Resubmissions
19-11-2022 21:40
221119-1jgzlacd49 819-11-2022 13:48
221119-q4ed4adg34 1019-11-2022 06:26
221119-g7aqmscg91 1019-11-2022 05:30
221119-f67hjsbc8t 1015-11-2022 20:50
221115-zm3j2abf6y 1015-11-2022 20:50
221115-zmpm6sfh23 1015-11-2022 20:49
221115-zl6kasfg98 1015-11-2022 20:19
221115-y4ct9sff87 1014-11-2022 19:39
221114-yc4tnsdb92 1014-11-2022 19:34
221114-yakb9adb83 10Analysis
-
max time kernel
1809s -
max time network
1810s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
19-11-2022 06:26
Static task
static1
Behavioral task
behavioral1
Sample
db79d6a667294c81210d9aa4d989f35832e75151863c2d216787028ae673da50.exe
Resource
win10v2004-20221111-en
General
-
Target
db79d6a667294c81210d9aa4d989f35832e75151863c2d216787028ae673da50.exe
-
Size
307KB
-
MD5
0abe50c1509136bf62d2184ab439e7a5
-
SHA1
722a7e2a0dd66f506ba93d24946b8bf504b100c0
-
SHA256
db79d6a667294c81210d9aa4d989f35832e75151863c2d216787028ae673da50
-
SHA512
0c232d1eaf68c0099fb499fcd40bb33cd604f0259a71b853c296e00cc468342de95548ccf61d9e904cef5d34fd94defbb43f844e9f50a51517c7c95ab66862c5
-
SSDEEP
6144:Gu0FGLnBOUaLPP7S9dW8dsgMF24raEn2E1a:Gu0wTBOU2Pj6EisgM/uUv
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/4540-133-0x00000000001F0000-0x00000000001F9000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Blocklisted process makes network request 61 IoCs
Processes:
rundll32.exeflow pid process 218 1120 rundll32.exe 316 1120 rundll32.exe 320 1120 rundll32.exe 349 1120 rundll32.exe 353 1120 rundll32.exe 354 1120 rundll32.exe 358 1120 rundll32.exe 360 1120 rundll32.exe 364 1120 rundll32.exe 373 1120 rundll32.exe 374 1120 rundll32.exe 385 1120 rundll32.exe 389 1120 rundll32.exe 391 1120 rundll32.exe 407 1120 rundll32.exe 408 1120 rundll32.exe 412 1120 rundll32.exe 415 1120 rundll32.exe 430 1120 rundll32.exe 432 1120 rundll32.exe 448 1120 rundll32.exe 449 1120 rundll32.exe 466 1120 rundll32.exe 472 1120 rundll32.exe 473 1120 rundll32.exe 478 1120 rundll32.exe 494 1120 rundll32.exe 495 1120 rundll32.exe 518 1120 rundll32.exe 519 1120 rundll32.exe 523 1120 rundll32.exe 526 1120 rundll32.exe 527 1120 rundll32.exe 533 1120 rundll32.exe 548 1120 rundll32.exe 549 1120 rundll32.exe 560 1120 rundll32.exe 574 1120 rundll32.exe 576 1120 rundll32.exe 579 1120 rundll32.exe 586 1120 rundll32.exe 601 1120 rundll32.exe 602 1120 rundll32.exe 626 1120 rundll32.exe 627 1120 rundll32.exe 649 1120 rundll32.exe 653 1120 rundll32.exe 655 1120 rundll32.exe 660 1120 rundll32.exe 680 1120 rundll32.exe 682 1120 rundll32.exe 685 1120 rundll32.exe 699 1120 rundll32.exe 715 1120 rundll32.exe 717 1120 rundll32.exe 718 1120 rundll32.exe 742 1120 rundll32.exe 743 1120 rundll32.exe 748 1120 rundll32.exe 775 1120 rundll32.exe 789 1120 rundll32.exe -
Downloads MZ/PE file
-
Executes dropped EXE 9 IoCs
Processes:
4C66.exesajsuhwsoftware_reporter_tool.exesoftware_reporter_tool.exesoftware_reporter_tool.exesoftware_reporter_tool.exesajsuhwChromeRecovery.exesajsuhwpid process 4064 4C66.exe 2308 sajsuhw 3160 software_reporter_tool.exe 3416 software_reporter_tool.exe 4556 software_reporter_tool.exe 3852 software_reporter_tool.exe 3504 sajsuhw 4348 ChromeRecovery.exe 4808 sajsuhw -
Sets DLL path for service in the registry 2 TTPs 1 IoCs
Processes:
rundll32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\br\Parameters\ServiceDll = "C:\\Program Files (x86)\\Windows Defender\\ja-JP\\br.dll耀" rundll32.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
rundll32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\br\ImagePath = "C:\\Windows\\system32\\svchost.exe -k LocalService" rundll32.exe -
Loads dropped DLL 10 IoCs
Processes:
rundll32.exesvchost.exerundll32.exesoftware_reporter_tool.exepid process 1120 rundll32.exe 4224 svchost.exe 4484 rundll32.exe 4556 software_reporter_tool.exe 4556 software_reporter_tool.exe 4556 software_reporter_tool.exe 4556 software_reporter_tool.exe 4556 software_reporter_tool.exe 4556 software_reporter_tool.exe 4556 software_reporter_tool.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts rundll32.exe -
Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe Key opened \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe Key opened \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe Key opened \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
rundll32.exedescription pid process target process PID 1120 set thread context of 2356 1120 rundll32.exe rundll32.exe -
Drops file in Program Files directory 46 IoCs
Processes:
rundll32.exeelevation_service.exedescription ioc process File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-stdio-l1-1-0.dll rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\back-arrow-default.svg rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Adobe.Reader.Dependencies.manifest rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\aic_file_icons_retina_thumb.png rundll32.exe File created C:\Program Files (x86)\Windows Defender\ja-JP\main-cef-ui-theme.css rundll32.exe File created C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir2300_844394813\ChromeRecoveryCRX.crx elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\main-cef-ui-theme.css rundll32.exe File created C:\Program Files (x86)\Windows Defender\ja-JP\main-cef-win.css rundll32.exe File created C:\Program Files (x86)\Windows Defender\ja-JP\br.dll rundll32.exe File opened for modification C:\Program Files\7-Zip\Lang\fr.txt rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\main-cef-mac.css rundll32.exe File created C:\Program Files (x86)\Windows Defender\ja-JP\back-arrow-default.svg rundll32.exe File created C:\Program Files (x86)\Windows Defender\ja-JP\duplicate.svg rundll32.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-private-l1-1-0.dll rundll32.exe File opened for modification C:\Program Files\7-Zip\Lang\af.txt rundll32.exe File created C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir2300_844394813\ChromeRecovery.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\Flash.mpp rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\back-arrow-disabled.svg rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\ccloud.png rundll32.