Resubmissions
15-07-2022 23:01
220715-2zsxgafhgk 1015-07-2022 22:50
220715-2splgafhdm 1015-07-2022 22:20
220715-188hvafgcj 10Analysis
-
max time kernel
865s -
max time network
1056s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
resource tags
arch:x64arch:x86image:win10v2004-20220414-enlocale:en-usos:windows10-2004-x64system -
submitted
15-07-2022 23:01
Static task
static1
General
-
Target
e01031275ef9cee42de309d2e23b5d8bb5831aaf8adfad8289472a27192331f2.exe
-
Size
4.7MB
-
MD5
b81617f91ae5dfc6ba926f807f908ec2
-
SHA1
569b4c96d628ac2fe57ba7851a28ff48eee19270
-
SHA256
e01031275ef9cee42de309d2e23b5d8bb5831aaf8adfad8289472a27192331f2
-
SHA512
440220ad23d8313e8d59799bdc04c72b69e34831e9022f4897a4510556115912a295784baeeef82a17ab7ddedc5db41948e0722043eadff43a813d95fcd02545
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
Processes:
wscript.exewscript.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, wscript.exe \"C:\\Program Files\\mrsmajor\\Launcher.vbs\"" wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, wscript.exe \"C:\\Program Files\\MicrosoftWindowsServicesEtc\\xRunReg.vbs\"" wscript.exe -
Modifies system executable filetype association 2 TTPs 4 IoCs
Processes:
wscript.exewscript.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon\ = "C:\\Program Files\\mrsmajor\\Icon_resource\\SkullIco.ico" wscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon\ = "C:\\Program Files\\MicrosoftWindowsServicesEtc\\data\\fileico.ico" wscript.exe -
Processes:
wscript.exewscript.exewscript.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" wscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" wscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" wscript.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
Setups.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Setups.exe -
XMRig Miner payload 7 IoCs
Processes:
resource yara_rule behavioral1/memory/3736-154-0x0000000140000000-0x0000000140809000-memory.dmp xmrig behavioral1/memory/3736-155-0x000000014036EAC4-mapping.dmp xmrig behavioral1/memory/3736-157-0x0000000140000000-0x0000000140809000-memory.dmp xmrig behavioral1/memory/3736-156-0x0000000140000000-0x0000000140809000-memory.dmp xmrig behavioral1/memory/3736-160-0x0000000140000000-0x0000000140809000-memory.dmp xmrig behavioral1/memory/3736-161-0x0000000140000000-0x0000000140809000-memory.dmp xmrig behavioral1/memory/3736-266-0x0000000140000000-0x0000000140809000-memory.dmp xmrig -
Disables RegEdit via registry modification 2 IoCs
Processes:
wscript.exewscript.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\disableregistrytools = "1" wscript.exe Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\disableregistrytools = "1" wscript.exe -
Disables Task Manager via registry modification
-
Executes dropped EXE 12 IoCs
Processes:
mmgaserver.exemmgaserver.exeChromeRecovery.exeSetups.exeMrsMajor3.0.exeeulascr.exeMrsMajor2.0.exeBossDaMajor.exeBossDaMajor.exeeula32.exeGetReady.exenotmuch.exepid process 5088 mmgaserver.exe 3960 mmgaserver.exe 4064 ChromeRecovery.exe 2660 Setups.exe 1576 MrsMajor3.0.exe 4720 eulascr.exe 1072 MrsMajor2.0.exe 1468 BossDaMajor.exe 4012 BossDaMajor.exe 4140 eula32.exe 4316 GetReady.exe 3640 notmuch.exe -
Possible privilege escalation attempt 4 IoCs
Processes:
takeown.exeicacls.exetakeown.exeicacls.exepid process 4284 takeown.exe 2864 icacls.exe 4708 takeown.exe 4908 icacls.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Setups.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Setups.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Setups.exe -
Checks computer location settings 2 TTPs 12 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
BossDaMajor.exewscript.exee01031275ef9cee42de309d2e23b5d8bb5831aaf8adfad8289472a27192331f2.exemmgaserver.exemmgaserver.exeMrsMajor3.0.exewscript.exeBossDaMajor.exeGetReady.exeMrsMajor2.0.exewscript.exewscript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation BossDaMajor.exe Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation wscript.exe Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation e01031275ef9cee42de309d2e23b5d8bb5831aaf8adfad8289472a27192331f2.exe Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation mmgaserver.exe Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation mmgaserver.exe Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation MrsMajor3.0.exe Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation wscript.exe Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation BossDaMajor.exe Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation GetReady.exe Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation MrsMajor2.0.exe Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation wscript.exe Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation wscript.exe -
Loads dropped DLL 1 IoCs
Processes:
eulascr.exepid process 4720 eulascr.exe -
Modifies file permissions 1 TTPs 4 IoCs
Processes:
takeown.exeicacls.exetakeown.exeicacls.exepid process 4284 takeown.exe 2864 icacls.exe 4708 takeown.exe 4908 icacls.exe -
Obfuscated with Agile.Net obfuscator 3 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\B50.tmp\eulascr.exe agile_net C:\Users\Admin\AppData\Local\Temp\B50.tmp\eulascr.exe agile_net behavioral1/memory/4720-190-0x0000000000DA0000-0x0000000000DCA000-memory.dmp agile_net -
Processes:
resource yara_rule C:\Users\Admin\Desktop\Setups.exe themida C:\Users\Admin\Desktop\Setups.exe themida behavioral1/memory/2660-170-0x0000000000DE0000-0x000000000159F000-memory.dmp themida behavioral1/memory/2660-171-0x0000000000DE0000-0x000000000159F000-memory.dmp themida behavioral1/memory/2660-172-0x0000000000DE0000-0x000000000159F000-memory.dmp themida behavioral1/memory/2660-173-0x0000000000DE0000-0x000000000159F000-memory.dmp themida behavioral1/memory/2660-175-0x0000000000DE0000-0x000000000159F000-memory.dmp themida behavioral1/memory/2660-177-0x0000000000DE0000-0x000000000159F000-memory.dmp themida -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
wscript.exemmgaserver.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MajorX = "wscript.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\xRun.vbs\"" wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NetVPUpdater = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\NetVPUpdater.exe\"" mmgaserver.exe -
Processes:
Setups.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Setups.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
unregmp2.exedescription ioc process File opened (read-only) \??\G: unregmp2.exe File opened (read-only) \??\I: unregmp2.exe File opened (read-only) \??\M: unregmp2.exe File opened (read-only) \??\R: unregmp2.exe File opened (read-only) \??\V: unregmp2.exe File opened (read-only) \??\W: unregmp2.exe File opened (read-only) \??\F: unregmp2.exe File opened (read-only) \??\N: unregmp2.exe File opened (read-only) \??\Z: unregmp2.exe File opened (read-only) \??\J: unregmp2.exe File opened (read-only) \??\B: unregmp2.exe File opened (read-only) \??\E: unregmp2.exe File opened (read-only) \??\K: unregmp2.exe File opened (read-only) \??\L: unregmp2.exe File opened (read-only) \??\O: unregmp2.exe File opened (read-only) \??\Q: unregmp2.exe File opened (read-only) \??\T: unregmp2.exe File opened (read-only) \??\A: unregmp2.exe File opened (read-only) \??\U: unregmp2.exe File opened (read-only) \??\P: unregmp2.exe File opened (read-only) \??\S: unregmp2.exe File opened (read-only) \??\X: unregmp2.exe File opened (read-only) \??\Y: unregmp2.exe File opened (read-only) \??\H: unregmp2.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Drops file in System32 directory 2 IoCs
Processes:
cmd.exedescription ioc process File opened for modification C:\Windows\System32\taskmgr.exe cmd.exe File opened for modification C:\Windows\System32\sethc.exe cmd.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
Setups.exepid process 2660 Setups.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
mmgaserver.exemmgaserver.exedescription pid process target process PID 5088 set thread context of 3960 5088 mmgaserver.exe mmgaserver.exe PID 3960 set thread context of 3736 3960 mmgaserver.exe notepad.exe -
Drops file in Program Files directory 60 IoCs
Processes:
wscript.exewscript.exeelevation_service.exewscript.exedescription ioc process File created C:\program files\MicrosoftWindowsServicesEtc\WinScrew.exe wscript.exe File opened for modification C:\Program Files\mrsmajor\CPUUsage.vbs wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\CallFunc.vbs wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\Major.exe wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\data\eula32.exe wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\weird\WinScrew.bat wscript.exe File created C:\Program Files\mrsmajor\default.txt wscript.exe File created C:\Program Files\mrsmajor\def_resource\creepysound.mp3 wscript.exe File opened for modification C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir3504_975096860\manifest.json elevation_service.exe File created C:\program files\MicrosoftWindowsServicesEtc\example.txt wscript.exe File created C:\Program Files\mrsmajor\WinLogon.bat wscript.exe File created C:\Program Files\mrsmajor\def_resource\Skullcur.cur wscript.exe File created C:\Program Files\mrsmajor\Launcher.vbs wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\healgen.vbs wscript.exe File created C:\Program Files\mrsmajor\reStart.vbs wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\weird\majorsod.vbs wscript.exe File opened for modification C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir3504_975096860\ChromeRecovery.exe elevation_service.exe File created C:\program files\MicrosoftWindowsServicesEtc\majorlist.exe wscript.exe File created C:\Program Files\mrsmajor\Icon_resource\SkullIco.ico wscript.exe File created C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir3504_975096860\manifest.json elevation_service.exe File created C:\program files\MicrosoftWindowsServicesEtc\fexec.vbs wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\xRunReg.vbs wscript.exe File created C:\Program Files\mrsmajor\def_resource\@Tile@@.jpg wscript.exe File created C:\Program Files\mrsmajor\MrsMjrGuiLauncher.bat wscript.exe File created C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir3504_975096860\ChromeRecovery.exe elevation_service.exe File created C:\program files\MicrosoftWindowsServicesEtc\weird\GetReady.bat wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\breakrule.exe wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\bsod.exe wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\GetReady.exe wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\xRun.vbs wscript.exe File created C:\Program Files\mrsmajor\def_resource\f11.mp4 wscript.exe File created C:\Program Files\mrsmajor\MrsMjrGui.exe wscript.exe File opened for modification C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir3504_975096860\_metadata\verified_contents.json elevation_service.exe File created C:\program files\MicrosoftWindowsServicesEtc\data\fileico.ico wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\majordared.exe wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\majorsod.exe wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\weird\cmd.vbs wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\weird\Major.vbs wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\weird\runner32s.vbs wscript.exe File created C:\Program Files\mrsmajor\DreS_X.bat wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\data\thetruth.jpg wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\DgzRun.vbs wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\weird\breakrule.vbs wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\AppKill.bat wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\data\runner32s.exe wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\RuntimeChecker.exe wscript.exe File created C:\Program Files\mrsmajor\CPUUsage.vbs wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\weird\bsod.bat wscript.exe File created C:\Program Files\mrsmajor\mrsmajorlauncher.vbs wscript.exe File created C:\Program Files\mrsmajor\Doll_patch.xml wscript.exe File created C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir3504_975096860\_metadata\verified_contents.json elevation_service.exe File created C:\program files\MicrosoftWindowsServicesEtc\checker.bat wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\clingclang.wav wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\NotMuch.exe wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\weird\majorlist.bat wscript.exe File created C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir3504_975096860\ChromeRecoveryCRX.crx elevation_service.exe File opened for modification C:\program files\MicrosoftWindowsServicesEtc\AppKill.bat wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\weird\RuntimeChecker.vbs wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\data\excursor.ani wscript.exe File created C:\program files\MicrosoftWindowsServicesEtc\rsod.exe wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies Control Panel 8 IoCs
Processes:
wscript.exewscript.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\Cursors\AppStarting = "C:\\Program Files\\mrsmajor\\def_resource\\skullcur.cur" wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\Cursors\Hand = "C:\\Program Files\\mrsmajor\\def_resource\\skullcur.cur" wscript.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\Cursors wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\Cursors\Arrow = "C:\\Program Files\\MicrosoftWindowsServicesEtc\\data\\excursor.ani" wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\Cursors\AppStarting = "C:\\Program Files\\MicrosoftWindowsServicesEtc\\data\\excursor.ani" wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\Cursors\Hand = "C:\\Program Files\\MicrosoftWindowsServicesEtc\\data\\excursor.ani" wscript.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\Cursors wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\Cursors\Arrow = "C:\\Program Files\\mrsmajor\\def_resource\\skullcur.cur" wscript.exe -
Modifies data under HKEY_USERS 15 IoCs
Processes:
LogonUI.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "33" LogonUI.exe -
Modifies registry class 23 IoCs
Processes:
wscript.exewscript.exechrome.exeOpenWith.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inifile\DefaultIcon\ = "C:\\Program Files\\mrsmajor\\Icon_resource\\SkullIco.ico" wscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon wscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mp4file\DefaultIcon\ = "C:\\Program Files\\MicrosoftWindowsServicesEtc\\data\\fileico.ico" wscript.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon wscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mp4file\DefaultIcon wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon\ = "C:\\Program Files\\mrsmajor\\Icon_resource\\SkullIco.ico" wscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inifile\DefaultIcon wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Program Files\\MicrosoftWindowsServicesEtc\\data\\fileico.ico" wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mp3file\DefaultIcon\ = "C:\\Program Files\\mrsmajor\\Icon_resource\\SkullIco.ico" wscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mp4file wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mp4file\DefaultIcon\ = "C:\\Program Files\\mrsmajor\\Icon_resource\\SkullIco.ico" wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon\ = "C:\\Program Files\\MicrosoftWindowsServicesEtc\\data\\fileico.ico" wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inifile\DefaultIcon\ = "C:\\Program Files\\MicrosoftWindowsServicesEtc\\data\\fileico.ico" wscript.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon wscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mp3file\DefaultIcon wscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mp4file\DefaultIcon wscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inifile\DefaultIcon wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Program Files\\mrsmajor\\Icon_resource\\SkullIco.ico" wscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mp3file\DefaultIcon wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mp3file\DefaultIcon\ = "C:\\Program Files\\MicrosoftWindowsServicesEtc\\data\\fileico.ico" wscript.exe -
Opens file in notepad (likely ransom note) 2 IoCs
Processes:
NOTEPAD.EXENOTEPAD.EXEpid process 3980 NOTEPAD.EXE 2160 NOTEPAD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exemmgaserver.exenotepad.exepid process 4664 powershell.exe 4664 powershell.exe 5088 mmgaserver.exe 5088 mmgaserver.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
taskmgr.exepid process 1684 taskmgr.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 42 IoCs
Processes:
chrome.exepid process 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe -
Suspicious use of AdjustPrivilegeToken 34 IoCs
Processes:
