hxxps://drive[.]google[.]com/uc?id=1cftqZwMjx3KPo1xvuOaPBeO3QVZYxza9

Analysis

max time kernel
557s
max time network
551s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 08:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/uc?id=1cftqZwMjx3KPo1xvuOaPBeO3QVZYxza9

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 64 IoCs

Processes:

ChromeRecovery.exedxwebsetup.exedxwsetup.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exe

pid	process
5004	ChromeRecovery.exe
2980	dxwebsetup.exe
4944	dxwsetup.exe
2460	infinst.exe
3456	infinst.exe
3208	infinst.exe
3080	infinst.exe
4484	infinst.exe
1336	infinst.exe
4736	infinst.exe
3572	infinst.exe
4464	infinst.exe
4168	infinst.exe
4420	infinst.exe
2420	infinst.exe
3516	infinst.exe
3984	infinst.exe
224	infinst.exe
2364	infinst.exe
2704	infinst.exe
5036	infinst.exe
1860	infinst.exe
1112	infinst.exe
4976	infinst.exe
3976	infinst.exe
4092	infinst.exe
5060	infinst.exe
4376	infinst.exe
3692	infinst.exe
1068	infinst.exe
4672	infinst.exe
3616	infinst.exe
3992	infinst.exe
1640	infinst.exe
4160	infinst.exe
4528	infinst.exe
1404	infinst.exe
1960	infinst.exe
1420	infinst.exe
2324	infinst.exe
3180	infinst.exe
1200	infinst.exe
4216	infinst.exe
1060	infinst.exe
4792	infinst.exe
4064	infinst.exe
3284	infinst.exe
2516	infinst.exe
2044	infinst.exe
3832	infinst.exe
1144	infinst.exe
748	infinst.exe
2252	infinst.exe
2460	infinst.exe
3456	infinst.exe
4848	infinst.exe
3904	infinst.exe
1728	infinst.exe
2268	infinst.exe
4084	infinst.exe
1132	infinst.exe
2228	infinst.exe
3568	infinst.exe
1504	infinst.exe

Registers COM server for autorun 1 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

regsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3a2495ce-31d0-435b-8ccf-e9f0843fd960}\InProcServer32\ = "C:\\Windows\\system32\\xactengine2_6.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c1e3f122-a2ea-442c-854f-20d98f8357a1}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f4769300-b949-4df9-b333-00d33932e9a6}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_1.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8bb7778b-645b-4475-9a73-1de3170bd3af}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4c9b6dde-6809-46e6-a278-9b6a97588670}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_5.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6f6ea3a9-2cf5-41cf-91c1-2170b1540063}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{074b110f-7f58-4743-aea5-12f15b5074ed}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3a2495ce-31d0-435b-8ccf-e9f0843fd960}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{94c1affa-66e7-4961-9521-cfdef3128d4f}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{94c1affa-66e7-4961-9521-cfdef3128d4f}\InProcServer32\ = "C:\\Windows\\system32\\xactengine3_3.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9cab402c-1d37-44b4-886d-fa4f36170a4c}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0977d092-2d95-4e43-8d42-9ddcc2545ed5}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5a508685-a254-4fba-9b82-9a24b00306af}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cd0d66ec-8057-43f5-acbd-66dfb36fd78c}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c0c56f46-29b1-44e9-9939-a32ce86867e2}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_0.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c1e3f122-a2ea-442c-854f-20d98f8357a1}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_1.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4c9b6dde-6809-46e6-a278-9b6a97588670}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3eda9b49-2085-498b-9bb2-39a6778493de}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{962f5027-99be-4692-a468-85802cf8de61}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f5ca7b34-8055-42c0-b836-216129eb7e30}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d06df0d0-8518-441e-822f-5451d5c595b8}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_5.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5a508685-a254-4fba-9b82-9a24b00306af}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6a93130e-1d53-41d1-a9cf-e758800bb179}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f1b577e-5e5a-4e8a-ba73-c657ea8e8598}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1138472b-d187-44e9-81f2-ae1b0e7785f1}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{bc3e0fc6-2e0d-4c45-bc61-d9c328319bd8}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cd0d66ec-8057-43f5-acbd-66dfb36fd78c}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cac1105f-619b-4d04-831a-44e1cbf12d57}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{94c1affa-66e7-4961-9521-cfdef3128d4f}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8bb7778b-645b-4475-9a73-1de3170bd3af}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{248d8a3b-6256-44d3-a018-2ac96c459f47}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cecec95a-d894-491a-bee3-5e106fb59f2d}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_6.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{bc3e0fc6-2e0d-4c45-bc61-d9c328319bd8}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{bc3e0fc6-2e0d-4c45-bc61-d9c328319bd8}\InProcServer32\ = "C:\\Windows\\system32\\xactengine2_4.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{54b68bc7-3a45-416b-a8c9-19bf19ec1df5}\InProcServer32\ = "C:\\Windows\\system32\\xactengine2_5.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{fac23f48-31f5-45a8-b49b-5225d61401aa}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_0.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c0c56f46-29b1-44e9-9939-a32ce86867e2}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{629cf0de-3ecc-41e7-9926-f7e43eebec51}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4c9b6dde-6809-46e6-a278-9b6a97588670}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e48c5a3f-93ef-43bb-a092-2c7ceb946f27}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cecec95a-d894-491a-bee3-5e106fb59f2d}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{bcc782bc-6492-4c22-8c35-f5d72fe73c6e}\InProcServer32\ = "C:\\Windows\\system32\\xactengine3_7.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5a508685-a254-4fba-9b82-9a24b00306af}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_7.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6a93130e-1d53-41d1-a9cf-e758800bb179}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f1b577e-5e5a-4e8a-ba73-c657ea8e8598}\InProcServer32\ = "C:\\Windows\\system32\\xactengine2_1.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{77c56bf4-18a1-42b0-88af-5072ce814949}\InProcServer32\ = "C:\\Windows\\system32\\xactengine2_8.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e21a7345-eb21-468e-be50-804db97cf708}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_1.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e180344b-ac83-4483-959e-18a5c56a5e19}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_3.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03219e78-5bc3-44d1-b92e-f63d89cc6526}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cd0d66ec-8057-43f5-acbd-66dfb36fd78c}\InProcServer32\ = "C:\\Windows\\system32\\xactengine2_7.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9cab402c-1d37-44b4-886d-fa4f36170a4c}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_3.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{65d822a4-4799-42c6-9b18-d26cf66dd320}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{65d822a4-4799-42c6-9b18-d26cf66dd320}\InProcServer32\ = "C:\\Windows\\system32\\xactengine2_10.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3332f02-3dd0-4de9-9aec-20d85c4111b6}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{248d8a3b-6256-44d3-a018-2ac96c459f47}\InProcServer32\ = "C:\\Windows\\system32\\xactengine3_6.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2139e6da-c341-4774-9ac3-b4e026347f64}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3eda9b49-2085-498b-9bb2-39a6778493de}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_6.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c60fae90-4183-4a3f-b2f7-ac1dc49b0e5c}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{77c56bf4-18a1-42b0-88af-5072ce814949}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{b802058a-464a-42db-bc10-b650d6f2586a}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c7338b95-52b8-4542-aa79-42eb016c8c1c}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_4.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{074b110f-7f58-4743-aea5-12f15b5074ed}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{b802058a-464a-42db-bc10-b650d6f2586a}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_2.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f5ca7b34-8055-42c0-b836-216129eb7e30}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_2.dll"	regsvr32.exe

Loads dropped DLL 64 IoCs

Processes:

dxwsetup.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exe

pid	process
4944	dxwsetup.exe
4944	dxwsetup.exe
4944	dxwsetup.exe
4944	dxwsetup.exe
4944	dxwsetup.exe
4944	dxwsetup.exe
4944	dxwsetup.exe
4944	dxwsetup.exe
4944	dxwsetup.exe
4944	dxwsetup.exe
4944	dxwsetup.exe
4944	dxwsetup.exe
4944	dxwsetup.exe
4944	dxwsetup.exe
4944	dxwsetup.exe
4944	dxwsetup.exe
4944	dxwsetup.exe
4944	dxwsetup.exe
4944	dxwsetup.exe
4944	dxwsetup.exe
4944	dxwsetup.exe
4944	dxwsetup.exe
4944	dxwsetup.exe
4944	dxwsetup.exe
4944	dxwsetup.exe
4944	dxwsetup.exe
4944	dxwsetup.exe
2348	regsvr32.exe
4944	dxwsetup.exe
4944	dxwsetup.exe
4944	dxwsetup.exe
4944	dxwsetup.exe
4944	dxwsetup.exe
4944	dxwsetup.exe
4944	dxwsetup.exe
4944	dxwsetup.exe
4944	dxwsetup.exe
4944	dxwsetup.exe
4944	dxwsetup.exe
4944	dxwsetup.exe
4944	dxwsetup.exe
4944	dxwsetup.exe
4944	dxwsetup.exe
4944	dxwsetup.exe
4944	dxwsetup.exe
4944	dxwsetup.exe
4944	dxwsetup.exe
1440	regsvr32.exe
4944	dxwsetup.exe
1516	regsvr32.exe
4944	dxwsetup.exe
1560	regsvr32.exe
1560	regsvr32.exe
4944	dxwsetup.exe
516	regsvr32.exe
516	regsvr32.exe
4944	dxwsetup.exe
2100	regsvr32.exe
4944	dxwsetup.exe
4492	regsvr32.exe
4944	dxwsetup.exe
3492	regsvr32.exe
4944	dxwsetup.exe
1108	regsvr32.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

dxwebsetup.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	dxwebsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	dxwebsetup.exe

Drops desktop.ini file(s) 2 IoCs

Processes:

dxwsetup.exe

description ioc process

File created C:\Windows\assembly\Desktop.ini dxwsetup.exe
File opened for modification C:\Windows\assembly\Desktop.ini dxwsetup.exe

description	ioc	process
File created	C:\Windows\assembly\Desktop.ini	dxwsetup.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	dxwsetup.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

dxwsetup.exe

description	ioc	process
File opened (read-only)	\??\E:	dxwsetup.exe
File opened (read-only)	\??\K:	dxwsetup.exe
File opened (read-only)	\??\M:	dxwsetup.exe
File opened (read-only)	\??\N:	dxwsetup.exe
File opened (read-only)	\??\O:	dxwsetup.exe
File opened (read-only)	\??\X:	dxwsetup.exe
File opened (read-only)	\??\T:	dxwsetup.exe
File opened (read-only)	\??\V:	dxwsetup.exe
File opened (read-only)	\??\B:	dxwsetup.exe
File opened (read-only)	\??\G:	dxwsetup.exe
File opened (read-only)	\??\L:	dxwsetup.exe
File opened (read-only)	\??\Q:	dxwsetup.exe
File opened (read-only)	\??\R:	dxwsetup.exe
File opened (read-only)	\??\S:	dxwsetup.exe
File opened (read-only)	\??\W:	dxwsetup.exe
File opened (read-only)	\??\A:	dxwsetup.exe
File opened (read-only)	\??\F:	dxwsetup.exe
File opened (read-only)	\??\I:	dxwsetup.exe
File opened (read-only)	\??\P:	dxwsetup.exe
File opened (read-only)	\??\H:	dxwsetup.exe
File opened (read-only)	\??\J:	dxwsetup.exe
File opened (read-only)	\??\U:	dxwsetup.exe
File opened (read-only)	\??\Y:	dxwsetup.exe
File opened (read-only)	\??\Z:	dxwsetup.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in System32 directory 64 IoCs

Processes:

dxwsetup.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exe

description	ioc	process
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Apr2006_xact_x86.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Aug2008_d3dx9_39_x64.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Jun2010_xact_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\xactengine2_2.dll	dxwsetup.exe
File opened for modification	C:\Windows\system32\xinput1_3.dll	infinst.exe
File created	C:\Windows\SysWOW64\SETAD45.tmp	dxwsetup.exe
File opened for modification	C:\Windows\system32\SETAFE5.tmp	infinst.exe
File opened for modification	C:\Windows\system32\SETBF75.tmp	infinst.exe
File created	C:\Windows\SysWOW64\SET8086.tmp	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\SET81D1.tmp	dxwsetup.exe
File opened for modification	C:\Windows\system32\SET8DB7.tmp	infinst.exe
File created	C:\Windows\system32\SET8E63.tmp	infinst.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Dec2005_d3dx9_28_x86.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Feb2007_xact_x64.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Mar2008_xact_x86.cab	dxwsetup.exe
File created	C:\Windows\system32\SET84CE.tmp	infinst.exe
File opened for modification	C:\Windows\SysWOW64\d3dx10_38.dll	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\SETA9E5.tmp	dxwsetup.exe
File opened for modification	C:\Windows\system32\D3DX9_42.dll	infinst.exe
File created	C:\Windows\system32\SETBE6C.tmp	infinst.exe
File opened for modification	C:\Windows\SysWOW64\directx\websetup\SET1286.tmp	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\d3dx9_30.dll	dxwsetup.exe
File opened for modification	C:\Windows\system32\SET7DAA.tmp	infinst.exe
File created	C:\Windows\system32\SET825E.tmp	infinst.exe
File opened for modification	C:\Windows\SysWOW64\xactengine2_7.dll	dxwsetup.exe
File opened for modification	C:\Windows\system32\SET8E63.tmp	infinst.exe
File opened for modification	C:\Windows\system32\D3DX9_39.dll	infinst.exe
File opened for modification	C:\Windows\system32\D3DX9_40.dll	infinst.exe
File opened for modification	C:\Windows\system32\SETB93C.tmp	infinst.exe
File created	C:\Windows\system32\SETBF86.tmp	infinst.exe
File created	C:\Windows\system32\SETCB9B.tmp	infinst.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Aug2005_d3dx9_27_x86.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Apr2007_xact_x64.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Feb2010_xaudio_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\SET78DF.tmp	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\xactengine2_6.dll	dxwsetup.exe
File opened for modification	C:\Windows\system32\SET8ABA.tmp	infinst.exe
File created	C:\Windows\system32\SET8B75.tmp	infinst.exe
File opened for modification	C:\Windows\SysWOW64\SETC24E.tmp	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\DirectX\WebSetup	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Feb2005_d3dx9_24_x86.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Apr2005_d3dx9_25_x86.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Feb2007_xact_x86.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Mar2008_xaudio_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\system32\d3dx9_31.dll	infinst.exe
File created	C:\Windows\SysWOW64\SET8E25.tmp	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\SET8E26.tmp	dxwsetup.exe
File opened for modification	C:\Windows\system32\XAPOFX1_1.dll	infinst.exe
File opened for modification	C:\Windows\system32\SETBF86.tmp	infinst.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\MDX_1.0.2903.0_x86.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\SET9DF1.tmp	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\SETB3F5.tmp	dxwsetup.exe
File opened for modification	C:\Windows\system32\X3DAudio1_7.dll	infinst.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Jun2007_d3dx10_34_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\system32\SET7C23.tmp	infinst.exe
File opened for modification	C:\Windows\system32\SET856A.tmp	infinst.exe
File created	C:\Windows\system32\SETA035.tmp	infinst.exe
File created	C:\Windows\system32\SETB40C.tmp	infinst.exe
File created	C:\Windows\SysWOW64\SETB4E1.tmp	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Apr2006_xinput_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\SET8D49.tmp	dxwsetup.exe
File created	C:\Windows\system32\SETA92E.tmp	infinst.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Aug2006_xact_x64.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Jun2008_d3dx9_38_x64.cab	dxwsetup.exe

Drops file in Program Files directory 7 IoCs

Processes:

elevation_service.exe

description	ioc	process
File created	C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir3144_871166837\ChromeRecoveryCRX.crx	elevation_service.exe
File created	C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir3144_871166837\ChromeRecovery.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir3144_871166837\ChromeRecovery.exe	elevation_service.exe
File created	C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir3144_871166837\manifest.json	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir3144_871166837\manifest.json	elevation_service.exe
File created	C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir3144_871166837\_metadata\verified_contents.json	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir3144_871166837\_metadata\verified_contents.json	elevation_service.exe

Drops file in Windows directory 64 IoCs

Processes:

dxwsetup.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exeinfinst.exe

description	ioc	process
File created	C:\Windows\msdownld.tmp\AS5D3CA4.tmp\Oct2006_xact_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5D4D6D.tmp\Apr2007_d3dx10_33_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5D5C61.tmp	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS5DA198.tmp\Nov2008_xaudio_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5DD7DB.tmp\Aug2009_xaudio_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe
File created	C:\Windows\msdownld.tmp\AS5D1B51.tmp\Aug2005_d3dx9_27_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5D73C2.tmp	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5D820A.tmp\Mar2008_xaudio_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5DA198.tmp\Nov2008_xaudio_x86.cab	dxwsetup.exe
File created	C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2909.0\Microsoft.DirectX.Direct3DX.dll	dxwsetup.exe
File created	C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.xml	dxwsetup.exe
File opened for modification	C:\Windows\DirectX.log	infinst.exe
File created	C:\Windows\msdownld.tmp\AS5CF078.tmp\Aug2009_d3dx10_42_x86.cab	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS5D50D8.tmp\Apr2007_xact_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5DA07F.tmp\Nov2008_xact_x86.cab	dxwsetup.exe
File created	C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.Diagnostics.xml	dxwsetup.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5D3234.tmp	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS5DBC73.tmp\Mar2009_x3daudio_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5DDBA3.tmp\Feb2010_xact_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5DDE53.tmp	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5DFC6A.tmp\MDX_1.0.2909.0_x86.cab	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS5DFDB2.tmp\MDX_1.0.2910.0_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5D6F3D.tmp\Nov2007_d3dx10_36_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5CB583.tmp\Aug2007_d3dx10_35_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe
File created	C:\Windows\msdownld.tmp\AS5C8991.tmp\Apr2006_d3dx9_30_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5D25D1.tmp	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS5D7F3B.tmp\Mar2008_x3daudio_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5DEAF5.tmp	dxwsetup.exe
File opened for modification	C:\Windows\assembly\tmp\TUHHWS6X\__AssemblyInfo__.ini	dxwsetup.exe
File opened for modification	C:\Windows\DirectX.log	infinst.exe
File opened for modification	C:\Windows\DirectX.log	infinst.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5C6B3B.tmp\Apr2007_xinput_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5D6867.tmp	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS5CABBF.tmp\Jun2007_d3dx10_34_x86.cab	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS5CFD78.tmp\Aug2009_D3DCompiler_42_x86.cab	dxwsetup.exe
File created	C:\Windows\assembly\Desktop.ini	dxwsetup.exe
File created	C:\Windows\assembly\tmp\CHK3J92E\Microsoft.DirectX.dll	dxwsetup.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe
File created	C:\Windows\msdownld.tmp\AS5CDB3B.tmp\Nov2008_d3dx9_40_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5D33DA.tmp\Jun2006_xact_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5D8100.tmp\Mar2008_xaudio_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5D9C87.tmp	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5DAF92.tmp	dxwsetup.exe
File created	C:\Windows\assembly\tmp\3MZSQYLG\Microsoft.DirectX.Direct3DX.dll	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS5C8E34.tmp\Oct2006_d3dx9_31_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5D3CA4.tmp	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5D582B.tmp	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS5D9E6C.tmp\Aug2008_xaudio_x64.cab	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS5DEBEF.tmp\Jun2010_xaudio_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe
File created	C:\Windows\msdownld.tmp\AS5CE0B9.tmp\Nov2008_d3dx10_40_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5D72B8.tmp\Nov2007_x3daudio_x64.cab	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS5D7EBE.tmp\Mar2008_x3daudio_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\assembly\tmp\EPP8DOA9\__AssemblyInfo__.ini	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5D2B6E.tmp\Feb2006_xact_x64.cab	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS5D9D33.tmp\Aug2008_xaudio_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5D9E6C.tmp	dxwsetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vssvc.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000045e03923b2b2bc3e0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000045e039230000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3f000000ffffffff00000000070001000068090045e03923000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000045e0392300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000045e0392300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exechrome.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 64 IoCs

Processes:

regsvr32.exedxwsetup.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cac1105f-619b-4d04-831a-44e1cbf12d57}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3332f02-3dd0-4de9-9aec-20d85c4111b6}\InProcServer32\ = "C:\\Windows\\SysWow64\\xactengine3_2.dll"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3eda9b49-2085-498b-9bb2-39a6778493de}\InProcServer32\ = "C:\\Windows\\SysWow64\\XAudio2_6.dll"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{94c1affa-66e7-4961-9521-cfdef3128d4f}\InProcServer32\ = "C:\\Windows\\system32\\xactengine3_3.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e48c5a3f-93ef-43bb-a092-2c7ceb946f27}\InProcServer32	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{c7338b95-52b8-4542-aa79-42eb016c8c1c}	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{074b110f-7f58-4743-aea5-12f15b5074ed}\InProcServer32	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3eda9b49-2085-498b-9bb2-39a6778493de}\InProcServer32	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3a2495ce-31d0-435b-8ccf-e9f0843fd960}\InProcServer32\ = "C:\\Windows\\SysWow64\\xactengine2_6.dll"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5a508685-a254-4fba-9b82-9a24b00306af}\InProcServer32\ = "C:\\Windows\\SysWow64\\XAudio2_7.dll"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f5ca7b34-8055-42c0-b836-216129eb7e30}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_2.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4c5e637a-16c7-4de3-9c46-5ed22181962d}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_3.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c60fae90-4183-4a3f-b2f7-ac1dc49b0e5c}\ = "XACT Engine"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e180344b-ac83-4483-959e-18a5c56a5e19}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8bb7778b-645b-4475-9a73-1de3170bd3af}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_4.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{bcc782bc-6492-4c22-8c35-f5d72fe73c6e}\ = "XACT Engine"	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6a93130e-1d53-41d1-a9cf-e758800bb179}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{629cf0de-3ecc-41e7-9926-f7e43eebec51}\InProcServer32	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8bb7778b-645b-4475-9a73-1de3170bd3af}\ = "AudioReverb"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{77c56bf4-18a1-42b0-88af-5072ce814949}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{962f5027-99be-4692-a468-85802cf8de61}	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{629cf0de-3ecc-41e7-9926-f7e43eebec51}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_2.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e21a7345-eb21-468e-be50-804db97cf708}\InProcServer32\ThreadingModel = "Both"	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{bcc782bc-6492-4c22-8c35-f5d72fe73c6e}	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0aa000aa-f404-11d9-bd7a-0010dc4f8f81}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3a2495ce-31d0-435b-8ccf-e9f0843fd960}\InProcServer32	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{54b68bc7-3a45-416b-a8c9-19bf19ec1df5}\ = "XACT Engine"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f4769300-b949-4df9-b333-00d33932e9a6}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8bb7778b-645b-4475-9a73-1de3170bd3af}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248d8a3b-6256-44d3-a018-2ac96c459f47}	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3eda9b49-2085-498b-9bb2-39a6778493de}\ = "XAudio2"	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{94c1affa-66e7-4961-9521-cfdef3128d4f}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8bb7778b-645b-4475-9a73-1de3170bd3af}\InProcServer32\ThreadingModel = "Both"	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{b802058a-464a-42db-bc10-b650d6f2586a}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8bb7778b-645b-4475-9a73-1de3170bd3af}	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{074b110f-7f58-4743-aea5-12f15b5074ed}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5a508685-a254-4fba-9b82-9a24b00306af}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0aa000aa-f404-11d9-bd7a-0010dc4f8f81}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{629cf0de-3ecc-41e7-9926-f7e43eebec51}\InProcServer32\ = "C:\\Windows\\SysWow64\\XAudio2_2.dll"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6f6ea3a9-2cf5-41cf-91c1-2170b1540063}\ = "AudioReverb"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{248d8a3b-6256-44d3-a018-2ac96c459f47}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5a508685-a254-4fba-9b82-9a24b00306af}\ = "XAudio2"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0aa000aa-f404-11d9-bd7a-0010dc4f8f81}\InProcServer32\ThreadingModel = "Both"	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3a2495ce-31d0-435b-8ccf-e9f0843fd960}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3332f02-3dd0-4de9-9aec-20d85c4111b6}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f1b577e-5e5a-4e8a-ba73-c657ea8e8598}\ = "XACT Engine"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3eda9b49-2085-498b-9bb2-39a6778493de}\ = "XAudio2"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3a2495ce-31d0-435b-8ccf-e9f0843fd960}\ = "XACT Engine"	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6f6ea3a9-2cf5-41cf-91c1-2170b1540063}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{962f5027-99be-4692-a468-85802cf8de61}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{343e68e6-8f82-4a8d-a2da-6e9a944b378c}	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{54b68bc7-3a45-416b-a8c9-19bf19ec1df5}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e180344b-ac83-4483-959e-18a5c56a5e19}\InProcServer32	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4c5e637a-16c7-4de3-9c46-5ed22181962d}\ = "XAudio2"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3a2495ce-31d0-435b-8ccf-e9f0843fd960}\InProcServer32\ThreadingModel = "Both"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3b80ee2a-b0f5-4780-9e30-90cb39685b03}\InProcServer32\ThreadingModel = "Both"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{962f5027-99be-4692-a468-85802cf8de61}\ = "XACT Engine"	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{629cf0de-3ecc-41e7-9926-f7e43eebec51}	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4c9b6dde-6809-46e6-a278-9b6a97588670}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_5.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{bc3e0fc6-2e0d-4c45-bc61-d9c328319bd8}\InProcServer32\ThreadingModel = "Both"	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e21a7345-eb21-468e-be50-804db97cf708}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{cecec95a-d894-491a-bee3-5e106fb59f2d}\ = "AudioReverb"	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3eda9b49-2085-498b-9bb2-39a6778493de}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{65d822a4-4799-42c6-9b18-d26cf66dd320}\ = "XACT Engine"	dxwsetup.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