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe rundll32.exe File created C:\Program Files (x86)\Windows Defender\ja-JP\logsession.dll rundll32.exe File created C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir2300_844394813\_metadata\verified_contents.json elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\duplicate.svg rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\turnOffNotificationInAcrobat.gif rundll32.exe File created C:\Program Files (x86)\Windows Defender\ja-JP\Flash.mpp rundll32.exe File created C:\Program Files (x86)\Windows Defender\ja-JP\turnOffNotificationInAcrobat.gif rundll32.exe File opened for modification C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir2300_844394813\manifest.json elevation_service.exe File created C:\Program Files (x86)\Windows Defender\ja-JP\server_issue.gif rundll32.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe rundll32.exe File opened for modification C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\manifest.json rundll32.exe File created C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir2300_844394813\manifest.json elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\server_issue.gif rundll32.exe File opened for modification C:\Program Files\7-Zip\7-zip.dll rundll32.exe File opened for modification C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir2300_844394813\_metadata\verified_contents.json elevation_service.exe File created C:\Program Files (x86)\Windows Defender\ja-JP\ccloud.png rundll32.exe File created C:\Program Files (x86)\Windows Defender\ja-JP\Adobe.Reader.Dependencies.manifest rundll32.exe File created C:\Program Files (x86)\Windows Defender\ja-JP\aic_file_icons_retina_thumb.png rundll32.exe File created C:\Program Files (x86)\Windows Defender\ja-JP\review_shared.gif rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\main-cef-win.css rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\review_shared.gif rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\logsession.dll rundll32.exe File created C:\Program Files (x86)\Windows Defender\ja-JP\back-arrow-disabled.svg rundll32.exe File opened for modification C:\Program Files\7-Zip\Lang\hi.txt rundll32.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-core-timezone-l1-1-0.dll rundll32.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-conio-l1-1-0.dll rundll32.exe File opened for modification C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir2300_844394813\ChromeRecovery.exe elevation_service.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3988 4064 WerFault.exe 4C66.exe -
Checks SCSI registry key(s) 3 TTPs 12 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
sajsuhwsajsuhwdb79d6a667294c81210d9aa4d989f35832e75151863c2d216787028ae673da50.exesajsuhwdescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sajsuhw Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sajsuhw Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI db79d6a667294c81210d9aa4d989f35832e75151863c2d216787028ae673da50.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sajsuhw Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sajsuhw Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sajsuhw Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sajsuhw Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sajsuhw Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sajsuhw Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI db79d6a667294c81210d9aa4d989f35832e75151863c2d216787028ae673da50.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI db79d6a667294c81210d9aa4d989f35832e75151863c2d216787028ae673da50.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sajsuhw -
Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
svchost.exerundll32.exerundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1 svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 svchost.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 rundll32.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision svchost.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision rundll32.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Processes:
description ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" Key created \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Internet Explorer\Toolbar Set value (int) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" Key created \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser Set value (data) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Key created \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Internet Explorer\IESettingSync Set value (int) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" Key created \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch -
Modifies registry class 8 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\WorkFolders Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\ Key created \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000_Classes\Local Settings chrome.exe Key created \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU Set value (data) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots Set value (data) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Key created \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ -
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\BEA1C32F2E5B33667CE371CE01CDC507F76E49C5 rundll32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\BEA1C32F2E5B33667CE371CE01CDC507F76E49C5\Blob = 030000000100000014000000bea1c32f2e5b33667ce371ce01cdc507f76e49c52000000001000000c0020000308202bc30820225a00302010202082a8859690239b653300d06092a864886f70d01010b050030783138303606035504030c2f566572695369676e20556e6976657273616c20526f6f7420436572746966696361746f6f6e20417574686f72697479311b3019060355040b0c1222286329203230303820566572695369676e31123010060355040a0c0922566572695369676e310b3009060355040613025553301e170d3230313131393037333032355a170d3234313131383037333032355a30783138303606035504030c2f566572695369676e20556e6976657273616c20526f6f7420436572746966696361746f6f6e20417574686f72697479311b3019060355040b0c1222286329203230303820566572695369676e31123010060355040a0c0922566572695369676e310b300906035504061302555330819f300d06092a864886f70d010101050003818d0030818902818100eac8308b394b9b11846caa88432cbc71be44cf0f0ca333e71ef0cfcce31ff89dbe19ff85acad5fa33c463d9dcfca404d022574a01d1a3648b13ae3f4440fc34e84d916b1f8c94f948ebf18a012f8304a53ff9b453961e1baa1082331c1e70fa2cf8e9a50f7ab17d49be8c7543243de2c85e8c801bf00042f571fbbcaf3f8dbcb0203010001a34f304d300f0603551d130101ff040530030101ff303a0603551d1104333031822f566572695369676e20556e6976657273616c20526f6f7420436572746966696361746f6f6e20417574686f72697479300d06092a864886f70d01010b050003818100ac33627b3aee4284898176325f7ab373a66179f3614c3f9d5656d101273ee0a946faadaf26b4a2322f70a6d75b19a6510b53100f26891d6014117e68c5fbcc5be4e78b83a5c8c3e6ad4902f8ab1f9eafe27de868cc213ec69ad28d906bf5484bf915d138700f8267842c79698f0c0397bfc46fe1d8027cf3d064ad4eef4158d0 rundll32.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
pid process 2704 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
db79d6a667294c81210d9aa4d989f35832e75151863c2d216787028ae673da50.exepid process 4540 db79d6a667294c81210d9aa4d989f35832e75151863c2d216787028ae673da50.exe 4540 db79d6a667294c81210d9aa4d989f35832e75151863c2d216787028ae673da50.exe 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2704 -
Suspicious behavior: MapViewOfSection 4 IoCs
Processes:
db79d6a667294c81210d9aa4d989f35832e75151863c2d216787028ae673da50.exesajsuhwsajsuhwsajsuhwpid process 4540 db79d6a667294c81210d9aa4d989f35832e75151863c2d216787028ae673da50.exe 2308 sajsuhw 3504 sajsuhw 4808 sajsuhw -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs
Processes:
chrome.exepid process 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
rundll32.exedescription pid process Token: SeShutdownPrivilege 2704 Token: SeCreatePagefilePrivilege 2704 Token: SeShutdownPrivilege 2704 Token: SeCreatePagefilePrivilege 2704 Token: SeShutdownPrivilege 2704 Token: SeCreatePagefilePrivilege 2704 Token: SeShutdownPrivilege 2704 Token: SeCreatePagefilePrivilege 2704 Token: SeShutdownPrivilege 2704 Token: SeCreatePagefilePrivilege 2704 Token: SeShutdownPrivilege 2704 Token: SeCreatePagefilePrivilege 2704 Token: SeShutdownPrivilege 2704 Token: SeCreatePagefilePrivilege 2704 Token: SeShutdownPrivilege 2704 Token: SeCreatePagefilePrivilege 2704 Token: SeShutdownPrivilege 2704 Token: SeCreatePagefilePrivilege 2704 Token: SeShutdownPrivilege 2704 Token: SeCreatePagefilePrivilege 2704 Token: SeShutdownPrivilege 2704 Token: SeCreatePagefilePrivilege 2704 Token: SeShutdownPrivilege 2704 Token: SeCreatePagefilePrivilege 2704 Token: SeShutdownPrivilege 2704 Token: SeCreatePagefilePrivilege 2704 Token: SeShutdownPrivilege 2704 Token: SeCreatePagefilePrivilege 2704 Token: SeShutdownPrivilege 2704 Token: SeCreatePagefilePrivilege 2704 Token: SeShutdownPrivilege 2704 Token: SeCreatePagefilePrivilege 2704 Token: SeShutdownPrivilege 2704 Token: SeCreatePagefilePrivilege 2704 Token: SeShutdownPrivilege 2704 Token: SeCreatePagefilePrivilege 2704 Token: SeShutdownPrivilege 2704 Token: SeCreatePagefilePrivilege 2704 Token: SeShutdownPrivilege 2704 Token: SeCreatePagefilePrivilege 2704 Token: SeShutdownPrivilege 2704 Token: SeCreatePagefilePrivilege 2704 Token: SeShutdownPrivilege 2704 Token: SeCreatePagefilePrivilege 2704 Token: SeShutdownPrivilege 2704 Token: SeCreatePagefilePrivilege 2704 Token: SeShutdownPrivilege 2704 Token: SeCreatePagefilePrivilege 2704 Token: SeShutdownPrivilege 2704 Token: SeCreatePagefilePrivilege 2704 Token: SeShutdownPrivilege 2704 Token: SeCreatePagefilePrivilege 2704 Token: SeShutdownPrivilege 2704 Token: SeCreatePagefilePrivilege 2704 Token: SeShutdownPrivilege 2704 Token: SeCreatePagefilePrivilege 2704 Token: SeShutdownPrivilege 2704 Token: SeCreatePagefilePrivilege 2704 Token: SeDebugPrivilege 1120 rundll32.exe Token: SeShutdownPrivilege 2704 Token: SeCreatePagefilePrivilege 2704 Token: SeShutdownPrivilege 2704 Token: SeCreatePagefilePrivilege 2704 Token: SeShutdownPrivilege 2704 -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
chrome.exerundll32.exepid process 2704 2704 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 2704 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 2704 2704 2356 rundll32.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 2704 2704 -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
chrome.exepid process 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 2704 2704 2704 2704 2704 2704 2704 2704 2704 -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
pid process 2704 2704 2704 -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 2704 wrote to memory of 784 2704 chrome.exe PID 2704 wrote to memory of 784 2704 chrome.exe PID 784 wrote to memory of 4168 784 chrome.exe chrome.exe PID 784 wrote to memory of 4168 784 chrome.exe chrome.exe PID 784 wrote to memory of 1872 784 chrome.exe chrome.exe PID 784 wrote to memory of 1872 784 chrome.exe chrome.exe PID 784 wrote to memory of 1872 784 chrome.exe chrome.exe PID 784 wrote to memory of 1872 784 chrome.exe chrome.exe PID 784 wrote to memory of 1872 784 chrome.exe chrome.exe PID 784 wrote to memory of 1872 784 chrome.exe chrome.exe PID 784 wrote to memory of 1872 784 chrome.exe chrome.exe PID 784 wrote to memory of 1872 784 chrome.exe chrome.exe PID 784 wrote to memory of 1872 784 chrome.exe chrome.exe PID 784 wrote to memory of 1872 784 chrome.exe chrome.exe PID 784 wrote to memory of 1872 784 chrome.exe chrome.exe PID 784 wrote to memory of 1872 784 chrome.exe chrome.exe PID 784 wrote to memory of 1872 784 chrome.exe chrome.exe PID 784 wrote to memory of 1872 784 chrome.exe chrome.exe PID 784 wrote to memory of 1872 784 chrome.exe chrome.exe PID 784 wrote to memory of 1872 784 chrome.exe chrome.exe PID 784 wrote to memory of 1872 784 chrome.exe chrome.exe PID 784 wrote to memory of 1872 784 chrome.exe chrome.exe PID 784 wrote to memory of 1872 784 chrome.exe chrome.exe PID 