Analysis

  • max time kernel
    1801s
  • max time network
    1775s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220310-en
  • submitted
    22/03/2022, 18:16

General

  • Target

    Test.py

  • Size

    128KB

  • MD5

    31ccc463d2d0e26c29ef7d666039f11c

  • SHA1

    ccbbbfba471f35760632eafd4577df0913e4ebab

  • SHA256

    b8861b968bb930b800d7d51bd04355f7312144ee51d91c332ab36c7b845050dc

  • SHA512

    da321017f0b4eaaab3baa2c6e67f3cfa635b7ce6b5423aa9c9e25d8f3c4b3f5390b3c7c196ce86eee97ef9a47aa980a30660862362f0dd230c74db2cb565fd02

Malware Config

Signatures

  • Registers COM server for autorun 1 TTPs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 13 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 6 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 60 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 11 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 34 IoCs
  • Modifies data under HKEY_USERS 38 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 58 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 57 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:2348
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault65b84859hbe51h433eha76ah2045dfd3f8a2
        2⤵
        • Enumerates system info in registry
        PID:5496
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa3f0446f8,0x7ffa3f044708,0x7ffa3f044718
          3⤵
            PID:1096
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,5473358884075486545,17958046945897949375,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
            3⤵
              PID:4604
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,5473358884075486545,17958046945897949375,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
              3⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:1984
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,5473358884075486545,17958046945897949375,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
              3⤵
                PID:5764
          • C:\Windows\system32\cmd.exe
            cmd /c C:\Users\Admin\AppData\Local\Temp\Test.py
            1⤵
              PID:4468
            • C:\Windows\System32\svchost.exe
              C:\Windows\System32\svchost.exe -k netsvcs -p
              1⤵
              • Drops file in System32 directory
              • Checks processor information in registry
              • Enumerates system info in registry
              PID:3932
            • C:\Windows\system32\OpenWith.exe
              C:\Windows\system32\OpenWith.exe -Embedding
              1⤵
              • Modifies registry class
              • Suspicious use of SetWindowsHookEx
              PID:4556
            • C:\Windows\System32\svchost.exe
              C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
              1⤵
              • Modifies data under HKEY_USERS
              PID:2304
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe"
              1⤵
              • Enumerates system info in registry
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of WriteProcessMemory
              PID:2704
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xe4,0x108,0x7ffa39544f50,0x7ffa39544f60,0x7ffa39544f70
                2⤵
                  PID:968
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1628 /prefetch:2
                  2⤵
                    PID:2480
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1928 /prefetch:8
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1500
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2256 /prefetch:8
                    2⤵
                      PID:4052
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2912 /prefetch:1
                      2⤵
                        PID:2344
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2860 /prefetch:1
                        2⤵
                          PID:4676
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3700 /prefetch:1
                          2⤵
                            PID:3284
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4440 /prefetch:8
                            2⤵
                              PID:4656
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4540 /prefetch:8
                              2⤵
                                PID:2680
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4568 /prefetch:8
                                2⤵
                                  PID:3288
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4696 /prefetch:8
                                  2⤵
                                    PID:3216
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4540 /prefetch:8
                                    2⤵
                                      PID:5080
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4756 /prefetch:8
                                      2⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:1460
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:1
                                      2⤵
                                        PID:2060
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3844 /prefetch:1
                                        2⤵
                                          PID:4572
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5716 /prefetch:8
                                          2⤵
                                            PID:3272
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5852 /prefetch:8
                                            2⤵
                                              PID:1680
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5740 /prefetch:8
                                              2⤵
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:4540
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5940 /prefetch:8
                                              2⤵
                                                PID:2876
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5728 /prefetch:8
                                                2⤵
                                                  PID:1868
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5844 /prefetch:8
                                                  2⤵
                                                    PID:4384
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5852 /prefetch:8
                                                    2⤵
                                                      PID:1340
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3956 /prefetch:8
                                                      2⤵
                                                        PID:3956
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3816 /prefetch:8
                                                        2⤵
                                                          PID:1316
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3764 /prefetch:1
                                                          2⤵
                                                            PID:556
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3736 /prefetch:1
                                                            2⤵
                                                              PID:4692
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
                                                              2⤵
                                                                PID:2560
                                                              • C:\Windows\system32\control.exe
                                                                "C:\Windows\system32\control.exe" /name Microsoft.DateAndTime
                                                                2⤵
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:3532
                                                                • C:\Windows\System32\rundll32.exe
                                                                  "C:\Windows\System32\rundll32.exe" C:\Windows\System32\shell32.dll,Control_RunDLL C:\Windows\System32\timedate.cpl
                                                                  3⤵
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:3284
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:8
                                                                2⤵
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:1008
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3848 /prefetch:8
                                                                2⤵
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:4384
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4396 /prefetch:8
                                                                2⤵
                                                                  PID:3412
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6000 /prefetch:8
                                                                  2⤵
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:4284
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3648 /prefetch:8
                                                                  2⤵
                                                                    PID:2748
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3492 /prefetch:1
                                                                    2⤵
                                                                      PID:4540
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2024 /prefetch:8
                                                                      2⤵
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      PID:1544
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2948 /prefetch:8
                                                                      2⤵
                                                                        PID:4500
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2972 /prefetch:8
                                                                        2⤵
                                                                          PID:3896
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3588 /prefetch:8
                                                                          2⤵
                                                                            PID:788
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2944 /prefetch:8
                                                                            2⤵
                                                                              PID:3128
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3648 /prefetch:8
                                                                              2⤵
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              PID:4388
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3392 /prefetch:8
                                                                              2⤵
                                                                                PID:4700
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2236 /prefetch:8
                                                                                2⤵
                                                                                  PID:2360
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5088 /prefetch:8
                                                                                  2⤵
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  PID:2624
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3616 /prefetch:8
                                                                                  2⤵
                                                                                    PID:4544
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2892 /prefetch:8
                                                                                    2⤵
                                                                                      PID:536
                                                                                    • C:\Users\Admin\Downloads\python-3.10.3-amd64.exe
                                                                                      "C:\Users\Admin\Downloads\python-3.10.3-amd64.exe"
                                                                                      2⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:1372
                                                                                      • C:\Windows\Temp\{4039F549-C230-40C0-841C-DCD6EA8B918D}\.cr\python-3.10.3-amd64.exe
                                                                                        "C:\Windows\Temp\{4039F549-C230-40C0-841C-DCD6EA8B918D}\.cr\python-3.10.3-amd64.exe" -burn.clean.room="C:\Users\Admin\Downloads\python-3.10.3-amd64.exe" -burn.filehandle.attached=560 -burn.filehandle.self=556