Processes:

chrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exe

pid	process
516	chrome.exe
516	chrome.exe
2952	chrome.exe
2952	chrome.exe
1940	chrome.exe
1940	chrome.exe
4048	chrome.exe
4048	chrome.exe
4532	chrome.exe
4532	chrome.exe
1204	chrome.exe
1204	chrome.exe
1508	chrome.exe
1508	chrome.exe
516	chrome.exe
516	chrome.exe
4780	chrome.exe
4780	chrome.exe
4972	chrome.exe
4972	chrome.exe
524	chrome.exe
524	chrome.exe
1484	chrome.exe
1484	chrome.exe
3760	chrome.exe
3760	chrome.exe
2164	chrome.exe
2164	chrome.exe
2736	chrome.exe
2736	chrome.exe
2736	chrome.exe
2736	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

Processes:

chrome.exechrome.exe

pid	process
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe
4780	chrome.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

Processes:

vssvc.exesrtasks.exe

description	pid	process
Token: SeBackupPrivilege	2560	vssvc.exe
Token: SeRestorePrivilege	2560	vssvc.exe
Token: SeAuditPrivilege	2560	vssvc.exe
Token: SeBackupPrivilege	4196	srtasks.exe
Token: SeRestorePrivilege	4196	srtasks.exe
Token: SeSecurityPrivilege	4196	srtasks.exe
Token: SeTakeOwnershipPrivilege	4196	srtasks.exe
Token: SeBackupPrivilege	4196	srtasks.exe
Token: SeRestorePrivilege	4196	srtasks.exe
Token: SeSecurityPrivilege	4196	srtasks.exe
Token: SeTakeOwnershipPrivilege	4196	srtasks.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

chrome.exe

pid	process
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe
2952	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 2952 wrote to memory of 1796	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 1796	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 2516	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 2516	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 2516	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 2516	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 2516	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 2516	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 2516	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 2516	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 2516	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 2516	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 2516	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 2516	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 2516	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 2516	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 2516	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 2516	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 2516	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 2516	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 2516	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 2516	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 2516	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 2516	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 2516	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 2516	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 2516	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 2516	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 2516	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 2516	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 2516	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 2516	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 2516	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 2516	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 2516	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 2516	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 2516	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 2516	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 2516	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 2516	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 2516	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 2516	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 516	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 516	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 3804	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 3804	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 3804	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 3804	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 3804	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 3804	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 3804	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 3804	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 3804	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 3804	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 3804	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 3804	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 3804	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 3804	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 3804	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 3804	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 3804	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 3804	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 3804	2952	chrome.exe	chrome.exe
PID 2952 wrote to memory of 3804	2952	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" https://drive.google.com/uc?id=1cftqZwMjx3KPo1xvuOaPBeO3QVZYxza9
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2952

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe1a3d4f50,0x7ffe1a3d4f60,0x7ffe1a3d4f70
2⤵
PID:1796

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1644,15257866929709585495,1627901948093630768,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1632 /prefetch:2
2⤵
PID:2516

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1644,15257866929709585495,1627901948093630768,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1632 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:516

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1644,15257866929709585495,1627901948093630768,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2344 /prefetch:8
2⤵
PID:3804

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,15257866929709585495,1627901948093630768,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3040 /prefetch:1
2⤵
PID:3508

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,15257866929709585495,1627901948093630768,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3020 /prefetch:1
2⤵
PID:3004

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,15257866929709585495,1627901948093630768,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4236 /prefetch:8
2⤵
PID:2072

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,15257866929709585495,1627901948093630768,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4436 /prefetch:1
2⤵
PID:4692