784 wrote to memory of 1872 784 chrome.exe chrome.exe PID 784 wrote to memory of 1872 784 chrome.exe chrome.exe PID 784 wrote to memory of 1872 784 chrome.exe chrome.exe PID 784 wrote to memory of 1872 784 chrome.exe chrome.exe PID 784 wrote to memory of 1872 784 chrome.exe chrome.exe PID 784 wrote to memory of 1872 784 chrome.exe chrome.exe PID 784 wrote to memory of 1872 784 chrome.exe chrome.exe PID 784 wrote to memory of 1872 784 chrome.exe chrome.exe PID 784 wrote to memory of 1872 784 chrome.exe chrome.exe PID 784 wrote to memory of 1872 784 chrome.exe chrome.exe PID 784 wrote to memory of 1872 784 chrome.exe chrome.exe PID 784 wrote to memory of 1872 784 chrome.exe chrome.exe PID 784 wrote to memory of 1872 784 chrome.exe chrome.exe PID 784 wrote to memory of 1872 784 chrome.exe chrome.exe PID 784 wrote to memory of 1872 784 chrome.exe chrome.exe PID 784 wrote to memory of 1872 784 chrome.exe chrome.exe PID 784 wrote to memory of 1872 784 chrome.exe chrome.exe PID 784 wrote to memory of 1872 784 chrome.exe chrome.exe PID 784 wrote to memory of 1872 784 chrome.exe chrome.exe PID 784 wrote to memory of 1872 784 chrome.exe chrome.exe PID 784 wrote to memory of 1872 784 chrome.exe chrome.exe PID 784 wrote to memory of 4172 784 chrome.exe chrome.exe PID 784 wrote to memory of 4172 784 chrome.exe chrome.exe PID 784 wrote to memory of 3116 784 chrome.exe chrome.exe PID 784 wrote to memory of 3116 784 chrome.exe chrome.exe PID 784 wrote to memory of 3116 784 chrome.exe chrome.exe PID 784 wrote to memory of 3116 784 chrome.exe chrome.exe PID 784 wrote to memory of 3116 784 chrome.exe chrome.exe PID 784 wrote to memory of 3116 784 chrome.exe chrome.exe PID 784 wrote to memory of 3116 784 chrome.exe chrome.exe PID 784 wrote to memory of 3116 784 chrome.exe chrome.exe PID 784 wrote to memory of 3116 784 chrome.exe chrome.exe PID 784 wrote to memory of 3116 784 chrome.exe chrome.exe PID 784 wrote to memory of 3116 784 chrome.exe chrome.exe PID 784 wrote to memory of 3116 784 chrome.exe chrome.exe PID 784 wrote to memory of 3116 784 chrome.exe chrome.exe PID 784 wrote to memory of 3116 784 chrome.exe chrome.exe PID 784 wrote to memory of 3116 784 chrome.exe chrome.exe PID 784 wrote to memory of 3116 784 chrome.exe chrome.exe PID 784 wrote to memory of 3116 784 chrome.exe chrome.exe PID 784 wrote to memory of 3116 784 chrome.exe chrome.exe -
outlook_office_path 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe -
outlook_win_path 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\db79d6a667294c81210d9aa4d989f35832e75151863c2d216787028ae673da50.exe"C:\Users\Admin\AppData\Local\Temp\db79d6a667294c81210d9aa4d989f35832e75151863c2d216787028ae673da50.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x9c,0x100,0x104,0xdc,0x108,0x7ffedc224f50,0x7ffedc224f60,0x7ffedc224f702⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1620,16298659186474751730,15449743352874096153,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1632 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1620,16298659186474751730,15449743352874096153,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1860 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1620,16298659186474751730,15449743352874096153,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2264 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,16298659186474751730,15449743352874096153,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2968 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,16298659186474751730,15449743352874096153,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3160 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,16298659186474751730,15449743352874096153,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3852 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,16298659186474751730,15449743352874096153,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4500 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,16298659186474751730,15449743352874096153,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4920 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,16298659186474751730,15449743352874096153,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5040 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,16298659186474751730,15449743352874096153,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5340 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,16298659186474751730,15449743352874096153,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5348 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,16298659186474751730,15449743352874096153,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5340 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,16298659186474751730,15449743352874096153,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4632 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,16298659186474751730,15449743352874096153,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4656 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,16298659186474751730,15449743352874096153,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4580 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,16298659186474751730,15449743352874096153,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4612 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,16298659186474751730,15449743352874096153,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4580 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,16298659186474751730,15449743352874096153,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4804 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,16298659186474751730,15449743352874096153,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,16298659186474751730,15449743352874096153,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4544 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,16298659186474751730,15449743352874096153,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4600 