                                                                                        3⤵
                                                                                        • Executes dropped EXE
                                                                                        • Checks computer location settings
                                                                                        • Loads dropped DLL
                                                                                        • Adds Run key to start application
                                                                                        • Modifies registry class
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:2000
                                                                                        • C:\Windows\Temp\{F97E91C2-DC29-4BA4-8F9A-F3AC593DA41A}\.be\python-3.10.3-amd64.exe
                                                                                          "C:\Windows\Temp\{F97E91C2-DC29-4BA4-8F9A-F3AC593DA41A}\.be\python-3.10.3-amd64.exe" -q -burn.elevated BurnPipe.{619E3FCF-C815-4299-90E6-4BB280DF627E} {316237C3-4E03-4045-A125-E42FAA1DC8B5} 2000
                                                                                          4⤵
                                                                                          • Executes dropped EXE
                                                                                          PID:4940
                                                                                        • C:\Users\Admin\AppData\Local\Programs\Python\Python310\pythonw.exe
                                                                                          "C:\Users\Admin\AppData\Local\Programs\Python\Python310\pythonw.exe" -c "import winreg; winreg.SetValueEx(winreg.CreateKey(winreg.HKEY_LOCAL_MACHINE, r'SYSTEM\CurrentControlSet\Control\FileSystem'), 'LongPathsEnabled', None, winreg.REG_DWORD, 1)"
                                                                                          4⤵
                                                                                          • Executes dropped EXE
                                                                                          • Loads dropped DLL
                                                                                          PID:2316
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3792 /prefetch:8
                                                                                      2⤵
                                                                                        PID:3468
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4772 /prefetch:2
                                                                                        2⤵
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        PID:2520
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3732 /prefetch:1
                                                                                        2⤵
                                                                                          PID:3920
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2624 /prefetch:8
                                                                                          2⤵
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          PID:4920
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2612 /prefetch:8
                                                                                          2⤵
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          PID:4500
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:1
                                                                                          2⤵
                                                                                            PID:3408
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4712 /prefetch:8
                                                                                            2⤵
                                                                                              PID:1796
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2532 /prefetch:8
                                                                                              2⤵
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              PID:4620
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
                                                                                              2⤵
                                                                                                PID:4464
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
                                                                                                2⤵
                                                                                                  PID:4532
                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
                                                                                                  2⤵
                                                                                                    PID:1560
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
                                                                                                    2⤵
                                                                                                      PID:1488
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2628 /prefetch:1
                                                                                                      2⤵
                                                                                                        PID:5012
                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
                                                                                                        2⤵
                                                                                                          PID:3400
                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
                                                                                                          2⤵
                                                                                                            PID:4148
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6476 /prefetch:8
                                                                                                            2⤵
                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                            PID:1708
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6316 /prefetch:1
                                                                                                            2⤵
                                                                                                              PID:4776
                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4636 /prefetch:1
                                                                                                              2⤵
                                                                                                                PID:4704
                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3784 /prefetch:1
                                                                                                                2⤵
                                                                                                                  PID:4420
                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3592 /prefetch:1
                                                                                                                  2⤵
                                                                                                                    PID:920
                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6736 /prefetch:1
                                                                                                                    2⤵
                                                                                                                      PID:3752
                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6648 /prefetch:1
                                                                                                                      2⤵
                                                                                                                        PID:4460
                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
                                                                                                                        2⤵
                                                                                                                          PID:1868
                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=72 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7440 /prefetch:1
                                                                                                                          2⤵
                                                                                                                            PID:1204
                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=73 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7468 /prefetch:1
                                                                                                                            2⤵
                                                                                                                              PID:788
                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=71 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7040 /prefetch:1
                                                                                                                              2⤵
                                                                                                                                PID:3928
                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=70 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7048 /prefetch:1
                                                                                                                                2⤵
                                                                                                                                  PID:4812
                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
                                                                                                                                  2⤵
                                                                                                                                    PID:872
                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=68 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7036 /prefetch:1
                                                                                                                                    2⤵
                                                                                                                                      PID:3272
                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=74 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8160 /prefetch:1
                                                                                                                                      2⤵
                                                                                                                                        PID:1560
                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=75 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8372 /prefetch:1
                                                                                                                                        2⤵
                                                                                                                                          PID:1116
                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=76 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4520 /prefetch:1
                                                                                                                                          2⤵
                                                                                                                                            PID:5012
                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=77 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8624 /prefetch:1
                                                                                                                                            2⤵
                                                                                                                                              PID:3312
