
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 768
                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                    • Program crash
                                                                                                                                                                                                                                    PID:3212
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c 61d89f4bc386f_Fri206caa80d49c.exe
                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                                PID:2636
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS8A6F57CA\61d89f4bc386f_Fri206caa80d49c.exe
                                                                                                                                                                                                                                  61d89f4bc386f_Fri206caa80d49c.exe
                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                                                                  PID:2420
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS8A6F57CA\61d89f4bc386f_Fri206caa80d49c.exe
                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7zS8A6F57CA\61d89f4bc386f_Fri206caa80d49c.exe
                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    PID:3208
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS8A6F57CA\61d89f4bc386f_Fri206caa80d49c.exe
                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7zS8A6F57CA\61d89f4bc386f_Fri206caa80d49c.exe
                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    PID:3476
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS8A6F57CA\61d89f4bc386f_Fri206caa80d49c.exe
                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7zS8A6F57CA\61d89f4bc386f_Fri206caa80d49c.exe
                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                      PID:3656
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c 61d89f4e083c6_Fri20a7f0304.exe
                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                                                                  PID:2244
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS8A6F57CA\61d89f4e083c6_Fri20a7f0304.exe
                                                                                                                                                                                                                                    61d89f4e083c6_Fri20a7f0304.exe
                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                                                                    • Checks SCSI registry key(s)
                                                                                                                                                                                                                                    • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                    PID:2448
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c 61d89f4ecb4c8_Fri20aa3e00cd06.exe
                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                                                                  PID:2592
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS8A6F57CA\61d89f4ecb4c8_Fri20aa3e00cd06.exe
                                                                                                                                                                                                                                    61d89f4ecb4c8_Fri20aa3e00cd06.exe
                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                    PID:1532
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS8A6F57CA\61d89f4ecb4c8_Fri20aa3e00cd06.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7zS8A6F57CA\61d89f4ecb4c8_Fri20aa3e00cd06.exe" -u
                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                      PID:3264
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c 61d89f5046090_Fri206cd1ca8363.exe
                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                    PID:2104
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS8A6F57CA\61d89f5046090_Fri206cd1ca8363.exe
                                                                                                                                                                                                                                      61d89f5046090_Fri206cd1ca8363.exe
                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      PID:3180
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\11111.exe /stab C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                          PID:3812
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c 61d89f526de40_Fri207dcb40.exe
                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                                                                                      PID:1604
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS8A6F57CA\61d89f526de40_Fri207dcb40.exe
                                                                                                                                                                                                                                        61d89f526de40_Fri207dcb40.exe
                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                                                                        PID:1148
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAwADsAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAwADsA
                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                            PID:3688
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\61d89f526de40_Fri207dcb40.exe
                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\61d89f526de40_Fri207dcb40.exe
                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                              PID:2996
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c 61d89f5225320_Fri20d04bdde5a.exe
                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                                                                          PID:692
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS8A6F57CA\61d89f5225320_Fri20d04bdde5a.exe
                                                                                                                                                                                                                                            61d89f5225320_Fri20d04bdde5a.exe
                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            PID:2552
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\is-L691I.tmp\61d89f5225320_Fri20d04bdde5a.tmp
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\is-L691I.tmp\61d89f5225320_Fri20d04bdde5a.tmp" /SL5="$3022E,140765,56832,C:\Users\Admin\AppData\Local\Temp\7zS8A6F57CA\61d89f5225320_Fri20d04bdde5a.exe"
                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              PID:3248
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS8A6F57CA\61d89f5225320_Fri20d04bdde5a.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7zS8A6F57CA\61d89f5225320_Fri20d04bdde5a.exe" /SILENT
                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                PID:3412
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-GDLGU.tmp\61d89f5225320_Fri20d04bdde5a.tmp
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-GDLGU.tmp\61d89f5225320_Fri20d04bdde5a.tmp" /SL5="$30246,140765,56832,C:\Users\Admin\AppData\Local\Temp\7zS8A6F57CA\61d89f5225320_Fri20d04bdde5a.exe" /SILENT
                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  PID:3456
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-T62SA.tmp\dllhostwin.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-T62SA.tmp\dllhostwin.exe" 77
                                                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                                                      PID:3400
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c 61d89f511a218_Fri20b28a460e.exe /mixtwo
                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                                                                            PID:2216
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS8A6F57CA\61d89f511a218_Fri20b28a460e.exe
                                                                                                                                                                                                                                              61d89f511a218_Fri20b28a460e.exe /mixtwo
                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                PID:3076