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,16298659186474751730,15449743352874096153,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3860 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,16298659186474751730,15449743352874096153,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3412 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,16298659186474751730,15449743352874096153,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3076 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,16298659186474751730,15449743352874096153,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3844 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,16298659186474751730,15449743352874096153,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,16298659186474751730,15449743352874096153,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,16298659186474751730,15449743352874096153,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3872 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,16298659186474751730,15449743352874096153,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4488 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,16298659186474751730,15449743352874096153,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5640 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,16298659186474751730,15449743352874096153,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3876 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,16298659186474751730,15449743352874096153,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3980 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,16298659186474751730,15449743352874096153,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,16298659186474751730,15449743352874096153,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3104 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1620,16298659186474751730,15449743352874096153,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4416 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,16298659186474751730,15449743352874096153,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,16298659186474751730,15449743352874096153,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3900 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,16298659186474751730,15449743352874096153,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6156 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1620,16298659186474751730,15449743352874096153,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6216 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1620,16298659186474751730,15449743352874096153,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3276 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,16298659186474751730,15449743352874096153,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6264 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,16298659186474751730,15449743352874096153,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3184 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,16298659186474751730,15449743352874096153,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=900 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,16298659186474751730,15449743352874096153,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5024 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,16298659186474751730,15449743352874096153,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5028 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,16298659186474751730,15449743352874096153,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3624 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,16298659186474751730,15449743352874096153,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6260 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,16298659186474751730,15449743352874096153,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5208 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,16298659186474751730,15449743352874096153,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2624 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,16298659186474751730,15449743352874096153,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:82⤵
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\107.294.200\software_reporter_tool.exe"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\107.294.200\software_reporter_tool.exe" --engine=2 --scan-locations=1,2,3,4,5,6,7,8,10 --disabled-locations=9,11 --session-id=F+QjEFOx9CCWRnRcWIJFrGrvnQ1Lc7zt1alv3TwD --registry-suffix=ESET --enable-crash-reporting --srt-field-trial-group-name=Off2⤵
- Executes dropped EXE
-
\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\107.294.200\software_reporter_tool.exe"c:\users\admin\appdata\local\google\chrome\user data\swreporter\107.294.200\software_reporter_tool.exe" --crash-handler "--database=c:\users\admin\appdata\local\Google\Software Reporter Tool" --url=https://clients2.google.com/cr/report --annotation=plat=Win32 --annotation=prod=ChromeFoil --annotation=ver=107.294.200 --initial-client-data=0x284,0x288,0x28c,0x260,0x290,0x7ff664035960,0x7ff664035970,0x7ff6640359803⤵
- Executes dropped EXE
-
\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\107.294.200\software_reporter_tool.exe"c:\users\admin\appdata\local\google\chrome\user data\swreporter\107.294.200\software_reporter_tool.exe" --enable-crash-reporting --use-crash-handler-with-id="\\.\pipe\crashpad_3160_DZAOBCHFBPELETOF" --sandboxed-process-id=2 --init-done-notifier=764 --sandbox-mojo-pipe-token=9086196065189160857 --mojo-platform-channel-handle=740 --engine=23⤵
- Executes dropped EXE
- Loads dropped DLL
-
\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\107.294.200\software_reporter_tool.exe"c:\users\admin\appdata\local\google\chrome\user data\swreporter\107.294.200\software_reporter_tool.exe" --enable-crash-reporting --use-crash-handler-with-id="\\.\pipe\crashpad_3160_DZAOBCHFBPELETOF" --sandboxed-process-id=3 --init-done-notifier=988 --sandbox-mojo-pipe-token=843797937003855043 --mojo-platform-channel-handle=9843⤵