                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=78 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6908 /prefetch:1
                                                                                                                                              2⤵
                                                                                                                                                PID:5200
                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=79 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
                                                                                                                                                2⤵
                                                                                                                                                  PID:5232
                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=80 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8892 /prefetch:1
                                                                                                                                                  2⤵
                                                                                                                                                    PID:5288
                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=81 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8860 /prefetch:1
                                                                                                                                                    2⤵
                                                                                                                                                      PID:5296
                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=82 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8400 /prefetch:1
                                                                                                                                                      2⤵
                                                                                                                                                        PID:5304
                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=85 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8488 /prefetch:1
                                                                                                                                                        2⤵
                                                                                                                                                          PID:5440
                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=84 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8448 /prefetch:1
                                                                                                                                                          2⤵
                                                                                                                                                            PID:5432
                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=83 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8456 /prefetch:1
                                                                                                                                                            2⤵
                                                                                                                                                              PID:5424
                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=86 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9636 /prefetch:1
                                                                                                                                                              2⤵
                                                                                                                                                                PID:5596
                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=87 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9200 /prefetch:1
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:5700
                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=88 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9284 /prefetch:1
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:5832
                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=90 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8832 /prefetch:1
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:5864
                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=89 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9272 /prefetch:1
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:5856
                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=91 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6864 /prefetch:1
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:5872
                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=93 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:6004
                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=92 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4388 /prefetch:1
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:5972
                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=94 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10388 /prefetch:1
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:5392
                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=95 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7792 /prefetch:1
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:5204
                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=96 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8152 /prefetch:1
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:5244
                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=97 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9552 /prefetch:1
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:5488
                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=98 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9544 /prefetch:1
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:864
                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=99 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6904 /prefetch:1
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:5060
                                                                                                                                                                                        • C:\Windows\py.exe
                                                                                                                                                                                          "C:\Windows\py.exe" "C:\Users\Admin\Downloads\Test.py"
                                                                                                                                                                                          2⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          PID:2288
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe
                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe "C:\Users\Admin\Downloads\Test.py"
                                                                                                                                                                                            3⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                            PID:6088
                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6640 /prefetch:8
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:3644
                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=11656 /prefetch:8
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:4364
                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4692 /prefetch:8
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:3668
                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=976 /prefetch:8
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:1344
                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5476 /prefetch:8
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:1888
                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4864 /prefetch:8
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:5080
                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,7666855044337270177,2660865203344038143,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5452 /prefetch:8
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:3516
                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                      PID:2588
                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa39544f50,0x7ffa39544f60,0x7ffa39544f70
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:3924
                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1584,13836367056779738415,9383613397410331532,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1596 /prefetch:2
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:1680
                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1584,13836367056779738415,9383613397410331532,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1988 /prefetch:8
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                            PID:4584
                                                                                                                                                                                                        • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                            PID:1716
                                                                                                                                                                                                          • C:\Windows\SysWOW64\DllHost.exe
                                                                                                                                                                                                            C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                              PID:2536
                                                                                                                                                                                                            • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                              C:\Windows\system32\rundll32.exe C:\Windows\system32\PcaSvc.dll,PcaPatchSdbTask
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                PID:1148
                                                                                                                                                                                                              • C:\Windows\system32\vssvc.exe
                                                                                                                                                                                                                C:\Windows\system32\vssvc.exe
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                • Checks SCSI registry key(s)
                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                PID:1984
                                                                                                                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s DsmSvc
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                • Checks SCSI registry key(s)
                                                                                                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                                                                                                PID:5048
                                                                                                                                                                                                              • C:\Windows\system32\srtasks.exe
                                                                                                                                                                                                                C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                PID:4772
                                                                                                                                                                                                              • C:\Windows\system32\msiexec.exe