powershell.exemmgaserver.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exenotepad.exetaskmgr.exe7zG.exe7zG.exeeulascr.exeunregmp2.exetakeown.exetakeown.exeshutdown.exeshutdown.exedescription pid process Token: SeDebugPrivilege 4664 powershell.exe Token: SeDebugPrivilege 5088 mmgaserver.exe Token: SeShutdownPrivilege 4432 powercfg.exe Token: SeCreatePagefilePrivilege 4432 powercfg.exe Token: SeShutdownPrivilege 856 powercfg.exe Token: SeCreatePagefilePrivilege 856 powercfg.exe Token: SeShutdownPrivilege 1640 powercfg.exe Token: SeCreatePagefilePrivilege 1640 powercfg.exe Token: SeShutdownPrivilege 3308 powercfg.exe Token: SeCreatePagefilePrivilege 3308 powercfg.exe Token: SeLockMemoryPrivilege 3736 notepad.exe Token: SeLockMemoryPrivilege 3736 notepad.exe Token: SeDebugPrivilege 1684 taskmgr.exe Token: SeSystemProfilePrivilege 1684 taskmgr.exe Token: SeCreateGlobalPrivilege 1684 taskmgr.exe Token: 33 1684 taskmgr.exe Token: SeIncBasePriorityPrivilege 1684 taskmgr.exe Token: SeRestorePrivilege 1420 7zG.exe Token: 35 1420 7zG.exe Token: SeSecurityPrivilege 1420 7zG.exe Token: SeSecurityPrivilege 1420 7zG.exe Token: SeRestorePrivilege 4016 7zG.exe Token: 35 4016 7zG.exe Token: SeSecurityPrivilege 4016 7zG.exe Token: SeSecurityPrivilege 4016 7zG.exe Token: SeDebugPrivilege 4720 eulascr.exe Token: SeShutdownPrivilege 4152 unregmp2.exe Token: SeCreatePagefilePrivilege 4152 unregmp2.exe Token: SeTakeOwnershipPrivilege 4284 takeown.exe Token: SeTakeOwnershipPrivilege 4708 takeown.exe Token: SeShutdownPrivilege 4760 shutdown.exe Token: SeRemoteShutdownPrivilege 4760 shutdown.exe Token: SeShutdownPrivilege 4072 shutdown.exe Token: SeRemoteShutdownPrivilege 4072 shutdown.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
notepad.exetaskmgr.exepid process 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 3736 notepad.exe 1684 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
notepad.exetaskmgr.exepid process 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 3736 notepad.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 3736 notepad.exe 1684 taskmgr.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
OpenWith.exeMrsMajor3.0.exeLogonUI.exepid process 2404 OpenWith.exe 1576 MrsMajor3.0.exe 1576 LogonUI.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
e01031275ef9cee42de309d2e23b5d8bb5831aaf8adfad8289472a27192331f2.exemmgaserver.exemmgaserver.execmd.exechrome.exedescription pid process target process PID 1580 wrote to memory of 5088 1580 e01031275ef9cee42de309d2e23b5d8bb5831aaf8adfad8289472a27192331f2.exe mmgaserver.exe PID 1580 wrote to memory of 5088 1580 e01031275ef9cee42de309d2e23b5d8bb5831aaf8adfad8289472a27192331f2.exe mmgaserver.exe PID 5088 wrote to memory of 4664 5088 mmgaserver.exe powershell.exe PID 5088 wrote to memory of 4664 5088 mmgaserver.exe powershell.exe PID 5088 wrote to memory of 3960 5088 mmgaserver.exe mmgaserver.exe PID 5088 wrote to memory of 3960 5088 mmgaserver.exe mmgaserver.exe PID 5088 wrote to memory of 3960 5088 mmgaserver.exe mmgaserver.exe PID 5088 wrote to memory of 3960 5088 mmgaserver.exe mmgaserver.exe PID 5088 wrote to memory of 3960 5088 mmgaserver.exe mmgaserver.exe PID 5088 wrote to memory of 3960 5088 mmgaserver.exe mmgaserver.exe PID 3960 wrote to memory of 3824 3960 mmgaserver.exe cmd.exe PID 3960 wrote to memory of 3824 3960 mmgaserver.exe cmd.exe PID 3824 wrote to memory of 4432 3824 cmd.exe powercfg.exe PID 3824 wrote to memory of 4432 3824 cmd.exe powercfg.exe PID 3824 wrote to memory of 856 3824 cmd.exe powercfg.exe PID 3824 wrote to memory of 856 3824 cmd.exe powercfg.exe PID 3824 wrote to memory of 1640 3824 cmd.exe powercfg.exe PID 3824 wrote to memory of 1640 3824 cmd.exe powercfg.exe PID 3824 wrote to memory of 3308 3824 cmd.exe powercfg.exe PID 3824 wrote to memory of 3308 3824 cmd.exe powercfg.exe PID 3960 wrote to memory of 3736 3960 mmgaserver.exe notepad.exe PID 3960 wrote to memory of 3736 3960 mmgaserver.exe notepad.exe PID 3960 wrote to memory of 3736 3960 mmgaserver.exe notepad.exe PID 3960 wrote to memory of 3736 3960 mmgaserver.exe notepad.exe PID 3960 wrote to memory of 3736 3960 mmgaserver.exe notepad.exe PID 3960 wrote to memory of 3736 3960 mmgaserver.exe notepad.exe PID 3960 wrote to memory of 3736 3960 mmgaserver.exe notepad.exe PID 3960 wrote to memory of 3736 3960 mmgaserver.exe notepad.exe PID 3960 wrote to memory of 3736 3960 mmgaserver.exe notepad.exe PID 3960 wrote to memory of 3736 3960 mmgaserver.exe notepad.exe PID 3960 wrote to memory of 3736 3960 mmgaserver.exe notepad.exe PID 3960 wrote to memory of 3736 3960 mmgaserver.exe notepad.exe PID 3960 wrote to memory of 3736 3960 mmgaserver.exe notepad.exe PID 3960 wrote to memory of 3736 3960 mmgaserver.exe notepad.exe PID 3960 wrote to memory of 3736 3960 mmgaserver.exe notepad.exe PID 2616 wrote to memory of 1664 2616 chrome.exe chrome.exe PID 2616 wrote to memory of 1664 2616 chrome.exe chrome.exe PID 2616 wrote to memory of 2728 2616 chrome.exe chrome.exe PID 2616 wrote to memory of 2728 2616 chrome.exe chrome.exe PID 2616 wrote to memory of 2728 2616 chrome.exe chrome.exe PID 2616 wrote to memory of 2728 2616 chrome.exe chrome.exe PID 2616 wrote to memory of 2728 2616 chrome.exe chrome.exe PID 2616 wrote to memory of 2728 2616 chrome.exe chrome.exe PID 2616 wrote to memory of 2728 2616 chrome.exe chrome.exe PID 2616 wrote to memory of 2728 2616 chrome.exe chrome.exe PID 2616 wrote to memory of 2728 2616 chrome.exe chrome.exe PID 2616 wrote to memory of 2728 2616 chrome.exe chrome.exe PID 2616 wrote to memory of 2728 2616 chrome.exe chrome.exe PID 2616 wrote to memory of 2728 2616 chrome.exe chrome.exe PID 2616 wrote to memory of 2728 2616 chrome.exe chrome.exe PID 2616 wrote to memory of 2728 2616 chrome.exe chrome.exe PID 2616 wrote to memory of 2728 2616 chrome.exe chrome.exe PID 2616 wrote to memory of 2728 2616 chrome.exe chrome.exe PID 2616 wrote to memory of 2728 2616 chrome.exe chrome.exe PID 2616 wrote to memory of 2728 2616 chrome.exe chrome.exe PID 2616 wrote to memory of 2728 2616 chrome.exe chrome.exe PID 2616 wrote to memory of 2728 2616 chrome.exe chrome.exe PID 2616 wrote to memory of 2728 2616 chrome.exe chrome.exe PID 2616 wrote to memory of 2728 2616 chrome.exe chrome.exe PID 2616 wrote to memory of 2728 2616 chrome.exe chrome.exe PID 2616 wrote to memory of 2728 2616 chrome.exe chrome.exe PID 2616 wrote to memory of 2728 2616 chrome.exe chrome.exe PID 2616 wrote to memory of 2728 2616 chrome.exe chrome.exe PID 2616 wrote to memory of 2728 2616 chrome.exe chrome.exe -
System policy modification 1 TTPs 6 IoCs
Processes:
wscript.exewscript.exewscript.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" wscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system wscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" wscript.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System wscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" wscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system wscript.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e01031275ef9cee42de309d2e23b5d8bb5831aaf8adfad8289472a27192331f2.exe"C:\Users\Admin\AppData\Local\Temp\e01031275ef9cee42de309d2e23b5d8bb5831aaf8adfad8289472a27192331f2.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\mmgaserver.exe"C:\Users\Admin\AppData\Local\Temp\mmgaserver.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANAA1AA==3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\mmgaserver.exeC:\Users\Admin\AppData\Local\Temp\mmgaserver.exe3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 04⤵
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-ac 05⤵
- Suspicious use of AdjustPrivilegeToken
PID:4432 -
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-dc 05⤵
- Suspicious use of AdjustPrivilegeToken
PID:856 -
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-ac 05⤵
- Suspicious use of AdjustPrivilegeToken
PID:1640 -
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-dc 05⤵
- Suspicious use of AdjustPrivilegeToken
PID:3308 -
C:\Windows\System32\notepad.exeC:\Windows\System32\notepad.exe eibjreadarlwhqjb0 6E3sjfZq2rJQaxvLPmXgsBL6xjjYguHWtOpZ+stIdvsjpN5Mqdy4DBfa6KATFfaKtAojfzUwjTQS8LU11cio3B91Dnx64uJpd+yv3ODgmKtlyHUG4wlRe6qD3C4hnccuCyfObt0sQRm3xP0XSv1OFHH30qIKppKf2w90wbt8GGZsj8u4ML7JuplmjYMl/cqWtRx56XoRsGk8kfCYoJkSJSqQfbO2wc/udqfRyVtvxkb+gHe+1PC0E+8tAVIzQyBaeqj88aWSku1DfJkpu4sDiwLbpA9r9ONPzc75XW+jSgPQvswv8ksqs4Tu0ZWY7rAandbpqmu8t2ISmE+8o+Em9NMn4LWpG81LxGs0LtD5F+1s9fVJt0ChwNtb835D5RStVJiYB7eHxgMpNT8bHWu2Btvm29pw6corXv39uviLDGenOCPpHFK71tjvtw7nmFTnW5T2+yRMlYWgiyOwVY1Z5EkDxgEO5RvIgS8rfPl7WH5TRXdeABsT239oc/4DLkhkUssmapzpnW9lrnvvgGXOEKiqHIdAssGmDJ00Yg5UFFA=4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3736
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1684
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffddb134f50,0x7ffddb134f60,0x7ffddb134f702⤵PID:1664
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1668 /prefetch:22⤵PID:2728
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1944 /prefetch:82⤵PID:4056
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2324 /prefetch:82⤵PID:2284
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3008 /prefetch:12⤵PID:4116
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3100 /prefetch:12⤵PID:4756
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3564 /prefetch:12⤵PID:4028