- Executes dropped EXE
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,16298659186474751730,15449743352874096153,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=380 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,16298659186474751730,15449743352874096153,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3112 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,16298659186474751730,15449743352874096153,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5456 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,16298659186474751730,15449743352874096153,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,16298659186474751730,15449743352874096153,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2284 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,16298659186474751730,15449743352874096153,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4580 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,16298659186474751730,15449743352874096153,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4704 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,16298659186474751730,15449743352874096153,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1556 /prefetch:82⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\4C66.exeC:\Users\Admin\AppData\Local\Temp\4C66.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Qieppoeedtppeh.tmp",Risetpqpdpi2⤵
- Blocklisted process makes network request
- Sets DLL path for service in the registry
- Sets service image path in registry
- Loads dropped DLL
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Checks processor information in registry
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 190883⤵
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\schtasks.exeschtasks /End /tn \Microsoft\Windows\Wininet\CacheTask3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4064 -s 5202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4064 -ip 40641⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\AppData\Roaming\sajsuhwC:\Users\Admin\AppData\Roaming\sajsuhw1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k LocalService1⤵
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "c:\program files (x86)\windows defender\ja-jp\br.dll",WiU1dkRpSzhH2⤵
- Loads dropped DLL
- Checks processor information in registry
-
C:\Users\Admin\AppData\Roaming\sajsuhwC:\Users\Admin\AppData\Roaming\sajsuhw1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"1⤵
- Drops file in Program Files directory
-
C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir2300_844394813\ChromeRecovery.exe"C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir2300_844394813\ChromeRecovery.exe" --appguid={8A69D345-D564-463c-AFF1-A69D9E530F96} --browser-version=89.0.4389.114 --sessionid={5a23d7d5-130e-4fe1-997d-dd07d4c3651a} --system2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\sajsuhwC:\Users\Admin\AppData\Roaming\sajsuhw1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Windows Defender\ja-JP\br.dllFilesize
802KB
MD5c34f756de2a700c3167fdacccd64a34a
SHA1d53037263cf25c9a144364027942640a93f6ae9d
SHA256fb9fd8b34b2f724caf687b7f350fbe6f9f46ef7395a98d9d644fb80e9b54fe4c
SHA5124b3512c4348cf06d04d4a172a21fa26c4feb65030de124bf11647b225518546343c6f46c5d705527b4a1b04e852bd4dbb7e796449c18ab590ded1cfebc516e1f
-
C:\Program Files (x86)\Windows Defender\ja-JP\br.dllFilesize
802KB
MD5c34f756de2a700c3167fdacccd64a34a
SHA1d53037263cf25c9a144364027942640a93f6ae9d
SHA256fb9fd8b34b2f724caf687b7f350fbe6f9f46ef7395a98d9d644fb80e9b54fe4c
SHA5124b3512c4348cf06d04d4a172a21fa26c4feb65030de124bf11647b225518546343c6f46c5d705527b4a1b04e852bd4dbb7e796449c18ab590ded1cfebc516e1f
-
C:\ProgramData\{455CF15F-E931-14FA-1CC2-96370E30FAF8}\C2RManifest.officemuiset.msi.16.en-us.xmlFilesize
1KB
MD5576aefa0d5cef530c59ff90625d60e25
SHA119be51d3942120e5474e0711592718da525eaa20
SHA256f5b39bd24efbf27831061a34d1a78cea8f0073bfccade786129495f17cf2f112
SHA5120d342bb21bb9651c0c36831718d9009af790bf808a9f38ec1788a06428d08d1299f4e215bd08e4912acc25d0f41ae95f3118019aa2811e89f35453b0ef8b32bf
-
C:\ProgramData\{455CF15F-E931-14FA-1CC2-96370E30FAF8}\DesktopSettings2013.xmlFilesize
17KB
MD5c6b6b07071e0f8ff39f5941a3169b20c
SHA1d77fd2513ac3cb9b8595424d1f695fce21e33d96
SHA256f8b710777d2c0105e74ee27ee6dfc8e43ca4ff7e14b4dba390eb72dad20705bd
SHA512167ab504d6e4c91239f8239722aba17a7f6748fb3e8ee750b2d3f3fd677e6646a8149c8b956513cb2e90722196471865591215938cea8444fdf2e5cff180fdec
-
C:\ProgramData\{455CF15F-E931-14FA-1CC2-96370E30FAF8}\Microsoft.AccountsControl_10.0.19041.1023_neutral__cw5n1h2txyewy.xmlFilesize
13KB
MD5c7405e2e68aec89e44862595ccc0d186
SHA12cc8d73f93dd875134917795633bb606911f1069
SHA2569a9adc35b9debbd0ded2aa1684769afd7fbb09b2e1afa20b19893de5fdbabe37
SHA5120cb3190812b404ff0cc32bc0442c8e0cc26ee989fbcab7284b21dbd134664f1b38fd3cb7e9a98898dd64b445ace1a117bd00cac793336fb25a819e17c60cab22
-
C:\ProgramData\{455CF15F-E931-14FA-1CC2-96370E30FAF8}\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe.xmlFilesize
9KB
MD5993d82e37af681bd65f1d428b6ee281e
SHA1bb1a8402cfccd1d97ea58d6136847a4dd1ba0f65
SHA2561bc1d4525a46e58edd165a9d792f50441ea3cbcecd14022dc112e02f3d9b5bf8
SHA5124eb247e384ffa84460e43abe7563643de30f397b628c02f3e6e51c69669d5d7b8be6ebe51355586e5cd5a252652e0eef7f1bd0219b416b61e1db318db4ac833c
-
C:\ProgramData\{455CF15F-E931-14FA-1CC2-96370E30FAF8}\Microsoft.MicrosoftEdge.Stable_92.0.902.67_neutral__8wekyb3d8bbwe.xmlFilesize
2KB
MD5c8d6f0d26db52746e243b785c269cacd
SHA1b06dc537fb0bbd424c0bb0c7a5ee0a85839e04f1
SHA256d3352e34ef1b362934f938a2c2710261ca18c5e5e4922167a73539d945a95e21
SHA512c674886978f91b35978544ad18ceb54aa7b2d8dfd8d9e0ddb752854ef211539e79a24d553d9a1a91c7e6711743e2bbd70c24611dac063c2d61379cc7f8ef3020
-
C:\ProgramData\{455CF15F-E931-14FA-1CC2-96370E30FAF8}\Qsswsuaweuhyoe.tmpFilesize
3.5MB
MD5bc0e1d0646af0b3a2bfe698249e473f0
SHA1990729f9e7bc74574092fd08658fbecf9869055b
SHA256440cfcfcf29623b6baef193d00df58d93e904f2f844b7b6060a7bafb0680bb35
SHA512384fd05b7665306ec2bb3c967865759e142ee4aad9250628815516367572570a2fb23604e3c32708116ba6422176b0bd6521dc9cee6622422de910bf85e38886