                                                                                                                                                                                                                C:\Windows\system32\msiexec.exe /V
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                • Blocklisted process makes network request
                                                                                                                                                                                                                • Enumerates connected drives
                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                PID:4572
                                                                                                                                                                                                                • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                  C:\Windows\syswow64\MsiExec.exe -Embedding BA3D189CC71E7CB14AEE6776143767EA
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                                                  PID:1412
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe" -E -s -m ensurepip -U --default-pip
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                                                    PID:580
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe
                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe -W ignore::DeprecationWarning -c " import runpy import sys sys.path = ['C:\\Users\\Admin\\AppData\\Local\\Temp\\tmps34xqc6m\\setuptools-58.1.0-py3-none-any.whl', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmps34xqc6m\\pip-22.0.4-py3-none-any.whl'] + sys.path sys.argv[1:] = ['install', '--no-cache-dir', '--no-index', '--find-links', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmps34xqc6m', '--upgrade', 'setuptools', 'pip'] runpy.run_module(\"pip\", run_name=\"__main__\", alter_sys=True) "
                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                                                                      PID:2292
                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                          PID:4324
                                                                                                                                                                                                                • C:\Windows\system32\compattelrunner.exe
                                                                                                                                                                                                                  C:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                                                                                  PID:2432
                                                                                                                                                                                                                • C:\Windows\system32\werfault.exe
                                                                                                                                                                                                                  werfault.exe /hc /shared Global\48c6381d929b429998853e362bd8f31b /t 3580 /p 3540
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:3808
                                                                                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                    • Enumerates system info in registry
                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                    PID:5920
                                                                                                                                                                                                                    • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                      C:\Windows\system32\WerFault.exe -u -p 5920 -s 4048
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                      PID:3736
                                                                                                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                    C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                      PID:6068
                                                                                                                                                                                                                    • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                      C:\Windows\system32\WerFault.exe -pss -s 184 -p 5920 -ip 5920
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                        PID:5444
                                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                        • Enumerates system info in registry
                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                        PID:3152
                                                                                                                                                                                                                        • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                          C:\Windows\system32\WerFault.exe -u -p 3152 -s 3948
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                          PID:4064
                                                                                                                                                                                                                      • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                        C:\Windows\system32\WerFault.exe -pss -s 516 -p 3152 -ip 3152
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                          PID:3724
                                                                                                                                                                                                                        • C:\Windows\System32\rundll32.exe
                                                                                                                                                                                                                          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                            PID:4996
                                                                                                                                                                                                                          • C:\Windows\py.exe
                                                                                                                                                                                                                            "C:\Windows\py.exe" "C:\Users\Admin\Downloads\Test.py"
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            PID:5760
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe
                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe "C:\Users\Admin\Downloads\Test.py"
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                                                              PID:2260
                                                                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                            • Enumerates system info in registry
                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                            PID:5536
                                                                                                                                                                                                                            • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                              C:\Windows\system32\WerFault.exe -u -p 5536 -s 2632
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                              • Program crash
                                                                                                                                                                                                                              PID:4948
                                                                                                                                                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                            C:\Windows\system32\WerFault.exe -pss -s 444 -p 5536 -ip 5536
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                              PID:4012
                                                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                              • Enumerates system info in registry
                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                              PID:2856
                                                                                                                                                                                                                              • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                C:\Windows\system32\WerFault.exe -u -p 2856 -s 3924
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                PID:5372
                                                                                                                                                                                                                            • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                              C:\Windows\system32\WerFault.exe -pss -s 480 -p 2856 -ip 2856
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                PID:6112
                                                                                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                • Enumerates system info in registry
                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                PID:5380
                                                                                                                                                                                                                                • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                  C:\Windows\system32\WerFault.exe -u -p 5380 -s 4020
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                                  PID:60
                                                                                                                                                                                                                              • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                C:\Windows\system32\WerFault.exe -pss -s 456 -p 5380 -ip 5380
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                  PID:3724
                                                                                                                                                                                                                                • C:\Windows\py.exe
                                                                                                                                                                                                                                  "C:\Windows\py.exe" "C:\Users\Admin\Downloads\Test.py"
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  PID:5776
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe
                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe "C:\Users\Admin\Downloads\Test.py"
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                                                                    PID:5808
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Programs\Python\Python310\pythonw.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Programs\Python\Python310\pythonw.exe" -m idlelib "C:\Users\Admin\Downloads\Test.py"
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  PID:3860
                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:3944
                                                                                                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                    • Enumerates system info in registry
                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                    PID:3992
                                                                                                                                                                                                                                    • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                      C:\Windows\system32\WerFault.exe -u -p 3992 -s 4400