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3860 /prefetch:12⤵PID:3428
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4024 /prefetch:82⤵PID:2816
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4724 /prefetch:82⤵PID:5072
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4896 /prefetch:82⤵PID:4456
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5032 /prefetch:82⤵PID:4844
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5160 /prefetch:82⤵PID:4636
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5196 /prefetch:82⤵PID:2260
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5208 /prefetch:82⤵PID:1936
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4780 /prefetch:82⤵PID:2212
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5140 /prefetch:82⤵PID:4396
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4760 /prefetch:82⤵PID:2648
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5512 /prefetch:82⤵PID:1128
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 /prefetch:82⤵PID:4404
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5456 /prefetch:82⤵PID:4036
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4800 /prefetch:82⤵PID:728
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5540 /prefetch:82⤵PID:1868
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:12⤵PID:1160
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:12⤵PID:2828
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:3208
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3528 /prefetch:82⤵PID:1644
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4148 /prefetch:82⤵PID:3588
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:82⤵PID:2216
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1040 /prefetch:82⤵PID:2816
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2460 /prefetch:12⤵PID:4132
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=244 /prefetch:12⤵PID:1936
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3084 /prefetch:12⤵PID:1756
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3564 /prefetch:82⤵PID:4524
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:4552
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:12⤵PID:1868
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:12⤵PID:4744
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:12⤵PID:3856
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:12⤵PID:2160
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:12⤵PID:760
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:12⤵PID:4912
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5056 /prefetch:82⤵PID:2360
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2524 /prefetch:82⤵PID:1680
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:12⤵PID:4252
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4952 /prefetch:82⤵PID:2240
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5532 /prefetch:82⤵PID:704
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3732 /prefetch:82⤵PID:4452
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5484 /prefetch:82⤵PID:1484
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5040 /prefetch:82⤵PID:4108
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5868 /prefetch:82⤵PID:4972
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5240 /prefetch:22⤵PID:860
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6124 /prefetch:82⤵PID:540
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5388 /prefetch:82⤵PID:3680
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:12⤵PID:668
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=936 /prefetch:12⤵PID:884
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3400 /prefetch:82⤵PID:4028
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5776 /prefetch:82⤵PID:4900
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6348 /prefetch:82⤵PID:3948
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6448 /prefetch:82⤵PID:2708
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6336 /prefetch:82⤵PID:1940
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6304 /prefetch:82⤵PID:4432
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6604 /prefetch:12⤵PID:2360
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3332 /prefetch:82⤵PID:4136
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2524 /prefetch:12⤵PID:448
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1040 /prefetch:82⤵PID:2948
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6260 /prefetch:82⤵PID:1772
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6216 /prefetch:82⤵PID:4244
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=68 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3584 /prefetch:12⤵PID:4880
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3984 /prefetch:12⤵PID:4820
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6320 /prefetch:82⤵PID:4600
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3676 /prefetch:82⤵PID:1948
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4896 /prefetch:82⤵PID:4236
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6736 /prefetch:82⤵PID:4432
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1040 /prefetch:82⤵PID:2484
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5152 /prefetch:82⤵PID:1940
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6748 /prefetch:82⤵PID:2800
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6776 /prefetch:82⤵PID:5108
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5488 /prefetch:82⤵PID:3804
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=79 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6344 /prefetch:12⤵PID:3976
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=80 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4016 /prefetch:12⤵PID:3728
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6452 /prefetch:82⤵PID:2588
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=82 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4272 /prefetch:12⤵PID:4256
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6660 /prefetch:82⤵PID:2560
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=84 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6224 /prefetch:12⤵PID:4708
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=85 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6208 /prefetch:12⤵PID:2452
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6616 /prefetch:82⤵PID:4940
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=87 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6276 /prefetch:12⤵PID:4968
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4160 /prefetch:82⤵PID:704
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=89 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:12⤵PID:4620
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3636 /prefetch:82⤵PID:2224
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7072 /prefetch:82⤵PID:4236
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\EULA.txt2⤵
- Opens file in notepad (likely ransom note)
PID:3980 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=92 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6620 /prefetch:12⤵PID:4212
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=93 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:12⤵PID:1864
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6512 /prefetch:82⤵PID:3464
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6884 /prefetch:82⤵PID:2404
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=96 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:12⤵PID:3780
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=97 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6624 /prefetch:12⤵PID:1144
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=98 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3732 /prefetch:12⤵PID:1200
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6844 /prefetch:82⤵PID:4028
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6848 /prefetch:82⤵PID:4148
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=101 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3880 /prefetch:12⤵PID:1824
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6988 /prefetch:82⤵PID:4636
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5960 /prefetch:82⤵PID:616
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Password.txt2⤵
- Opens file in notepad (likely ransom note)
PID:2160 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=104 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:12⤵PID:4416
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=105 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:12⤵PID:704