-
C:\ProgramData\{455CF15F-E931-14FA-1CC2-96370E30FAF8}\background.pngFilesize
126KB
MD59adaf3a844ce0ce36bfed07fa2d7ef66
SHA13a804355d5062a6d2ed9653d66e9e4aebaf90bc0
SHA256d3e8d47e8c1622ec10adef672ca7a8992748c4f0a4e75f877462e7e661069698
SHA512e6988737153a0996b14e6baa45e8010ff46714fe7679d05a2676cc18e1c653e99227e7507cdae4f2b6a99b3c31478630e7e1ae13d0f7c12525406d8cf9867ca5
-
C:\ProgramData\{455CF15F-E931-14FA-1CC2-96370E30FAF8}\edb.jcpFilesize
8KB
MD51a0f5ad4f2f6e94afefabddce95b0581
SHA11e9cb706656237c2e999b75760534d4a993d4372
SHA2563ffc3680a1ba22a32eefed74ee7e743e62884e1a92192447b146b44f13f9b20a
SHA5125a40cb453877886d2f606dccb6faf67b8a961f210206761b280f778be0c3cbf7db524b212e50fe861152b9237551ba4460c84a45ace6b46423780ecb632279a7
-
C:\ProgramData\{455CF15F-E931-14FA-1CC2-96370E30FAF8}\edbres00002.jrsFilesize
64KB
MD5fcd6bcb56c1689fcef28b57c22475bad
SHA11adc95bebe9eea8c112d40cd04ab7a8d75c4f961
SHA256de2f256064a0af797747c2b97505dc0b9f3df0de4f489eac731c23ae9ca9cc31
SHA51273e4153936dab198397b74ee9efc26093dda721eaab2f8d92786891153b45b04265a161b169c988edb0db2c53124607b6eaaa816559c5ce54f3dbc9fa6a7a4b2
-
C:\ProgramData\{455CF15F-E931-14FA-1CC2-96370E30FAF8}\guest.bmpFilesize
588KB
MD5908fa2dfb385771ecf5f8b2b3e7bff16
SHA11255fa1edbd2dbbcab6d9eb9f74b7d6783697a58
SHA25660ff5131dba68a8ffe7ba0475bf3e192b432e1969e5ac52d7f217f6935f4035d
SHA512573c9fde441fb8debaa44b6fa2d3763c3dc4714497089b82bedc8ef0720eea4a907f75cffb1c0ec4a77ac89cfecbef8e6182a2a8fea5b51a2e91920ceaad5f69
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000009Filesize
64KB
MD5c7782af9d54787032e0e4b7c7365fb5b
SHA1c696eadca78a31329e47e0a71b05057e4c215143
SHA2560dec9ff08fbc1080e270e1b80802940713cb05ea6199f4467f92d90fb6c29394
SHA5127a1eabac7a57937d1c744b03c3333c939e44bfd40fe2bf66e2eb577c090d1fa0a55a2dd7fe3f193f605529612f5a751d4174615b2105f3f306376d24818ff20b
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000019Filesize
46KB
MD5998d9074954b439c4c4ad9871591bbdc
SHA1afa51bebdd6b20f9a863d1005f7d0025dffe0ca3
SHA2563d73cfb6fc2aea80a9d09404204c0b25a1dc54d35e7dd2211066983ebbbc6c56
SHA51256f92ebfdf9c840cfc2f19fb8d11b6076954e94dcb9c60918f5ec5d8689580f453929dd0d23b0389a4aa08c630820830f5e1e565befee63e44f6561e1c6aac46
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\27a6ad47452b1de8_0Filesize
2KB
MD5ae01b47312d20ef333ab34fc1e2ae180
SHA17e23aa3a3b329ca0eedc2fdd6323604bede9856c
SHA25678502f6c717be71ce5072a25217a8fac0de052fd2f16eece3bd0580ad7af605e
SHA512c7ef283283437eb7bbc83a7bb4220e246e40b07791fa772facf7364acc54e8a75d6705627af1b18779aeb62ac15685d12ba80551c247af9ac8116b56bdaf8120
-
C:\Users\Admin\AppData\Local\Temp\4C66.exeFilesize
1.2MB
MD5578ecff2823a463b85cd7888931e37e0
SHA1e5dc6560471eb54c6f1700aef624e4f316f0332d
SHA256b92ac3c77eacb6955e2ccec9943821d016a2593b64ac608bd4c98f61b795f0f7
SHA51239f599943edb237e79b51fdba72c80bca2063d2e8642dea9ebacd9f1403e96c8cc190d32db8e1c1b44bd292042d0550d106ef39cb0850c91aeafe6d9209b499a
-
C:\Users\Admin\AppData\Local\Temp\4C66.exeFilesize
1.2MB
MD5578ecff2823a463b85cd7888931e37e0
SHA1e5dc6560471eb54c6f1700aef624e4f316f0332d
SHA256b92ac3c77eacb6955e2ccec9943821d016a2593b64ac608bd4c98f61b795f0f7
SHA51239f599943edb237e79b51fdba72c80bca2063d2e8642dea9ebacd9f1403e96c8cc190d32db8e1c1b44bd292042d0550d106ef39cb0850c91aeafe6d9209b499a
-
C:\Users\Admin\AppData\Local\Temp\Qieppoeedtppeh.tmpFilesize
802KB
MD5759e32c67ea3441582e9573471496f41
SHA1c8e8378787184363d256b91417e60f09ccb4258d
SHA256a5555d31a4f07e83f86100ce6f8242feccaa5157b10ccef2b48ab13dfac06ffd
SHA5125c5d8f5b0aca6a68ea7bf7a30a7fe8afc204514e76cf13c6d23eb0e2bcc6925dd36d65fde81a893a338ec61dfb5f0c2da1e0c4cf1c52856e5df9511ceca741d4
-
C:\Users\Admin\AppData\Local\Temp\Qieppoeedtppeh.tmpFilesize
802KB
MD5759e32c67ea3441582e9573471496f41
SHA1c8e8378787184363d256b91417e60f09ccb4258d
SHA256a5555d31a4f07e83f86100ce6f8242feccaa5157b10ccef2b48ab13dfac06ffd
SHA5125c5d8f5b0aca6a68ea7bf7a30a7fe8afc204514e76cf13c6d23eb0e2bcc6925dd36d65fde81a893a338ec61dfb5f0c2da1e0c4cf1c52856e5df9511ceca741d4
-
C:\Users\Admin\AppData\Roaming\sajsuhwFilesize
307KB
MD50abe50c1509136bf62d2184ab439e7a5
SHA1722a7e2a0dd66f506ba93d24946b8bf504b100c0
SHA256db79d6a667294c81210d9aa4d989f35832e75151863c2d216787028ae673da50
SHA5120c232d1eaf68c0099fb499fcd40bb33cd604f0259a71b853c296e00cc468342de95548ccf61d9e904cef5d34fd94defbb43f844e9f50a51517c7c95ab66862c5
-
C:\Users\Admin\AppData\Roaming\sajsuhwFilesize
307KB
MD50abe50c1509136bf62d2184ab439e7a5
SHA1722a7e2a0dd66f506ba93d24946b8bf504b100c0
SHA256db79d6a667294c81210d9aa4d989f35832e75151863c2d216787028ae673da50
SHA5120c232d1eaf68c0099fb499fcd40bb33cd604f0259a71b853c296e00cc468342de95548ccf61d9e904cef5d34fd94defbb43f844e9f50a51517c7c95ab66862c5
-
C:\Users\Admin\Downloads\FreeFileV56_Password_10101.zipFilesize
7.7MB
MD5e2ce9cfa4f423289f41b757429347654
SHA1d193de1eb06b8517d2d9761a210cad761834ee95
SHA256643cd7a15864abe0d25647bb017ee8eee9a0775dfdf53d45c58655d1aef83a13
SHA512bf23fd62fe4c194a7c4520131cd300ff3b640082d86afde0613faaafe992ed090452d06453d7cc0ae3f817b34e1dd1bc73459dcd589caec15842269f0973e927
-
\??\c:\program files (x86)\windows defender\ja-jp\br.dllFilesize
802KB
MD5c34f756de2a700c3167fdacccd64a34a
SHA1d53037263cf25c9a144364027942640a93f6ae9d
SHA256fb9fd8b34b2f724caf687b7f350fbe6f9f46ef7395a98d9d644fb80e9b54fe4c
SHA5124b3512c4348cf06d04d4a172a21fa26c4feb65030de124bf11647b225518546343c6f46c5d705527b4a1b04e852bd4dbb7e796449c18ab590ded1cfebc516e1f
-
\??\pipe\crashpad_784_VFEAASMNWUZNQHLKMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/1120-153-0x0000000004480000-0x00000000045C0000-memory.dmpFilesize
1.2MB
-
memory/1120-149-0x0000000004480000-0x00000000045C0000-memory.dmpFilesize
1.2MB
-
memory/1120-152-0x0000000004480000-0x00000000045C0000-memory.dmpFilesize
1.2MB
-
memory/1120-142-0x0000000000000000-mapping.dmp
-
memory/1120-160-0x00000000062A0000-0x0000000006DE8000-memory.dmpFilesize
11.3MB
-
memory/1120-151-0x0000000004480000-0x00000000045C0000-memory.dmpFilesize
1.2MB
-
memory/1120-150-0x0000000004480000-0x00000000045C0000-memory.dmpFilesize
1.2MB
-