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                                      PID:60
                                                                                                                                                                                                                                  • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                    C:\Windows\system32\WerFault.exe -pss -s 524 -p 3992 -ip 3992
                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                      PID:6000
                                                                                                                                                                                                                                    • C:\Windows\ImmersiveControlPanel\SystemSettings.exe
                                                                                                                                                                                                                                      "C:\Windows\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanel
                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                      • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                                                                                                                                                                      • Checks SCSI registry key(s)
                                                                                                                                                                                                                                      • Checks processor information in registry
                                                                                                                                                                                                                                      • Enumerates system info in registry
                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                      PID:4480
                                                                                                                                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                      C:\Windows\system32\svchost.exe -k LocalService -p -s BthAvctpSvc
                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                        PID:5180
                                                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                        • Enumerates system info in registry
                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                        PID:3880
                                                                                                                                                                                                                                        • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                          C:\Windows\system32\WerFault.exe -u -p 3880 -s 4120
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                                          PID:4408
                                                                                                                                                                                                                                      • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                        C:\Windows\system32\WerFault.exe -pss -s 528 -p 3880 -ip 3880
                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                          PID:3700
                                                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                          • Enumerates system info in registry
                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                          PID:3508
                                                                                                                                                                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                            C:\Windows\system32\WerFault.exe -u -p 3508 -s 4128
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                                            PID:1344
                                                                                                                                                                                                                                        • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                          C:\Windows\system32\WerFault.exe -pss -s 580 -p 3508 -ip 3508
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                            PID:5372
                                                                                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                            • Enumerates system info in registry
                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                            PID:5352
                                                                                                                                                                                                                                            • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                              C:\Windows\system32\WerFault.exe -u -p 5352 -s 4176
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                              • Program crash
                                                                                                                                                                                                                                              PID:5208
                                                                                                                                                                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                            C:\Windows\system32\WerFault.exe -pss -s 452 -p 5352 -ip 5352
                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                              PID:4972
                                                                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                              • Enumerates system info in registry
                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                              PID:5692
                                                                                                                                                                                                                                              • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                C:\Windows\system32\WerFault.exe -u -p 5692 -s 3928
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                                PID:2468
                                                                                                                                                                                                                                            • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                              C:\Windows\system32\WerFault.exe -pss -s 464 -p 5692 -ip 5692
                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                PID:5820
                                                                                                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                • Enumerates system info in registry
                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                PID:6008
                                                                                                                                                                                                                                                • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\WerFault.exe -u -p 6008 -s 3992
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                                                  PID:3592
                                                                                                                                                                                                                                              • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                C:\Windows\system32\WerFault.exe -pss -s 472 -p 6008 -ip 6008
                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                  PID:5168
                                                                                                                                                                                                                                                • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                                                                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                    PID:4700
                                                                                                                                                                                                                                                  • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                                    C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                      PID:5416
                                                                                                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                      • Enumerates system info in registry
                                                                                                                                                                                                                                                      PID:2712
                                                                                                                                                                                                                                                    • C:\Windows\system32\werfault.exe
                                                                                                                                                                                                                                                      werfault.exe /h /shared Global\0dd2b27e120c4154a4fc43c624b6f5b8 /t 3760 /p 3860
                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                        PID:4740
                                                                                                                                                                                                                                                      • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                                        C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                          PID:2344
                                                                                                                                                                                                                                                        • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                                          C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                            PID:2652
                                                                                                                                                                                                                                                          • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                                            C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                              PID:1984
                                                                                                                                                                                                                                                            • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                                              C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                PID:3880
                                                                                                                                                                                                                                                              • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                                                C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                  PID:6096