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=106 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6260 /prefetch:12⤵PID:3932
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6292 /prefetch:82⤵PID:4796
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6660 /prefetch:82⤵PID:1088
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=109 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:12⤵PID:2636
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:82⤵PID:448
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6096 /prefetch:82⤵PID:4208
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4852 /prefetch:82⤵PID:3328
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1656,11090352205394204259,10906742098531868560,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=113 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4200 /prefetch:12⤵PID:616
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3592
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"1⤵
- Drops file in Program Files directory
PID:3504 -
C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir3504_975096860\ChromeRecovery.exe"C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir3504_975096860\ChromeRecovery.exe" --appguid={8A69D345-D564-463c-AFF1-A69D9E530F96} --browser-version=89.0.4389.114 --sessionid={e04134f9-029a-401d-8d7c-184f5137abd1} --system2⤵
- Executes dropped EXE
PID:4064
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1116
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap32656:118:7zEvent103531⤵
- Suspicious use of AdjustPrivilegeToken
PID:1420
-
C:\Users\Admin\Desktop\Setups.exe"C:\Users\Admin\Desktop\Setups.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2660
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2404
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap28680:76:7zEvent249621⤵
- Suspicious use of AdjustPrivilegeToken
PID:4016
-
C:\Users\Admin\Desktop\MrsMajor3.0.exe"C:\Users\Admin\Desktop\MrsMajor3.0.exe"1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
PID:1576 -
C:\Windows\system32\wscript.exe"C:\Windows\system32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\B50.tmp\B51.tmp\B52.vbs //Nologo2⤵
- UAC bypass
- Checks computer location settings
- System policy modification
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\B50.tmp\eulascr.exe"C:\Users\Admin\AppData\Local\Temp\B50.tmp\eulascr.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4720
-
C:\Users\Admin\Desktop\MrsMajor2.0.exe"C:\Users\Admin\Desktop\MrsMajor2.0.exe"1⤵
- Executes dropped EXE
- Checks computer location settings
PID:1072 -
C:\Windows\system32\wscript.exe"C:\Windows\sysnative\wscript.exe" C:\Users\Admin\AppData\Local\Temp\2BA9.tmp\2BAA.vbs2⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- UAC bypass
- Disables RegEdit via registry modification
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies Control Panel
- Modifies registry class
- System policy modification
PID:1684 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c cd\&cd "C:\Users\Admin\AppData\Local\Temp" & eula32.exe3⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\eula32.exeeula32.exe4⤵
- Executes dropped EXE
PID:4140 -
C:\Program Files\MicrosoftWindowsServicesEtc\GetReady.exe"C:\Program Files\MicrosoftWindowsServicesEtc\GetReady.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
PID:4316 -
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\1\5D68.bat "C:\Program Files\MicrosoftWindowsServicesEtc\GetReady.exe""4⤵
- Drops file in System32 directory
PID:316 -
C:\Windows\System32\takeown.exetakeown /f taskmgr.exe5⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:4284 -
C:\Windows\System32\icacls.exeicacls taskmgr.exe /granted "Admin":F5⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2864 -
C:\Windows\System32\takeown.exetakeown /f sethc.exe5⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:4708 -
C:\Windows\System32\icacls.exeicacls sethc.exe /granted "Admin":F5⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4908 -
C:\Program Files\MicrosoftWindowsServicesEtc\notmuch.exe"C:\Program Files\MicrosoftWindowsServicesEtc\notmuch.exe"3⤵
- Executes dropped EXE
PID:3640 -
C:\Windows\System32\shutdown.exe"C:\Windows\System32\shutdown.exe" -r -t 53⤵
- Suspicious use of AdjustPrivilegeToken
PID:4072
-
C:\Users\Admin\Desktop\BossDaMajor\BossDaMajor.exe"C:\Users\Admin\Desktop\BossDaMajor\BossDaMajor.exe"1⤵
- Executes dropped EXE
- Checks computer location settings
PID:1468 -
C:\Windows\system32\wscript.exe"C:\Windows\sysnative\wscript.exe" C:\Users\Admin\AppData\Local\Temp\3D1E.tmp\3D1F.vbs2⤵
- Checks computer location settings
- Drops file in Program Files directory
PID:4332 -
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"3⤵PID:2360
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" "C:\Program files\mrsmajor\mrsmajorlauncher.vbs" RunAsAdministrator3⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- UAC bypass
- Disables RegEdit via registry modification
- Checks computer location settings
- Drops file in Program Files directory
- Modifies Control Panel
- Modifies registry class
- System policy modification
PID:4112 -
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" "C:\Program Files\mrsmajor\def_resource\f11.mp4"4⤵PID:3200
-
C:\Program Files (x86)\Windows Media Player\setup_wm.exe"C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" "C:\Program Files\mrsmajor\def_resource\f11.mp4"5⤵PID:4840
-
C:\Windows\SysWOW64\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon5⤵PID:516
-
C:\Windows\system32\unregmp2.exe"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT6⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:4152 -
C:\Windows\System32\shutdown.exe"C:\Windows\System32\shutdown.exe" -r -t 034⤵
- Suspicious use of AdjustPrivilegeToken
PID:4760
-
C:\Users\Admin\Desktop\BossDaMajor\BossDaMajor.exe"C:\Users\Admin\Desktop\BossDaMajor\BossDaMajor.exe"1⤵
- Executes dropped EXE
- Checks computer location settings
PID:4012 -
C:\Windows\system32\wscript.exe"C:\Windows\sysnative\wscript.exe" C:\Users\Admin\AppData\Local\Temp\403B.tmp\403C.vbs2⤵PID:1888
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\MRS MAJOR WANTS TO MEET YOU 40.txt1⤵PID:684
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa396f055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1576
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding1⤵PID:4364
Network
MITRE ATT&CK Enterprise v6
Persistence
Change Default File Association
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Bypass User Account Control
1Disabling Security Tools
1File and Directory Permissions Modification
1Modify Registry
5Virtualization/Sandbox Evasion
1Web Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir3504_975096860\ChromeRecovery.exeFilesize
253KB
MD549ac3c96d270702a27b4895e4ce1f42a
SHA155b90405f1e1b72143c64113e8bc65608dd3fd76
SHA25682aa3fd6a25cda9e16689cfadea175091be010cecae537e517f392e0bef5ba0f
SHA512b62f6501cb4c992d42d9097e356805c88ac4ac5a46ead4a8eee9f8cbae197b2305da8aab5b4a61891fe73951588025f2d642c32524b360687993f98c913138a0
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\RecoveryImproved\1.3.36.141\Recovery.crx3Filesize
141KB
MD5ea1c1ffd3ea54d1fb117bfdbb3569c60
SHA110958b0f690ae8f5240e1528b1ccffff28a33272
SHA2567c3a6a7d16ac44c3200f572a764bce7d8fa84b9572dd028b15c59bdccbc0a77d
SHA5126c30728cac9eac53f0b27b7dbe2222da83225c3b63617d6b271a6cfedf18e8f0a8dffa1053e1cbc4c5e16625f4bbc0d03aa306a946c9d72faa4ceb779f8ffcaf
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\mmgaserver.exe.logFilesize
621B
MD58ac365dc282788c15f8acf7d54b6f633
SHA106ba77cb09a2c33bf03f6506f47fe7fbb396ae1a
SHA2562c09c3a4a8926cac0a5abb3cd34c92c78ec66d87e0e225a04f26e02d6630bdeb
SHA51273a80236ab1b2fd69384ea047667d784e0b4ce4064a57ee6c6e23ee61e58fad37346c42792cf4d9cbcfe52e3f7c72ef5eada6fa025a262adf57a4b80123e4a14
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.dbFilesize
28KB
MD5f26e2fc0dd610e8ba5319f305f20879e
SHA18f456e1dba4485aaf669be9899093e1484d67552
SHA25601d3de70f709bbabde0d3f0b07668a54114cb68067c5dc02490206f8f3a529aa
SHA51208b6f8c9c9317f6497009992a15f6ffdabee67276b2a806f18021f09536e9ca61c77d04c2603148627eb71d1aaf96db0e27ac66ad18c368c10a60e7fea9974f2
-
C:\Users\Admin\AppData\Local\Temp\2BA9.tmp\2BAA.vbsFilesize
2KB
MD5fd76266c8088a4dca45414c36c7e9523
SHA16b19bf2904a0e3b479032e101476b49ed3ae144a
SHA256f853dddb0f9f1b74b72bccdb5191c28e18d466b5dbc205f7741a24391375cd6f
SHA5123cd49395368e279ac9a63315583d3804aa89ec8bb6112754973451a7ea7b68140598699b30eef1b0e94c3286d1e6254e2063188282f7e6a18f1349877adeb072
-
C:\Users\Admin\AppData\Local\Temp\2BA9.tmp\MicrosoftWindowsServicesEtc\AppKill.batFilesize
671B
MD5d4e987817d2e5d6ed2c12633d6f11101
SHA13f38430a028f9e3cb66c152e302b3586512dd9c4
SHA2565549670ef8837c6e3c4e496c1ea2063670618249d4151dea4d07d48ab456690c