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS8A6F57CA\61d89f511a218_Fri20b28a460e.exe
                                                                                                                                                                                                                                                  61d89f511a218_Fri20b28a460e.exe /mixtwo
                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  PID:3240
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 3240 -s 500
                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                    • Program crash
                                                                                                                                                                                                                                                    PID:3396
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c 61d89f537071e_Fri20c174611.exe
                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                PID:3064
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS8A6F57CA\61d89f537071e_Fri20c174611.exe
                                                                                                                                                                                                                                                  61d89f537071e_Fri20c174611.exe
                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  PID:3088
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c 61d89f54b97d4_Fri2076f4f5f.exe
                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                  PID:2124
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS8A6F57CA\61d89f54b97d4_Fri2076f4f5f.exe
                                                                                                                                                                                                                                                    61d89f54b97d4_Fri2076f4f5f.exe
                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    PID:3228
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\control.exe
                                                                                                                                                                                                                                                      "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\50jiI6D.cpL",
                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                        PID:4028
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                          "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\50jiI6D.cpL",
                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                            PID:2784
                                                                                                                                                                                                                                              • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                                rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",global
                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                • Process spawned unexpected child process
                                                                                                                                                                                                                                                PID:3888
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",global
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                  PID:3076
                                                                                                                                                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                  PID:2716
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\4E31.exe
                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\4E31.exe
                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                    PID:3988
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\4E31.exe.dll,z C:\Users\Admin\AppData\Local\Temp\4E31.exe
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                        PID:2240
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6960.exe
                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\6960.exe
                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                        PID:3936
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\6960.exe.dll,z C:\Users\Admin\AppData\Local\Temp\6960.exe
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                            PID:1948
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\CD8F.exe
                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\CD8F.exe
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                            PID:3124
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\CD8F.exe.dll,z C:\Users\Admin\AppData\Local\Temp\CD8F.exe
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                PID:2720
                                                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                PID:2960
                                                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef62e4f50,0x7fef62e4f60,0x7fef62e4f70
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                    PID:2656
                                                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1092,5783871700243911626,909061755632886950,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1104 /prefetch:2
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                      PID:3264
                                                                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1092,5783871700243911626,909061755632886950,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1448 /prefetch:8
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                        PID:4028
                                                                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1092,5783871700243911626,909061755632886950,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1716 /prefetch:8
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                          PID:2056
                                                                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1092,5783871700243911626,909061755632886950,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2056 /prefetch:1
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                            PID:2996
                                                                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1092,5783871700243911626,909061755632886950,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2240 /prefetch:1
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                              PID:2644
                                                                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1092,5783871700243911626,909061755632886950,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2068 /prefetch:1
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                PID:3076
                                                                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1092,5783871700243911626,909061755632886950,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2112 /prefetch:1
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                  PID:1816
                                                                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1092,5783871700243911626,909061755632886950,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3444 /prefetch:2
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                    PID:2820
                                                                                                                                                                                                                                                                                • C:\Windows\system32\LogonUI.exe
                                                                                                                                                                                                                                                                                  "LogonUI.exe" /flags:0x0
                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                    PID:2964