                                                                                                                                                                                                                                                                Network

                                                                                                                                                                                                                                                                MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                                                                                                Downloads

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  40B

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  821c1122f0d1d5d9da13bb3a9b2bbe19

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  f571758a82487d499a3a594073d5d03860002a97

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  496c5a4bf9c2b9f82d5eed099129e60fd705da43a30511b7f7ac1c02513013d0

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  06b00209546e4f13b569191dfc36334c114e0a4b6bc4375e18b4927360e47582900694a10f8de7914ca20090ddc5a688d0907a054579ae961d572c3b5c2b2a38

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  40B

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  821c1122f0d1d5d9da13bb3a9b2bbe19

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  f571758a82487d499a3a594073d5d03860002a97

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  496c5a4bf9c2b9f82d5eed099129e60fd705da43a30511b7f7ac1c02513013d0

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  06b00209546e4f13b569191dfc36334c114e0a4b6bc4375e18b4927360e47582900694a10f8de7914ca20090ddc5a688d0907a054579ae961d572c3b5c2b2a38

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  40B

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  821c1122f0d1d5d9da13bb3a9b2bbe19

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  f571758a82487d499a3a594073d5d03860002a97

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  496c5a4bf9c2b9f82d5eed099129e60fd705da43a30511b7f7ac1c02513013d0

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  06b00209546e4f13b569191dfc36334c114e0a4b6bc4375e18b4927360e47582900694a10f8de7914ca20090ddc5a688d0907a054579ae961d572c3b5c2b2a38

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  69KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  92db333673e76da2820e3dce30b2b67e

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  ec2be0e499b5ae538d696abd0abc6a6a158d3e81

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  f0d1f8aa33f0ab94bb8ab3a5039a691935f72f507a91ca38d2eecf096b4c6376

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  edeee7f24cbaaae33f7965bfee4fb24f0bcb90f80770bd852540beb11b014736edd63ebfa2481f277e0542c2e4c76450b6103d7fb243e0e3bfd306231acf5efc

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\chrome_BITS_2704_1446996795\gcmjkmgdlgnkkcocmoeiminaijmmjnii_9.34.0_all_acb7qksdc2wjznjioir7p6lt3dwq.crx3

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  37KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  c919be360bcc277412b08aaf36831db4

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  7c33e8f1f9b245aec0e0e4168a54350615f52d9d

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  93823a4e71e764b932ee22dfcf84c24429867a440c5e480e55be527ac30de1ae

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  aa82748a902db51d80c6b4c0395d108e1067693d3ef031f599be6f7567bb80d2e76d66932c2e85a6708533e6d1fbbe45c514275be98069fbe887039037038a2c

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\chrome_BITS_2704_886969075\obedbbhbpmojnkanicioggnmelmoomoc_20220222.432047118_all_ENUS500000_hbwjwk7bommr565nn72etjdnwe.crx3

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  5.1MB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  a75cd4f42d1c9dbdaf22b31e06c0fe44

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  dfea9712224315d809cf432b1d84128dfa11ada5

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  191e8d0245ef4a9e9fac8966c175ae9b3943d70cfe949de9e33d3c6a19b7c840

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  d7b54e94a2a42697a7b25fb287fae12d7342acde89a482dd00c37edbe5234f2c8f899732dd519a0fdff15c1f04cb21bbd618e78df4102e61878aad22a8826449

                                                                                                                                                                                                                                                                • C:\Users\Admin\Downloads\python-3.10.3-amd64.exe

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  27.1MB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  9ea305690dbfd424a632b6a659347c1e

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  ebe0abda063d772ff812a2f07e7acccf52d7cd6b

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  48aea4b9f6315a6544f82480b2caf1e29fd6687abb5b756930ad98a1e9b9a847

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  7bbacee4fbe785597116edc93daf8ddbf52ccf6fb4806f90be8675149407b7853ca90315f79f8ef54aac7377666055611efb8a425f61ff2fce6af611d4a806b5

                                                                                                                                                                                                                                                                • C:\Users\Admin\Downloads\python-3.10.3-amd64.exe

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  27.1MB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  9ea305690dbfd424a632b6a659347c1e

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  ebe0abda063d772ff812a2f07e7acccf52d7cd6b