memory/1120-154-0x0000000004480000-0x00000000045C0000-memory.dmpFilesize
1.2MB
-
memory/1120-147-0x00000000062A0000-0x0000000006DE8000-memory.dmpFilesize
11.3MB
-
memory/1120-148-0x00000000062A0000-0x0000000006DE8000-memory.dmpFilesize
11.3MB
-
memory/2008-189-0x0000000000000000-mapping.dmp
-
memory/2308-166-0x0000000000400000-0x0000000000850000-memory.dmpFilesize
4.3MB
-
memory/2308-167-0x0000000000400000-0x0000000000850000-memory.dmpFilesize
4.3MB
-
memory/2308-165-0x0000000000A93000-0x0000000000AA9000-memory.dmpFilesize
88KB
-
memory/2356-158-0x0000000000DE0000-0x0000000001090000-memory.dmpFilesize
2.7MB
-
memory/2356-155-0x00007FF6A22F6890-mapping.dmp
-
memory/2356-161-0x000001AF60140000-0x000001AF60401000-memory.dmpFilesize
2.8MB
-
memory/2356-159-0x000001AF60140000-0x000001AF60401000-memory.dmpFilesize
2.8MB
-
memory/2356-157-0x000001AF61BB0000-0x000001AF61CF0000-memory.dmpFilesize
1.2MB
-
memory/2356-156-0x000001AF61BB0000-0x000001AF61CF0000-memory.dmpFilesize
1.2MB
-
memory/3160-193-0x0000000000000000-mapping.dmp
-
memory/3416-194-0x0000000000000000-mapping.dmp
-
memory/3852-198-0x0000000000000000-mapping.dmp
-
memory/3944-190-0x0000000000000000-mapping.dmp
-
memory/4064-146-0x0000000000400000-0x000000000092F000-memory.dmpFilesize
5.2MB
-
memory/4064-143-0x0000000000400000-0x000000000092F000-memory.dmpFilesize
5.2MB
-
memory/4064-141-0x0000000000C50000-0x0000000000D7F000-memory.dmpFilesize
1.2MB
-
memory/4064-140-0x0000000000B03000-0x0000000000BF0000-memory.dmpFilesize
948KB
-
memory/4064-137-0x0000000000000000-mapping.dmp
-
memory/4224-183-0x0000000004300000-0x0000000004E48000-memory.dmpFilesize
11.3MB
-
memory/4224-191-0x0000000004300000-0x0000000004E48000-memory.dmpFilesize
11.3MB
-
memory/4224-171-0x0000000004300000-0x0000000004E48000-memory.dmpFilesize
11.3MB
-
memory/4348-270-0x0000000000000000-mapping.dmp
-
memory/4484-187-0x0000000005230000-0x0000000005D78000-memory.dmpFilesize
11.3MB
-
memory/4484-188-0x0000000005230000-0x0000000005D78000-memory.dmpFilesize
11.3MB
-
memory/4484-192-0x0000000005230000-0x0000000005D78000-memory.dmpFilesize
11.3MB
-
memory/4484-181-0x0000000000000000-mapping.dmp
-
memory/4540-134-0x0000000000400000-0x0000000000850000-memory.dmpFilesize
4.3MB
-
memory/4540-133-0x00000000001F0000-0x00000000001F9000-memory.dmpFilesize
36KB
-
memory/4540-135-0x0000000000400000-0x0000000000850000-memory.dmpFilesize
4.3MB
-
memory/4540-132-0x0000000000AE2000-0x0000000000AF7000-memory.dmpFilesize
84KB
-
memory/4556-206-0x000001D4D3E70000-0x000001D4D3EB0000-memory.dmpFilesize
256KB
-
memory/4556-222-0x000001D4D3EF0000-0x000001D4D3F30000-memory.dmpFilesize
256KB
-
memory/4556-201-0x000001D4D3040000-0x000001D4D3080000-memory.dmpFilesize
256KB
-
memory/4556-203-0x000001D4D3100000-0x000001D4D3140000-memory.dmpFilesize
256KB
-
memory/4556-202-0x000001D4D30C0000-0x000001D4D3100000-memory.dmpFilesize
256KB
-
memory/4556-204-0x000001D4D3DB0000-0x000001D4D3DF0000-memory.dmpFilesize
256KB
-
memory/4556-205-0x000001D4D3DF0000-0x000001D4D3E30000-memory.dmpFilesize
256KB
-
memory/4556-207-0x000001D4D3EB0000-0x000001D4D3EF0000-memory.dmpFilesize
256KB
-
memory/4556-199-0x000001D4D22F0000-0x000001D4D2330000-memory.dmpFilesize
256KB
-
memory/4556-208-0x000001D4D3EF0000-0x000001D4D3F30000-memory.dmpFilesize
256KB
-
memory/4556-209-0x000001D4D3F70000-0x000001D4D3FB0000-memory.dmpFilesize
256KB
-
memory/4556-210-0x000001D4D3FB0000-0x000001D4D3FF0000-memory.dmpFilesize
256KB
-
memory/4556-211-0x000001D4D22F0000-0x000001D4D2330000-memory.dmpFilesize
256KB
-
memory/4556-212-0x000001D4D22F0000-0x000001D4D2330000-memory.dmpFilesize
256KB
-
memory/4556-213-0x000001D4D2330000-0x000001D4D2370000-memory.dmpFilesize
256KB
-
memory/4556-214-0x000001D4D3040000-0x000001D4D3080000-memory.dmpFilesize
256KB
-
memory/4556-215-0x000001D4D3080000-0x000001D4D30C0000-memory.dmpFilesize
256KB
-
memory/4556-216-0x000001D4D30C0000-0x000001D4D3100000-memory.dmpFilesize
256KB
-
memory/4556-217-0x000001D4D3100000-0x000001D4D3140000-memory.dmpFilesize
256KB
-
memory/4556-219-0x000001D4D3DB0000-0x000001D4D3DF0000-memory.dmpFilesize
256KB
-
memory/4556-218-0x000001D4D3D70000-0x000001D4D3DB0000-memory.dmpFilesize
256KB
-
memory/4556-220-0x000001D4D3E70000-0x000001D4D3EB0000-memory.dmpFilesize
256KB
-
memory/4556-221-0x000001D4D3EB0000-0x000001D4D3EF0000-memory.dmpFilesize
256KB
-
memory/4556-200-0x000001D4D2330000-0x000001D4D2370000-memory.dmpFilesize
256KB
-
memory/4556-223-0x000001D4D3F70000-0x000001D4D3FB0000-memory.dmpFilesize
256KB
-
memory/4556-224-0x000001D4D3FB0000-0x000001D4D3FF0000-memory.dmpFilesize
256KB
-
memory/4556-225-0x000001D4D22F0000-0x000001D4D2330000-memory.dmpFilesize
256KB
-
memory/4556-226-0x000001D4D22F0000-0x000001D4D2330000-memory.dmpFilesize
256KB
-
memory/4556-227-0x000001D4D22F0000-0x000001D4D2330000-memory.dmpFilesize
256KB
-
memory/4556-228-0x000001D4D22F0000-0x000001D4D2330000-memory.dmpFilesize
256KB
-
memory/4556-229-0x000001D4D22F0000-0x000001D4D2330000-memory.dmpFilesize
256KB
-
memory/4556-230-0x000001D4D22F0000-0x000001D4D2330000-memory.dmpFilesize
256KB
-
memory/4556-231-0x000001D4D22F0000-0x000001D4D2330000-memory.dmpFilesize
256KB
-
memory/4556-232-0x000001D4D22F0000-0x000001D4D2330000-memory.dmpFilesize
256KB
-
memory/4556-233-0x000001D4D2330000-0x000001D4D2370000-memory.dmpFilesize
256KB
-
memory/4556-235-0x000001D4D3960000-0x000001D4D39A0000-memory.dmpFilesize
256KB
-
memory/4556-234-0x000001D4D3BC0000-0x000001D4D3C00000-memory.dmpFilesize
256KB
-
memory/4556-236-0x000001D4D22F0000-0x000001D4D2330000-memory.dmpFilesize
256KB
-
memory/4556-237-0x000001D4D39E0000-0x000001D4D3A20000-memory.dmpFilesize
256KB
-
memory/4556-238-0x000001D4D3B80000-0x000001D4D3BC0000-memory.dmpFilesize
256KB
-
memory/4556-239-0x000001D4D3A60000-0x000001D4D3AA0000-memory.dmpFilesize
256KB
-
memory/4556-240-0x000001D4D3AE0000-0x000001D4D3B20000-memory.dmpFilesize
256KB
-
memory/4556-241-0x000001D4D4D20000-0x000001D4D4D60000-memory.dmpFilesize
256KB
-
memory/4556-242-0x000001D4D4BD0000-0x000001D4D4C10000-memory.dmpFilesize
256KB
-
memory/4556-196-0x0000000000000000-mapping.dmp