                                                                                                                                                                                                                                                                                  Network

                                                                                                                                                                                                                                                                                        MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                                                                                                                        Downloads

                                                                                                                                                                                                                                                                                        • memory/432-54-0x00000000002E8000-0x00000000002F9000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          68KB

                                                                                                                                                                                                                                                                                        • memory/432-58-0x0000000000030000-0x0000000000039000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          36KB

                                                                                                                                                                                                                                                                                        • memory/1296-59-0x0000000002120000-0x0000000002136000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          88KB

                                                                                                                                                                                                                                                                                        • memory/1296-72-0x0000000004130000-0x0000000004146000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          88KB

                                                                                                                                                                                                                                                                                        • memory/1296-83-0x0000000004250000-0x0000000004266000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          88KB

                                                                                                                                                                                                                                                                                        • memory/1544-224-0x0000000000090000-0x00000000000B0000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                                                                        • memory/1544-236-0x0000000000090000-0x00000000000B0000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                                                                        • memory/1544-238-0x0000000000090000-0x00000000000B0000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                                                                        • memory/1636-68-0x0000000000400000-0x000000000046D000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          436KB

                                                                                                                                                                                                                                                                                        • memory/1636-65-0x00000000005BA000-0x00000000005CA000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          64KB

                                                                                                                                                                                                                                                                                        • memory/1636-66-0x0000000000020000-0x0000000000029000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          36KB

                                                                                                                                                                                                                                                                                        • memory/1640-73-0x0000000000628000-0x0000000000638000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          64KB

                                                                                                                                                                                                                                                                                        • memory/1832-217-0x0000000003370000-0x0000000003371000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                        • memory/1832-209-0x0000000002610000-0x0000000002611000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                        • memory/1832-220-0x0000000002750000-0x0000000002751000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                        • memory/1832-219-0x0000000002740000-0x0000000002741000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                        • memory/1832-218-0x0000000000300000-0x0000000000301000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                        • memory/1832-216-0x0000000003370000-0x0000000003371000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                        • memory/1832-215-0x0000000003370000-0x0000000003371000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                        • memory/1832-213-0x0000000003370000-0x0000000003371000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                        • memory/1832-214-0x0000000003370000-0x0000000003371000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                        • memory/1832-212-0x0000000002630000-0x0000000002631000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                        • memory/1832-211-0x00000000025C0000-0x00000000025C1000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                        • memory/1832-210-0x00000000025D0000-0x00000000025D1000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                        • memory/1832-208-0x00000000025A0000-0x00000000025A1000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                        • memory/1832-207-0x00000000025F0000-0x00000000025F1000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                        • memory/1832-206-0x00000000025E0000-0x00000000025E1000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                        • memory/1832-205-0x0000000003370000-0x0000000003371000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                        • memory/1832-204-0x0000000003370000-0x0000000003371000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                        • memory/1832-203-0x00000000007C0000-0x00000000007C1000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                        • memory/1832-202-0x0000000000760000-0x0000000000761000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                        • memory/1832-201-0x0000000000710000-0x0000000000711000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                        • memory/1832-200-0x00000000003F0000-0x00000000003F1000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                        • memory/1832-199-0x0000000000740000-0x0000000000741000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                        • memory/1832-198-0x0000000000730000-0x0000000000731000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                        • memory/1832-197-0x0000000003370000-0x0000000003371000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                        • memory/1832-196-0x0000000003370000-0x0000000003371000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                        • memory/1832-195-0x0000000003370000-0x0000000003371000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                        • memory/1832-194-0x0000000003370000-0x0000000003371000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                        • memory/1832-193-0x0000000003380000-0x0000000003381000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                        • memory/1832-192-0x00000000026B0000-0x00000000026B1000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                        • memory/1832-191-0x00000000026E0000-0x00000000026E1000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                        • memory/1832-190-0x0000000002670000-0x0000000002671000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                        • memory/1832-189-0x0000000002680000-0x0000000002681000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                        • memory/1832-188-0x00000000026C0000-0x00000000026C1000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                        • memory/1832-187-0x0000000002650000-0x0000000002651000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                        • memory/1832-186-0x00000000026A0000-0x00000000026A1000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                        • memory/1832-185-0x0000000002690000-0x0000000002691000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                        • memory/1832-184-0x0000000000390000-0x00000000003F0000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          384KB

                                                                                                                                                                                                                                                                                        • memory/1832-183-0x0000000000400000-0x00000000006F7000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          3.0MB

                                                                                                                                                                                                                                                                                        • memory/1832-182-0x0000000000400000-0x00000000006F7000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          3.0MB

                                                                                                                                                                                                                                                                                        • memory/1840-55-0x0000000000400000-0x0000000000409000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          36KB

                                                                                                                                                                                                                                                                                        • memory/1840-57-0x0000000076641000-0x0000000076643000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                                                                        • memory/1892-136-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                                                                        • memory/1892-132-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                                                                        • memory/1892-130-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                                                                        • memory/1892-133-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                                                                        • memory/1892-129-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                                                                        • memory/1892-137-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                                                                        • memory/1892-131-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                                                                        • memory/1892-138-0x0000000004A20000-0x0000000004A21000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                        • memory/1924-61-0x000007FEFC2E1000-0x000007FEFC2E3000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                                                                        • memory/2336-145-0x0000000000170000-0x00000000001E4000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          464KB

                                                                                                                                                                                                                                                                                        • memory/2336-146-0x0000000000100000-0x000000000016B000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          428KB