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  48aea4b9f6315a6544f82480b2caf1e29fd6687abb5b756930ad98a1e9b9a847

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  7bbacee4fbe785597116edc93daf8ddbf52ccf6fb4806f90be8675149407b7853ca90315f79f8ef54aac7377666055611efb8a425f61ff2fce6af611d4a806b5

                                                                                                                                                                                                                                                                • C:\Windows\Temp\{4039F549-C230-40C0-841C-DCD6EA8B918D}\.cr\python-3.10.3-amd64.exe

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  848KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  12975d7249f9c5df0820b0a9ef3a7ea7

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  1148bcf4bfe56455e275e044b815fd2d41955f9a

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  fd088482a4d7dcd1f3bea7a12e47d8474fc1699f164e538e5d2d5d56fe4fe38f

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  d5f7145ce1132b147319266806e6897fbaa18dad7140e4e453ddde89cf7610d529229d77fb55491e82fce375b077cde21a1636d9c1942baa12b65e27a681cf8e

                                                                                                                                                                                                                                                                • C:\Windows\Temp\{4039F549-C230-40C0-841C-DCD6EA8B918D}\.cr\python-3.10.3-amd64.exe

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  848KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  12975d7249f9c5df0820b0a9ef3a7ea7

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  1148bcf4bfe56455e275e044b815fd2d41955f9a

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  fd088482a4d7dcd1f3bea7a12e47d8474fc1699f164e538e5d2d5d56fe4fe38f

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  d5f7145ce1132b147319266806e6897fbaa18dad7140e4e453ddde89cf7610d529229d77fb55491e82fce375b077cde21a1636d9c1942baa12b65e27a681cf8e

                                                                                                                                                                                                                                                                • C:\Windows\Temp\{F97E91C2-DC29-4BA4-8F9A-F3AC593DA41A}\.ba\PythonBA.dll

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  663KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  f0de7f1a8fcc825d5d32cf804e44a0dc

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  35bdc53a3782e3f820c2ebd715009fb6a328cc3b

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  e9f560f381826f2ada40d1e9d422601b4e35fe293940be29e631be11e1c34c7a

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  dcb83fa0734614232ca0ff8c1cefadaf4902a0c945f793675afb7b08d0e594f71dfc643bbbd0c37c569be1cee7437b5b6aabe8859190654b2d99d61a2d446c7b

                                                                                                                                                                                                                                                                • C:\Windows\Temp\{F97E91C2-DC29-4BA4-8F9A-F3AC593DA41A}\.be\python-3.10.3-amd64.exe

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  848KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  12975d7249f9c5df0820b0a9ef3a7ea7

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  1148bcf4bfe56455e275e044b815fd2d41955f9a

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  fd088482a4d7dcd1f3bea7a12e47d8474fc1699f164e538e5d2d5d56fe4fe38f

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  d5f7145ce1132b147319266806e6897fbaa18dad7140e4e453ddde89cf7610d529229d77fb55491e82fce375b077cde21a1636d9c1942baa12b65e27a681cf8e

                                                                                                                                                                                                                                                                • C:\Windows\Temp\{F97E91C2-DC29-4BA4-8F9A-F3AC593DA41A}\.be\python-3.10.3-amd64.exe

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  848KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  12975d7249f9c5df0820b0a9ef3a7ea7

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  1148bcf4bfe56455e275e044b815fd2d41955f9a

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  fd088482a4d7dcd1f3bea7a12e47d8474fc1699f164e538e5d2d5d56fe4fe38f

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  d5f7145ce1132b147319266806e6897fbaa18dad7140e4e453ddde89cf7610d529229d77fb55491e82fce375b077cde21a1636d9c1942baa12b65e27a681cf8e

                                                                                                                                                                                                                                                                • memory/1984-249-0x000001B70B1F0000-0x000001B70B1F4000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  16KB

                                                                                                                                                                                                                                                                • memory/1984-253-0x000001B70AF10000-0x000001B70AF14000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  16KB

                                                                                                                                                                                                                                                                • memory/1984-248-0x000001B70AEF0000-0x000001B70AEF4000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  16KB

                                                                                                                                                                                                                                                                • memory/1984-254-0x000001B70AE10000-0x000001B70AE11000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                • memory/1984-250-0x000001B70B1E0000-0x000001B70B1E1000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                • memory/1984-251-0x000001B70AF20000-0x000001B70AF24000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  16KB

                                                                                                                                                                                                                                                                • memory/1984-252-0x000001B70AF10000-0x000001B70AF11000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                • memory/2304-206-0x000001B57E7F0000-0x000001B57E7F4000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  16KB