SHA512b84fef88f0128b46f1e2f9c5dff2cb620ee885bed6c90dcf4a5dc51c77bea492c92b8084d8dc8b4277b47b2493a2d9d3f348c6e229bf3da9041ef90e0fd8b6c4
-
C:\Users\Admin\AppData\Local\Temp\2BA9.tmp\MicrosoftWindowsServicesEtc\CallFunc.vbsFilesize
388B
MD55f9737f03289963a6d7a71efab0813c4
SHA1ba22dfae8d365cbf8014a630f23f1d8574b5cf85
SHA256a767894a68ebc490cb5ab2b7b04dd12b7465553ce7ba7e41e1ea45f1eaef5275
SHA5125f4fb691e6da90e8e0872378a7b78cbd1acbf2bd75d19d65f17bf5b1cea95047d66b79fd1173703fcfef42cfc116ca629b9b37e355e44155e8f3b98f2d916a2a
-
C:\Users\Admin\AppData\Local\Temp\2BA9.tmp\MicrosoftWindowsServicesEtc\DgzRun.vbsFilesize
341B
MD5a91417f7c55510155771f1f644dd6c7e
SHA141bdb69c5baca73f49231d5b5f77975b79e55bdf
SHA256729f7540887cf32a5d4e1968a284c46cf904752821c734bd970ecd30a848477a
SHA512f786699c1ab9d7c74dd9eb9d76a76728980b29e84999a166a47b7ee102d8e545901ed0fcb30331712490a36de2d726115b661ad3900cdc2bfcfc601d00b76b07
-
C:\Users\Admin\AppData\Local\Temp\2BA9.tmp\MicrosoftWindowsServicesEtc\GetReady.exeFilesize
52KB
MD557f3795953dafa8b5e2b24ba5bfad87f
SHA147719bd600e7527c355dbdb053e3936379d1b405
SHA2565319958efc38ea81f61854eb9f6c8aee32394d4389e52fe5c1f7f7ef6b261725
SHA512172006e8deed2766e7fa71e34182b5539309ec8c2ac5f63285724ef8f59864e1159c618c0914eb05692df721794eb4726757b2ccf576f0c78a6567d807cbfb98
-
C:\Users\Admin\AppData\Local\Temp\2BA9.tmp\MicrosoftWindowsServicesEtc\Major.exeFilesize
60KB
MD5d604c29940864c64b4752d31e2deb465
SHA1c1698ea4e5d1ba1c9b78973556f97e8f6dbbdef3
SHA256da0233f5e5e9a34e8dd4f6911444ca1f3e29bb9cbd958a9f4508ac7d72ccd55d
SHA51289a4a14574ba19fe319c766add0111feeb4320c08bf75f55a898d9acc783d5a862a6433758a413cc719b9179dcf873f1c850d1084851b8fc37aa1e3deabfcf54
-
C:\Users\Admin\AppData\Local\Temp\2BA9.tmp\MicrosoftWindowsServicesEtc\NotMuch.exeFilesize
122KB
MD587a43b15969dc083a0d7e2ef73ee4dd1
SHA1657c7ff7e3f325bcbc88db9499b12c636d564a5f
SHA256cf830a2d66d3ffe51341de9e62c939b2bb68583afbc926ddc7818c3a71e80ebb
SHA5128a02d24f5dab33cdaf768bca0d7a1e3ea75ad515747ccca8ee9f7ffc6f93e8f392ab377f7c2efa5d79cc0b599750fd591358a557f074f3ce9170283ab5b786a1
-
C:\Users\Admin\AppData\Local\Temp\2BA9.tmp\MicrosoftWindowsServicesEtc\RuntimeChecker.exeFilesize
58KB
MD5cd58990b1b7f6c68f56244c41ab91665
SHA17ccca9958d6aebbe3883b55f115b041b827bd2e7
SHA25651f59e877a1c2a1c2760c677def7395ef2868c2ee3e56ffdc3ace570afa50428
SHA512011bdd417ec3bf72daa2b32d3816b696be8b87423740dc2a0182e23515651deeb870a94f3415a73480145f9f5e36c1a3a492410b77ca95d7fab8b9826e9198cc
-
C:\Users\Admin\AppData\Local\Temp\2BA9.tmp\MicrosoftWindowsServicesEtc\WinScrew.exeFilesize
52KB
MD51aaafedd9f259acca75708f4af10b5be
SHA1f6b4ea28d304e1f9205c1c0b970d60ee989402f2
SHA256429e01b0e06b02a55bafb1527629f8d4c5f64d9b21ac9f81484a3928fdce6dc9
SHA512a995ebf4d142452aabb419f0cacfa5412d03532840cb08c37dd7c00001dee521bf9d0da66ac4346b07dffd91fe01fa3115fa05811acbd43d380320dca1be4aa8
-
C:\Users\Admin\AppData\Local\Temp\2BA9.tmp\MicrosoftWindowsServicesEtc\breakrule.exeFilesize
58KB
MD5bcb0ac4822de8aeb86ea8a83cd74d7ca
SHA18e2b702450f91dde3c085d902c09dd265368112e
SHA2565eafebd52fbf6d0e8abd0cc9bf42d36e5b6e4d85b8ebe59f61c9f2d6dccc65e4
SHA512b73647a59eeb92f95c4d7519432ce40ce9014b292b9eb1ed6a809cca30864527c2c827fe49c285bb69984f33469704424edca526f9dff05a6244b33424df01d1
-
C:\Users\Admin\AppData\Local\Temp\2BA9.tmp\MicrosoftWindowsServicesEtc\bsod.exeFilesize
1.2MB
MD58f6a3b2b1af3a4aacd8df1734d250cfe
SHA1505b3bd8e936cb5d8999c1b319951ffebab335c9
SHA2566581eeab9fd116662b4ca73f6ef00fb96e0505d01cfb446ee4b32bbdeefe1361
SHA512c1b5f845c005a1a586080e9da9744e30c7f3eda1e3aaba9c351768f7dea802e9f39d0227772413756ab63914ae4a2514e6ce52c494a91e92c3a1f08badb40264
-
C:\Users\Admin\AppData\Local\Temp\2BA9.tmp\MicrosoftWindowsServicesEtc\checker.batFilesize
151B
MD5f59801d5c49713770bdb2f14eff34e2f
SHA191090652460c3a197cfad74d2d3c16947d023d63
SHA2563382484b5a6a04d05500e7622da37c1ffaef3a1343395942bc7802bf2a19b53f
SHA512c1c3a78f86e7938afbe391f0e03065b04375207704e419fe77bf0810d1e740c3ef8926c878884ad81b429ec41e126813a68844f600e124f5fa8d28ef17b4b7bc
-
C:\Users\Admin\AppData\Local\Temp\2BA9.tmp\MicrosoftWindowsServicesEtc\clingclang.wavFilesize
13.1MB
MD51c723b3b9420e04cb8845af8b62a37fa
SHA13331a0f04c851194405eb9a9ff49c76bfa3d4db0
SHA2566831f471ee3363e981e6a1eb0d722f092b33c9b73c91f9f2a9aafa5cb4c56b29
SHA51241f4005ec2a7e0ee8e0e5f52b9d97f25a64a25bb0f00c85c07c643e4e63ea361b4d86733a0cf719b30ea6af225c4fcaca494f22e8e2f73cda9db906c5a0f12ae
-
C:\Users\Admin\AppData\Local\Temp\2BA9.tmp\MicrosoftWindowsServicesEtc\data\eula32.exeFilesize
1.2MB
MD5cbc127fb8db087485068044b966c76e8
SHA1d02451bd20b77664ce27d39313e218ab9a9fdbf9
SHA256c5704419b3eec34fb133cf2509d12492febdcb8831efa1ab014edeac83f538d9
SHA512200ee39287f056b504cc23beb1b301a88b183a3806b023d936a2d44a31bbfd08854f6776082d4f7e2232c3d2f606cd5d8229591ecdc86a2bbcfd970a1ee33d41
-
C:\Users\Admin\AppData\Local\Temp\2BA9.tmp\MicrosoftWindowsServicesEtc\data\excursor.aniFilesize
17KB
MD5289624a46bb7ec6d91d5b099343b7f24
SHA12b0aab828ddb252baf4ed99994f716d136cd7948
SHA256b93b0cb2bb965f5758cb0c699fbc827a64712d6f248aaf810cde5fa5ef3227eb
SHA5128c77696fe1c897f56ea3afdecf67ad1128274815942cd4c73d30bf0a44dd1a690d8c2f4b0be08e604853084e5515020c2e913d6e044f9801b6223c1912eec8f8
-
C:\Users\Admin\AppData\Local\Temp\2BA9.tmp\MicrosoftWindowsServicesEtc\data\fileico.icoFilesize
38KB
MD5a62eeca905717738a4355dc5009d0fc6
SHA1dd4cc0d3f203d395dfdc26834fc890e181d33382
SHA256d13f7fd44f38136dae1cdf147ba9b673e698f77c0a644ccd3c12e3a71818a0cd
SHA51247ffac6dc37dac4276579cd668fd2524ab1591b594032adbeb609d442f3a28235a2d185c66d8b78b6827ac51d62d97bdc3dffc3ffbaa70cf13d4d5f1dc5f16c2
-
C:\Users\Admin\AppData\Local\Temp\2BA9.tmp\MicrosoftWindowsServicesEtc\data\runner32s.exeFilesize
58KB
MD587815289b110cf33af8af1decf9ff2e9
SHA109024f9ec9464f56b7e6c61bdd31d7044bdf4795
SHA256a97ea879e2b51972aa0ba46a19ad4363d876ac035502a2ed2df27db522bc6ac4
SHA5128d9024507fa83f578b375c86f38970177313ec3dd9fae794b6e7f739e84fa047a9ef56bf190f6f131d0c7c5e280e729208848b152b3ca492a54af2b18e70f5dc
-
C:\Users\Admin\AppData\Local\Temp\2BA9.tmp\MicrosoftWindowsServicesEtc\data\thetruth.jpgFilesize
483KB
MD57907845316bdbd32200b82944d752d9c
SHA11e5c37db25964c5dd05f4dce392533a838a722a9
SHA2564e3baea3d98c479951f9ea02e588a3b98b1975055c1dfdf67af4de6e7b41e476
SHA51272a64fab025928d60174d067990c35caa3bb6dadacf9c66e5629ee466016bc8495e71bed218e502f6bde61623e0819485459f25f3f82836e632a52727335c0a0
-
C:\Users\Admin\AppData\Local\Temp\2BA9.tmp\MicrosoftWindowsServicesEtc\example.txtFilesize
302B
MD58837818893ce61b6730dd8a83d625890
SHA1a9d71d6d6d0c262d41a60b6733fb23cd7b8c7614
SHA256cc6d0f847fde710096b01abf905c037594ff4afae6e68a8b6af0cc59543e29bb
SHA5126f17d46098e3c56070ced4171d4c3a0785463d92db5f703b56b250ab8615bcb6e504d4c5a74d05308a62ea36ae31bc29850187943b54add2b50422fb03125516
-
C:\Users\Admin\AppData\Local\Temp\2BA9.tmp\MicrosoftWindowsServicesEtc\fexec.vbsFilesize
2KB
MD5fd76266c8088a4dca45414c36c7e9523
SHA16b19bf2904a0e3b479032e101476b49ed3ae144a
SHA256f853dddb0f9f1b74b72bccdb5191c28e18d466b5dbc205f7741a24391375cd6f
SHA5123cd49395368e279ac9a63315583d3804aa89ec8bb6112754973451a7ea7b68140598699b30eef1b0e94c3286d1e6254e2063188282f7e6a18f1349877adeb072
-
C:\Users\Admin\AppData\Local\Temp\2BA9.tmp\MicrosoftWindowsServicesEtc\healgen.vbsFilesize
302B
MD58837818893ce61b6730dd8a83d625890
SHA1a9d71d6d6d0c262d41a60b6733fb23cd7b8c7614
SHA256cc6d0f847fde710096b01abf905c037594ff4afae6e68a8b6af0cc59543e29bb
SHA5126f17d46098e3c56070ced4171d4c3a0785463d92db5f703b56b250ab8615bcb6e504d4c5a74d05308a62ea36ae31bc29850187943b54add2b50422fb03125516
-
C:\Users\Admin\AppData\Local\Temp\2BA9.tmp\MicrosoftWindowsServicesEtc\majordared.exeFilesize
8.8MB
MD5570d35aabee1887f7f6ab3f0a1e76984
SHA1ae989563c3be21ee9043690dcaac3a426859d083
SHA256fa24bc7bc366f2ad579d57a691fb0d10d868e501221df0c32a98e705d2d61e43
SHA5129b68a8acacba451bbf028656c181fae29c5bcaed6a7ff4c1fc26ab708b62ca4be7bba9c777c598926d23331570617d20a0ce439f014461eccd8c3f595d21a54f
-
C:\Users\Admin\AppData\Local\Temp\2BA9.tmp\MicrosoftWindowsServicesEtc\majorlist.exeFilesize
51KB
MD5230970ec5286b34a6b2cda9afdd28368
SHA1e3198d3d3b51d245a62a0dc955f2b1449608a295
SHA2563cdafc944b48d45a0d5dc068652486a970124ebe1379a7a04e5cf1dcf05c37c8
SHA51252912b6b2ba55c540316fcfc6f45d68771d1c22ddf4eb09c2cc15fb8ddd214812c18fd75cd61b561c29f660e2bf20290a101b85da1e0bbf8dfbf90b791892b57
-
C:\Users\Admin\AppData\Local\Temp\2BA9.tmp\MicrosoftWindowsServicesEtc\majorsod.exeFilesize
58KB
MD5b561c360c46744f55be79a25e1844e3c
SHA1ed0f7eb00b4f1ae6cf92ad75e5701014f3d03d56
SHA256d1094e91960ded15444c6f50756adc451a7c0b495b2ea28319b7184ba96236f7
SHA5120a3a75d08f1d7afcd7a476fc71157983e04b0c26b00ace4d505aa644e5da3e242dd0f6afdb3c93f29ba0b08d2702d0e96b49acba4ed260330068b13f93973e9f
-
C:\Users\Admin\AppData\Local\Temp\2BA9.tmp\MicrosoftWindowsServicesEtc\rsod.exeFilesize
74KB
MD591a0740cfb043e1f4d8461f8cbe2ff19
SHA192e1ad31c34c4102e5cb2cc69f3793b2a1d5304e