                                                                                                                                                                                                                                                                                        • memory/2336-141-0x0000000071C41000-0x0000000071C43000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                                                                        • memory/2368-85-0x0000000000400000-0x0000000000462000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          392KB

                                                                                                                                                                                                                                                                                        • memory/2368-84-0x0000000000020000-0x000000000003C000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          112KB

                                                                                                                                                                                                                                                                                        • memory/2368-82-0x0000000000558000-0x0000000000569000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          68KB

                                                                                                                                                                                                                                                                                        • memory/2436-148-0x0000000000060000-0x000000000006C000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          48KB

                                                                                                                                                                                                                                                                                        • memory/2436-147-0x0000000000070000-0x0000000000077000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          28KB

                                                                                                                                                                                                                                                                                        • memory/2444-93-0x0000000000020000-0x0000000000033000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          76KB

                                                                                                                                                                                                                                                                                        • memory/2444-94-0x0000000000400000-0x000000000045F000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          380KB

                                                                                                                                                                                                                                                                                        • memory/2444-89-0x00000000005E8000-0x00000000005F9000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          68KB

                                                                                                                                                                                                                                                                                        • memory/2568-106-0x0000000000570000-0x0000000000571000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                        • memory/2568-102-0x0000000000200000-0x000000000028A000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          552KB

                                                                                                                                                                                                                                                                                        • memory/2568-105-0x00000000049F0000-0x00000000049F1000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                        • memory/2568-101-0x0000000000200000-0x000000000028A000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          552KB

                                                                                                                                                                                                                                                                                        • memory/2580-247-0x0000000000200000-0x00000000002F1000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          964KB

                                                                                                                                                                                                                                                                                        • memory/2580-248-0x0000000000200000-0x00000000002F1000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          964KB

                                                                                                                                                                                                                                                                                        • memory/2636-261-0x0000000000508000-0x0000000000534000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          176KB

                                                                                                                                                                                                                                                                                        • memory/2688-163-0x0000000075E20000-0x0000000075ECC000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          688KB

                                                                                                                                                                                                                                                                                        • memory/2688-166-0x0000000000130000-0x0000000000176000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          280KB

                                                                                                                                                                                                                                                                                        • memory/2688-160-0x0000000000CD0000-0x0000000000D86000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          728KB

                                                                                                                                                                                                                                                                                        • memory/2688-159-0x0000000000CD0000-0x0000000000D86000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          728KB

                                                                                                                                                                                                                                                                                        • memory/2688-162-0x00000000760E0000-0x0000000076127000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          284KB

                                                                                                                                                                                                                                                                                        • memory/2688-161-0x0000000000180000-0x0000000000181000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                        • memory/2756-117-0x0000000000400000-0x000000000045F000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          380KB

                                                                                                                                                                                                                                                                                        • memory/2756-111-0x00000000005B8000-0x00000000005C9000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          68KB

                                                                                                                                                                                                                                                                                        • memory/2840-113-0x0000000000080000-0x0000000000095000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          84KB

                                                                                                                                                                                                                                                                                        • memory/2840-114-0x0000000000080000-0x0000000000095000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          84KB

                                                                                                                                                                                                                                                                                        • memory/2920-175-0x0000000000400000-0x0000000000885000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          4.5MB

                                                                                                                                                                                                                                                                                        • memory/2920-171-0x00000000009A0000-0x0000000000A37000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          604KB

                                                                                                                                                                                                                                                                                        • memory/2920-176-0x0000000002160000-0x00000000021F5000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          596KB

                                                                                                                                                                                                                                                                                        • memory/2920-174-0x000000000035E000-0x00000000003BB000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                                                        • memory/2920-177-0x0000000000400000-0x0000000000885000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          4.5MB

                                                                                                                                                                                                                                                                                        • memory/2920-255-0x0000000000400000-0x0000000000885000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          4.5MB

                                                                                                                                                                                                                                                                                        • memory/2920-172-0x0000000000400000-0x0000000000885000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          4.5MB

                                                                                                                                                                                                                                                                                        • memory/2920-170-0x00000000002EA000-0x000000000035D000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          460KB

                                                                                                                                                                                                                                                                                        • memory/2968-272-0x000000000061A000-0x000000000062A000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          64KB

                                                                                                                                                                                                                                                                                        • memory/3036-275-0x0000000000898000-0x00000000008A9000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          68KB