                                                                                                                                                                                                                                                                • memory/2304-136-0x000001B57E7C0000-0x000001B57E7C4000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  16KB

                                                                                                                                                                                                                                                                • memory/2304-209-0x000001B57E6E0000-0x000001B57E6E1000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                • memory/2304-207-0x000001B57E7E0000-0x000001B57E7E1000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                • memory/2304-208-0x000001B57E7E0000-0x000001B57E7E4000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  16KB

                                                                                                                                                                                                                                                                • memory/2304-205-0x000001B57ED00000-0x000001B57ED01000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                • memory/2304-204-0x000001B57ED10000-0x000001B57ED14000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  16KB

                                                                                                                                                                                                                                                                • memory/2304-134-0x000001B57DB60000-0x000001B57DB70000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  64KB

                                                                                                                                                                                                                                                                • memory/2304-135-0x000001B57E460000-0x000001B57E470000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  64KB

                                                                                                                                                                                                                                                                • memory/2344-235-0x0000017EB2620000-0x0000017EB2624000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  16KB

                                                                                                                                                                                                                                                                • memory/2344-236-0x0000017EB0320000-0x0000017EB0321000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                • memory/2344-230-0x0000017EB2600000-0x0000017EB2604000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  16KB

                                                                                                                                                                                                                                                                • memory/2344-231-0x0000017EB2900000-0x0000017EB2904000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  16KB

                                                                                                                                                                                                                                                                • memory/2344-232-0x0000017EB28F0000-0x0000017EB28F1000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                • memory/2344-233-0x0000017EB2630000-0x0000017EB2634000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  16KB

                                                                                                                                                                                                                                                                • memory/2344-234-0x0000017EB2620000-0x0000017EB2621000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                • memory/2652-239-0x000001D9547E0000-0x000001D9547E4000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  16KB

                                                                                                                                                                                                                                                                • memory/2652-245-0x000001D954760000-0x000001D954761000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                • memory/2652-240-0x000001D956D40000-0x000001D956D44000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  16KB

                                                                                                                                                                                                                                                                • memory/2652-241-0x000001D956D30000-0x000001D956D31000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                • memory/2652-242-0x000001D956A70000-0x000001D956A74000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  16KB

                                                                                                                                                                                                                                                                • memory/2652-243-0x000001D956A60000-0x000001D956A61000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                • memory/2652-244-0x000001D956A60000-0x000001D956A64000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  16KB

                                                                                                                                                                                                                                                                • memory/3152-163-0x0000028A77768000-0x0000028A77770000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                • memory/3880-260-0x000001C461890000-0x000001C461894000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  16KB

                                                                                                                                                                                                                                                                • memory/3880-262-0x000001C461880000-0x000001C461884000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  16KB

                                                                                                                                                                                                                                                                • memory/3880-263-0x000001C45F580000-0x000001C45F581000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                • memory/3880-261-0x000001C461880000-0x000001C461881000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                • memory/3880-259-0x000001C461B50000-0x000001C461B51000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                • memory/3880-258-0x000001C461B60000-0x000001C461B64000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  16KB

                                                                                                                                                                                                                                                                • memory/3880-257-0x000001C461860000-0x000001C461864000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  16KB

                                                                                                                                                                                                                                                                • memory/4604-216-0x00007FFA564B0000-0x00007FFA564B1000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                • memory/5416-225-0x0000026357F70000-0x0000026357F71000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                • memory/5416-221-0x0000026357F50000-0x0000026357F54000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  16KB

                                                                                                                                                                                                                                                                • memory/5416-222-0x0000026358240000-0x0000026358244000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  16KB

                                                                                                                                                                                                                                                                • memory/5416-227-0x0000026357E70000-0x0000026357E71000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                • memory/5416-223-0x0000026358230000-0x0000026358231000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                • memory/5416-226-0x0000026357F70000-0x0000026357F74000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  16KB

                                                                                                                                                                                                                                                                • memory/5416-224-0x0000026357F80000-0x0000026357F84000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  16KB

                                                                                                                                                                                                                                                                • memory/6096-266-0x0000021231F10000-0x0000021231F14000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  16KB

                                                                                                                                                                                                                                                                • memory/6096-267-0x0000021232200000-0x0000021232204000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  16KB

                                                                                                                                                                                                                                                                • memory/6096-268-0x00000212321F0000-0x00000212321F1000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                • memory/6096-269-0x0000021231F40000-0x0000021231F44000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  16KB

                                                                                                                                                                                                                                                                • memory/6096-270-0x0000021231F30000-0x0000021231F31000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  4KB