SHA256dcaabfd6955d3fec26a86217d1b1ab7e979c301d498473e4d885145ce031fc3b
SHA512c60067655e5f191708af9b25382869e3ce65cd3ea2d6cac70f8cae4132942cfd6a8aa9dde1e2b7f3f12997d6d7411e21dc73ab4cd83ec555d74b82b86778a613
-
C:\Users\Admin\AppData\Local\Temp\2BA9.tmp\MicrosoftWindowsServicesEtc\weird\GetReady.batFilesize
345B
MD53dbccaadafb7f0227c1839be5ca07015
SHA1bd636f73235d52d172ad8932a8e4a6a8b17389a0
SHA25633a0c62f3f66bce3fc1beb37aca8ad731bfa5590177d933d9d4eae016019242a
SHA512d981670f9d492d97931ab260a7d7d27d4f97621a1ef3e20246d4be2a9b4cfc01e01174a1d46432b4a3d937ad135c97eec9ef7bbc7da46034388843887df4637e
-
C:\Users\Admin\AppData\Local\Temp\2BA9.tmp\MicrosoftWindowsServicesEtc\weird\Major.vbsFilesize
2KB
MD59192fd494155eab424110765c751559e
SHA1b54fcc1e29617b3eee1c7bb215c048498881b641
SHA256cbd3b0f294e8f11592a3ad80d1070d81746f806a48183b93c345251422ccbf0d
SHA512b8c48916535f3721e7f47be6af671765c3befefcd407c6ea5fabcf9ada119747408d662f61fb436f98a7c33050b6674da54dddf25e683429204a96555ec6e801
-
C:\Users\Admin\AppData\Local\Temp\2BA9.tmp\MicrosoftWindowsServicesEtc\weird\RuntimeChecker.vbsFilesize
440B
MD5fe44b78a465853c0ac0744c6ab05ea40
SHA1f32dacd91b9547fce9a8a2846a4e17c33295aab3
SHA256989d947c51c878bcefecb53d867a3c182c2d67129a87a5f6773eb6ef2bbf9b2e
SHA5126b945e16786833c2e2e9867315b8859c413687fc72d4c8576b9c0a1aed2dc65249468317dd49f2ecf777e27c9969b7a7abc72b4d9b7c182dc7999051377515db
-
C:\Users\Admin\AppData\Local\Temp\2BA9.tmp\MicrosoftWindowsServicesEtc\weird\WinScrew.batFilesize
336B
MD504067ca733ee8b2ab2f068edc8b75a0f
SHA1973cb577f6ab2463040918c3661333553a3132c8
SHA2563aef33c03777abe62feef0a840ac6a087caafc05adfe801464fd1c52eac656a0
SHA5125423a1e668211f269a3d787548e11d18de7365d6c2525c2de61014854f1ab5a51b5de9eda70fb21d6ebe356cb52e93b3f406c71ed7fbcaedd2b023b6fa9c13f8
-
C:\Users\Admin\AppData\Local\Temp\2BA9.tmp\MicrosoftWindowsServicesEtc\weird\breakrule.vbsFilesize
108B
MD52609fde7a9604c73be5083e4bcfa0e20
SHA1068c89f703fb11663143b9927f2a0c9f9f59c0e3
SHA25617d014cb4abbaced3acce9b6d7a1b595cd6e2dd814e41f06ceddcdc08e93eebe
SHA512439fee7cc198cb3fef4ef14693141e52c305579a4ff2da0842323f57dcffade03f3b01ac288080fed423511937a4c1e2080f5a79f967a963fe34253f541824cb
-
C:\Users\Admin\AppData\Local\Temp\2BA9.tmp\MicrosoftWindowsServicesEtc\weird\bsod.batFilesize
133B
MD5c94bb8d71863b05b95891389bed6365e
SHA107bb402d67f8b1fc601687f1df2622369413db3b
SHA2563900e3b60b4691311e050c4cf8fac82ff178a06e3d04d5d6b2d7ea12cf5d53d1
SHA51200e7ab3a91862faaf5ac5ca3de6dbf2cbb8aac4aba277e1e14b2ecf4650eea2e68134e0df549dca35ab715ed46e36fa9cfee1ba7bb3520511723bf567566682d
-
C:\Users\Admin\AppData\Local\Temp\2BA9.tmp\MicrosoftWindowsServicesEtc\weird\cmd.vbsFilesize
11B
MD5b181d5a4055b4a620dd7c44c5065bbe7
SHA136320f257026b923b923ad2c0e7fa93a257806e0
SHA2564d2639e890d6d5988eb9cb6f8cb50647048bbfeeb83fc604c52567e7381c876c
SHA5120bec0cf2e5b93065701c5458c1d7e047312971d7bbed3ce5444db710654fa0d84eabb7d7c243130e3cb2dae38eb05874929b5b08547174a6065f8accd4e0433d
-
C:\Users\Admin\AppData\Local\Temp\2BA9.tmp\MicrosoftWindowsServicesEtc\weird\majorlist.batFilesize
105B
MD54cc606c63f423fda5324c962db709562
SHA1091250ffc64db9bea451885350abed2b7748014c
SHA256839301ef07178c100e7f4d47874faf995ae5d11dfd527dda096a284c8114671b
SHA512f29ef2bc694f497499545d1fa4e14ca93c06049fff582af3a6caf3885153491a1cd9e96ab5a6746051aa972421f876c008e5d5b671bd34c3922b61c84151097f
-
C:\Users\Admin\AppData\Local\Temp\2BA9.tmp\MicrosoftWindowsServicesEtc\weird\majorsod.vbsFilesize
126B
MD5fecb9e50c1f01d9d6101f273cb860260
SHA118c413f577c289004db6156bd133e5db70258044
SHA2568863b595563e92d73b29090ff83191b2fa1297507be588aa7e1cf910e77c7feb
SHA5122c30641b099d5b6c3af40cb41e70160c1f4294bb30dc3162b018e9552b48fc899d1a63d3e366bfb71fcf6803bcc518cf8d504ce60684ce221028a9bf2bc07f9d
-
C:\Users\Admin\AppData\Local\Temp\2BA9.tmp\MicrosoftWindowsServicesEtc\weird\runner32s.vbsFilesize
383B
MD55f427dc44f33906509423d24fa0590c0
SHA1b896f7667381a594d3751e05f258925b81c231c0
SHA2569aae0707b1d5d3b7ed3bf5cc8fbb530aebd195e3e2f18312f3f7f1aa43e031b4
SHA512bd28c386772062ef945f24c8ad7a25f158856af36e31d2c9b14674cedfd34b4f48ed531cd40a7eb291384d83665ffe154f0786c1a7ee1616256cf30125120961
-
C:\Users\Admin\AppData\Local\Temp\2BA9.tmp\MicrosoftWindowsServicesEtc\xRun.vbsFilesize
93B
MD526ec8d73e3f6c1e196cc6e3713b9a89f
SHA1cb2266f3ecfef4d59bd12d7f117c2327eb9c55fa
SHA256ed588fa361979f7f9c6dbb4e6a1ae6e075f2db8d79ea6ca2007ba8e3423671b0
SHA5122b3ad279f1cdc2a5b05073116c71d79e190bfa407da09d8268d56ac2a0c4cc0c31161a251686ac67468d0ba329c302a301c542c22744d9e3a3f5e7ffd2b51195
-
C:\Users\Admin\AppData\Local\Temp\2BA9.tmp\MicrosoftWindowsServicesEtc\xRunReg.vbsFilesize
134B
MD58267192f547f8914ff36eff80ca3f402
SHA123bdeb19fb37059e1293dd80d8be69480c957c73
SHA256cdd4f356ca256c707960bc42b97649111a830e6f951ca6a3cf80853e3c342947
SHA512cd684cb73496ca925fd8604fbbf286b842e2b02ce18b19d63618e8355dcec02bce700fb09b25da932545845b01a7f8d9986fa486db504b92a42d7c0ace21e9e2
-
C:\Users\Admin\AppData\Local\Temp\3D1E.tmp\3D1F.vbsFilesize
1007B
MD55706bc5d518069a3b2be5e6fac51b12f
SHA1d7361f3623ecf05e63bb97cc9da8d5c50401575c
SHA2568a74eead47657582c84209eb4cdba545404d9c67dd288c605515a86e06de0aad
SHA512fb68727db0365ab10c5b0d5e5e1d44b95aa38806e33b0af3280abcefae83f30eb8252653e158ac941320f3b38507649cce41898c8511223ee8642339cfece047
-
C:\Users\Admin\AppData\Local\Temp\3D1E.tmp\mrsmajor\CPUUsage.vbsFilesize
92B
MD50e4c01bf30b13c953f8f76db4a7e857d
SHA1b8ddbc05adcf890b55d82a9f00922376c1a22696
SHA25628e69e90466034ce392e84db2bde3ad43ad556d12609e3860f92016641b2a738
SHA5125e66e2793e7bc88066b8df3dccb554351287dea18207e280b69d7798ecd5cdc99bd4c126c3e394db9f45f54bb561e6688f928de4f638c5eca4f101dc2cea54a1
-
C:\Users\Admin\AppData\Local\Temp\3D1E.tmp\mrsmajor\default.txtFilesize
266B
MD530cfd8bb946a7e889090fb148ea6f501
SHA1c49dbc93f0f17ff65faf3b313562c655ef3f9753
SHA256e1ebbd3abfcaddf7d6960708f3ccd8eda64c944723f0905ff76551c692b94210
SHA5128e7d98e6d0c05d199114d2d6ab8da886aed68de690c4d79643868eaf051c229fff94c88d937adb3da5e31fe48116613cf79dd00dda30f296746ce0a8aded9fe2
-
C:\Users\Admin\AppData\Local\Temp\5a530dfd-bc51-4992-a05d-f09d41a331d4\AgileDotNetRT64.dllFilesize
75KB
MD542b2c266e49a3acd346b91e3b0e638c0
SHA12bc52134f03fcc51cb4e0f6c7cf70646b4df7dd1
SHA256adeed015f06efa363d504a18acb671b1db4b20b23664a55c9bc28aef3283ca29
SHA512770822fd681a1d98afe03f6fbe5f116321b54c8e2989fb07491811fd29fca5b666f1adf4c6900823af1271e342cacc9293e9db307c4eef852d1a253b00347a81
-
C:\Users\Admin\AppData\Local\Temp\B50.tmp\B51.tmp\B52.vbsFilesize
352B
MD53b8696ecbb737aad2a763c4eaf62c247
SHA14a2d7a2d61d3f4c414b4e5d2933cd404b8f126e5
SHA256ce95f7eea8b303bc23cfd6e41748ad4e7b5e0f0f1d3bdf390eadb1e354915569
SHA512713d9697b892b9dd892537e8a01eab8d0265ebf64867c8beecf7a744321257c2a5c11d4de18fcb486bb69f199422ce3cab8b6afdbe880481c47b06ba8f335beb
-
C:\Users\Admin\AppData\Local\Temp\B50.tmp\eulascr.exeFilesize
143KB
MD58b1c352450e480d9320fce5e6f2c8713
SHA1d6bd88bf33de7c5d4e68b233c37cc1540c97bd3a
SHA2562c343174231b55e463ca044d19d47bd5842793c15954583eb340bfd95628516e
SHA5122d8e43b1021da08ed1bf5aff110159e6bc10478102c024371302ccfce595e77fd76794658617b5b52f9a50190db250c1ba486d247d9cd69e4732a768edbb4cbc
-
C:\Users\Admin\AppData\Local\Temp\B50.tmp\eulascr.exeFilesize
143KB
MD58b1c352450e480d9320fce5e6f2c8713
SHA1d6bd88bf33de7c5d4e68b233c37cc1540c97bd3a
SHA2562c343174231b55e463ca044d19d47bd5842793c15954583eb340bfd95628516e
SHA5122d8e43b1021da08ed1bf5aff110159e6bc10478102c024371302ccfce595e77fd76794658617b5b52f9a50190db250c1ba486d247d9cd69e4732a768edbb4cbc
-
C:\Users\Admin\AppData\Local\Temp\mmgaserver.exeFilesize
858.3MB
MD56801ce702c2f379f5d92e71a64bb7993
SHA1fb48b8e5c9e82389ea657e683c856c90e78be3b2
SHA256275dee718bc2c22ce4384c0023686b72217f995227e0e5884459270bc945b83d
SHA5122a107ee1ba6d98fbd979e523f578401f6e37869d25613732868521fc5c9a6c71d0a510c9b4c672a02cdf20e56ed8e790090aa43201f5a89008f0b5e821619c87
-
C:\Users\Admin\AppData\Local\Temp\mmgaserver.exeFilesize
858.3MB
MD56801ce702c2f379f5d92e71a64bb7993
SHA1fb48b8e5c9e82389ea657e683c856c90e78be3b2
SHA256275dee718bc2c22ce4384c0023686b72217f995227e0e5884459270bc945b83d
SHA5122a107ee1ba6d98fbd979e523f578401f6e37869d25613732868521fc5c9a6c71d0a510c9b4c672a02cdf20e56ed8e790090aa43201f5a89008f0b5e821619c87
-
C:\Users\Admin\AppData\Local\Temp\mmgaserver.exeFilesize
858.3MB
MD56801ce702c2f379f5d92e71a64bb7993
SHA1fb48b8e5c9e82389ea657e683c856c90e78be3b2
SHA256275dee718bc2c22ce4384c0023686b72217f995227e0e5884459270bc945b83d
SHA5122a107ee1ba6d98fbd979e523f578401f6e37869d25613732868521fc5c9a6c71d0a510c9b4c672a02cdf20e56ed8e790090aa43201f5a89008f0b5e821619c87
-
C:\Users\Admin\AppData\Roaming\Microsoft\NetVPUpdater.exeFilesize
858.3MB
MD56801ce702c2f379f5d92e71a64bb7993
SHA1fb48b8e5c9e82389ea657e683c856c90e78be3b2
SHA256275dee718bc2c22ce4384c0023686b72217f995227e0e5884459270bc945b83d
SHA5122a107ee1ba6d98fbd979e523f578401f6e37869d25613732868521fc5c9a6c71d0a510c9b4c672a02cdf20e56ed8e790090aa43201f5a89008f0b5e821619c87
-
C:\Users\Admin\Desktop\BossDaMajor\BossDaMajor.exeFilesize
1.9MB
MD538ff71c1dee2a9add67f1edb1a30ff8c
SHA110f0defd98d4e5096fbeb321b28d6559e44d66db
SHA256730a41a7656f606a22e9f0d68782612d6e00ab8cfe1260160b9e0b00bc2e442a
SHA5128347782951f2647fe433482cb13186653afa32ee9f5be83a138c4ed47ff34d8de66a26e74b5a28ea21c1529b2078401922a9a26803772677b70489967c10f3e9
-
C:\Users\Admin\Desktop\BossDaMajor\BossDaMajor.exeFilesize
1.9MB
MD538ff71c1dee2a9add67f1edb1a30ff8c
SHA110f0defd98d4e5096fbeb321b28d6559e44d66db
SHA256730a41a7656f606a22e9f0d68782612d6e00ab8cfe1260160b9e0b00bc2e442a
SHA5128347782951f2647fe433482cb13186653afa32ee9f5be83a138c4ed47ff34d8de66a26e74b5a28ea21c1529b2078401922a9a26803772677b70489967c10f3e9
-
C:\Users\Admin\Desktop\MrsMajor2.0.exeFilesize
25.6MB
MD5247a35851fdee53a1696715d67bd0905
SHA1d2e86020e1d48e527e81e550f06c651328bd58a4
SHA2565dd4ea169cabf9226f54bb53e63ea6a1b5880a0d1222242aee378efb6255b57d
SHA512a173801aaef4fab608d99b52223b5b2400d69b91edcbf33c21fcb47bd832eef9d771dfd36da350a502a371ed1739c869a7c2b4dca456c93f2feed9ac9c647c7c
-
C:\Users\Admin\Desktop\MrsMajor2.0.exeFilesize
25.6MB
MD5247a35851fdee53a1696715d67bd0905
SHA1d2e86020e1d48e527e81e550f06c651328bd58a4
SHA2565dd4ea169cabf9226f54bb53e63ea6a1b5880a0d1222242aee378efb6255b57d
SHA512a173801aaef4fab608d99b52223b5b2400d69b91edcbf33c21fcb47bd832eef9d771dfd36da350a502a371ed1739c869a7c2b4dca456c93f2feed9ac9c647c7c
-
C:\Users\Admin\Desktop\MrsMajor3.0.exeFilesize
381KB
MD535a27d088cd5be278629fae37d464182
SHA1d5a291fadead1f2a0cf35082012fe6f4bf22a3ab
SHA2564a75f2db1dbd3c1218bb9994b7e1c690c4edd4e0c1a675de8d2a127611173e69
SHA512eb0be3026321864bd5bcf53b88dc951711d8c0b4bcbd46800b90ca5116a56dba22452530e29f3ccbbcc43d943bdefc8ed8ca2d31ba2e7e5f0e594f74adba4ab5
-
C:\Users\Admin\Desktop\MrsMajor3.0.exeFilesize
381KB
MD535a27d088cd5be278629fae37d464182
SHA1d5a291fadead1f2a0cf35082012fe6f4bf22a3ab
SHA2564a75f2db1dbd3c1218bb9994b7e1c690c4edd4e0c1a675de8d2a127611173e69
SHA512eb0be3026321864bd5bcf53b88dc951711d8c0b4bcbd46800b90ca5116a56dba22452530e29f3ccbbcc43d943bdefc8ed8ca2d31ba2e7e5f0e594f74adba4ab5
-
C:\Users\Admin\Desktop\PA$$w0rds_1234__FreeSetup8--Z5.rarFilesize
6.5MB
MD5b0de796c8891f9bc855f82e42c94b71d
SHA1d3d0907d2d7aafaf37d0e5c8257df1f05ec57bd9
SHA2566cd032d4a3844ea4fd8a0c0642cabc729de07030f907d33a3185e9795173f9c4
SHA512ec2d98e041be1cfba97a0cc33a156d1a4ae59c712ce6c68e4112101dacabb64367ba584420b1e29d15e96de9299399ab90d8a701d78c6969bc97ba8a60c6f060
-
C:\Users\Admin\Desktop\Setups.exeFilesize
379.0MB
MD59a0482c51786a57e1c1697a5dbe5da9d
SHA14c982a379df02ac56436ce690764fef9646bbcf5
SHA2563d05b67e336f8a4776a32c6a699d9889a1adb71b3831e80c487b4ae40670ffe1
SHA51207ccbd7303d610ccc6220578d9a40faf1b993caa80f8e7940b5a712f80949236c42a22bddc1b07928fe3c8cf685bf03580674652bf1c25bfc1da311733d258e5
-
C:\Users\Admin\Desktop\Setups.exeFilesize
379.0MB
MD59a0482c51786a57e1c1697a5dbe5da9d
SHA14c982a379df02ac56436ce690764fef9646bbcf5
SHA2563d05b67e336f8a4776a32c6a699d9889a1adb71b3831e80c487b4ae40670ffe1
SHA51207ccbd7303d610ccc6220578d9a40faf1b993caa80f8e7940b5a712f80949236c42a22bddc1b07928fe3c8cf685bf03580674652bf1c25bfc1da311733d258e5
-
C:\Users\Admin\Downloads\EULA.txtFilesize
1KB
MD58c2383e7db60f0141456b92e84791b49
SHA1a656c857339c1f31aa883f98b6b99e4031e7dbb2
SHA2561061c2c0f62e46bfc98bebc98f9ef6c51b14a1f9bc4bf6a775d9764f4ae75d77
SHA51251d95e17b235aec03f34ed960ee3d93150b5cb1e3efbe848e5c56aae229f2138f14ecf42e589dbb94361359019a99cda3f83744d2e4358b698528c7d3c6c78b4
-
C:\Users\Admin\Downloads\Password.txtFilesize
146B
MD5864d6f104c7227b0b61a8c6ad9f36799
SHA171e5e6ce5a72a9064e8d6ebe48c82dcf1775c051
SHA256b4ffe702f87be39da9ccab745ddd48ae6223ca594d05ae9d54d30f5b82d09032
SHA512ef0606612b5f576bf7859cffd0c3bf5850873e6feb1fd5539165828c597bd39a19e7a7609ad43cb46567a982a9a2900d79d0acbaf9b718897ce2aaa6b018a7bf
-
memory/316-257-0x0000000000000000-mapping.dmp
-
memory/516-254-0x0000000000000000-mapping.dmp
-
memory/856-150-0x0000000000000000-mapping.dmp
-
memory/1420-185-0x0000000000000000-mapping.dmp
-
memory/1640-152-0x0000000000000000-mapping.dmp
-
memory/1684-199-0x0000000000000000-mapping.dmp
-
memory/1888-244-0x0000000000000000-mapping.dmp
-
memory/2160-181-0x0000000000000000-mapping.dmp
-
memory/2212-245-0x0000000000000000-mapping.dmp
-
memory/2360-243-0x0000000000000000-mapping.dmp
-
memory/2660-174-0x0000000077470000-0x0000000077613000-memory.dmpFilesize
1.6MB
-
memory/2660-171-0x0000000000DE0000-0x000000000159F000-memory.dmpFilesize
7.7MB
-
memory/2660-172-0x0000000000DE0000-0x000000000159F000-memory.dmpFilesize
7.7MB
-
memory/2660-173-0x0000000000DE0000-0x000000000159F000-memory.dmpFilesize
7.7MB
-
memory/2660-178-0x0000000077470000-0x0000000077613000-memory.dmpFilesize
1.6MB
-
memory/2660-175-0x0000000000DE0000-0x000000000159F000-memory.dmpFilesize
7.7MB
-
memory/2660-176-0x0000000077470000-0x0000000077613000-memory.dmpFilesize
1.6MB
-
memory/2660-177-0x0000000000DE0000-0x000000000159F000-memory.dmpFilesize
7.7MB
-
memory/2660-170-0x0000000000DE0000-0x000000000159F000-memory.dmpFilesize
7.7MB
-
memory/2864-259-0x0000000000000000-mapping.dmp
-
memory/3200-252-0x0000000000000000-mapping.dmp
-
memory/3308-153-0x0000000000000000-mapping.dmp
-
memory/3640-265-0x00000000008F0000-0x0000000000914000-memory.dmpFilesize
144KB
-
memory/3640-263-0x0000000000000000-mapping.dmp
-
memory/3736-160-0x0000000140000000-0x0000000140809000-memory.dmpFilesize
8.0MB
-
memory/3736-159-0x0000027F4B6A0000-0x0000027F4B6C0000-memory.dmpFilesize
128KB
-
memory/3736-154-0x0000000140000000-0x0000000140809000-memory.dmpFilesize
8.0MB
-
memory/3736-155-0x000000014036EAC4-mapping.dmp
-
memory/3736-157-0x0000000140000000-0x0000000140809000-memory.dmpFilesize
8.0MB
-
memory/3736-156-0x0000000140000000-0x0000000140809000-memory.dmpFilesize
8.0MB
-
memory/3736-161-0x0000000140000000-0x0000000140809000-memory.dmpFilesize
8.0MB
-
memory/3736-266-0x0000000140000000-0x0000000140809000-memory.dmpFilesize
8.0MB
-
memory/3824-148-0x0000000000000000-mapping.dmp
-
memory/3960-146-0x00007FFDDB0D0000-0x00007FFDDBB91000-memory.dmpFilesize
10.8MB
-
memory/3960-141-0x0000000000400000-0x0000000000828000-memory.dmpFilesize
4.2MB
-
memory/3960-158-0x00007FFDDB0D0000-0x00007FFDDBB91000-memory.dmpFilesize
10.8MB
-
memory/3960-151-0x0000013FCE3F0000-0x0000013FCE402000-memory.dmpFilesize
72KB
-
memory/3960-147-0x00007FFDDB0D0000-0x00007FFDDBB91000-memory.dmpFilesize
10.8MB
-
memory/3960-142-0x0000000000400000-mapping.dmp
-
memory/3980-179-0x0000000000000000-mapping.dmp
-
memory/4064-165-0x0000000000000000-mapping.dmp
-
memory/4072-264-0x0000000000000000-mapping.dmp
-
memory/4112-251-0x0000000000000000-mapping.dmp
-
memory/4140-247-0x0000000000A80000-0x0000000000BBC000-memory.dmpFilesize
1.2MB
-
memory/4140-246-0x0000000000000000-mapping.dmp
-
memory/4140-250-0x0000000005570000-0x000000000557A000-memory.dmpFilesize
40KB
-
memory/4140-249-0x00000000055D0000-0x0000000005662000-memory.dmpFilesize
584KB
-
memory/4140-248-0x0000000005C90000-0x0000000006234000-memory.dmpFilesize
5.6MB
-
memory/4152-255-0x0000000000000000-mapping.dmp
-
memory/4284-258-0x0000000000000000-mapping.dmp
-
memory/4316-256-0x0000000000000000-mapping.dmp
-
memory/4332-239-0x0000000000000000-mapping.dmp
-
memory/4432-149-0x0000000000000000-mapping.dmp
-
memory/4664-139-0x00007FFDDB0D0000-0x00007FFDDBB91000-memory.dmpFilesize
10.8MB
-
memory/4664-136-0x00000256C0010000-0x00000256C0032000-memory.dmpFilesize
136KB
-
memory/4664-137-0x00007FFDDB0D0000-0x00007FFDDBB91000-memory.dmpFilesize
10.8MB
-
memory/4664-135-0x0000000000000000-mapping.dmp
-
memory/4664-140-0x00007FFDDB0D0000-0x00007FFDDBB91000-memory.dmpFilesize
10.8MB
-
memory/4708-260-0x0000000000000000-mapping.dmp
-
memory/4720-192-0x00007FFDE9060000-0x00007FFDE91AE000-memory.dmpFilesize
1.3MB
-
memory/4720-190-0x0000000000DA0000-0x0000000000DCA000-memory.dmpFilesize
168KB
-
memory/4720-193-0x00007FFDD44B0000-0x00007FFDD4F71000-memory.dmpFilesize
10.8MB
-
memory/4720-195-0x000000001F2B0000-0x000000001F7D8000-memory.dmpFilesize
5.2MB
-
memory/4720-196-0x00007FFDD44B0000-0x00007FFDD4F71000-memory.dmpFilesize
10.8MB
-
memory/4720-194-0x000000001EBB0000-0x000000001ED72000-memory.dmpFilesize
1.8MB
-
memory/4720-188-0x0000000000000000-mapping.dmp
-
memory/4760-262-0x0000000000000000-mapping.dmp
-
memory/4840-253-0x0000000000000000-mapping.dmp
-
memory/4908-261-0x0000000000000000-mapping.dmp
-
memory/5088-130-0x0000000000000000-mapping.dmp
-
memory/5088-145-0x00007FFDDB0D0000-0x00007FFDDBB91000-memory.dmpFilesize
10.8MB
-
memory/5088-138-0x00007FFDDB0D0000-0x00007FFDDBB91000-memory.dmpFilesize
10.8MB
-
memory/5088-133-0x000001FDB0C20000-0x000001FDB107E000-memory.dmpFilesize
4.4MB
-
memory/5088-134-0x00007FFDDB0D0000-0x00007FFDDBB91000-memory.dmpFilesize
10.8MB