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1644,15257866929709585495,1627901948093630768,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5104 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1940

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1644,15257866929709585495,1627901948093630768,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5292 /prefetch:8
2⤵
PID:3860

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,15257866929709585495,1627901948093630768,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5368 /prefetch:8
2⤵
PID:3164

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1644,15257866929709585495,1627901948093630768,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4048

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1644,15257866929709585495,1627901948093630768,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4272 /prefetch:8
2⤵
PID:2716

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,15257866929709585495,1627901948093630768,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3252 /prefetch:8
2⤵
PID:1564

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1644,15257866929709585495,1627901948093630768,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4744 /prefetch:8
2⤵
PID:4208

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,15257866929709585495,1627901948093630768,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4252 /prefetch:1
2⤵
PID:2680

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1644,15257866929709585495,1627901948093630768,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4384 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4532

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1644,15257866929709585495,1627901948093630768,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5504 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1204

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,15257866929709585495,1627901948093630768,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4308 /prefetch:8
2⤵
PID:5096

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1644,15257866929709585495,1627901948093630768,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4620 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1508

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1644,15257866929709585495,1627901948093630768,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5292 /prefetch:8
2⤵
PID:3776

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1644,15257866929709585495,1627901948093630768,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2108 /prefetch:8
2⤵
PID:5040

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:380

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5100

C:\Users\Admin\Desktop\SDT2 0.1.0\SDT2.exe
"C:\Users\Admin\Desktop\SDT2 0.1.0\SDT2.exe"
1⤵
PID:3952

C:\Users\Admin\Desktop\SDT2 0.1.0\SDT2.exe
"C:\Users\Admin\Desktop\SDT2 0.1.0\SDT2.exe"
1⤵
PID:4544

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:4780

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffe1a3d4f50,0x7ffe1a3d4f60,0x7ffe1a3d4f70
2⤵
PID:4888

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1636,16714106840033332038,10191314340082784356,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1656 /prefetch:2
2⤵
PID:5048

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1636,16714106840033332038,10191314340082784356,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1804 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:516

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,16714106840033332038,10191314340082784356,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2560 /prefetch:1
2⤵
PID:3180

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1636,16714106840033332038,10191314340082784356,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
2⤵
PID:2704

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,16714106840033332038,10191314340082784356,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2552 /prefetch:1
2⤵
PID:2964

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,16714106840033332038,10191314340082784356,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
2⤵
PID:3688

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,16714106840033332038,10191314340082784356,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4396 /prefetch:8
2⤵
PID:432

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,16714106840033332038,10191314340082784356,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4388 /prefetch:8
2⤵
PID:836

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,16714106840033332038,10191314340082784356,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4516 /prefetch:8
2⤵
PID:3316

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,16714106840033332038,10191314340082784356,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4520 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4972

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,16714106840033332038,10191314340082784356,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4808 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:524

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,16714106840033332038,10191314340082784356,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5032 /prefetch:8
2⤵
PID:3300

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,16714106840033332038,10191314340082784356,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:1
2⤵
PID:2852

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,16714106840033332038,10191314340082784356,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2780 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1484

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,16714106840033332038,10191314340082784356,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2324 /prefetch:1
2⤵
PID:2204

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,16714106840033332038,10191314340082784356,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3544 /prefetch:1
2⤵
PID:732

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,16714106840033332038,10191314340082784356,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3556 /prefetch:1
2⤵
PID:4728

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,16714106840033332038,10191314340082784356,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2984 /prefetch:1
2⤵
PID:4872

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,16714106840033332038,10191314340082784356,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
2⤵
PID:2232

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,16714106840033332038,10191314340082784356,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4340 /prefetch:1
2⤵
PID:2664

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,16714106840033332038,10191314340082784356,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3544 /prefetch:1
2⤵
PID:1844

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1636,16714106840033332038,10191314340082784356,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5196 /prefetch:8
2⤵
PID:3724

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1636,16714106840033332038,10191314340082784356,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5164 /prefetch:8
2⤵
PID:3396

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,16714106840033332038,10191314340082784356,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5476 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3760

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,16714106840033332038,10191314340082784356,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
2⤵
PID:1444

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1636,16714106840033332038,10191314340082784356,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5380 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2164

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1636,16714106840033332038,10191314340082784356,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5328 /prefetch:8
2⤵
PID:5056

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1636,16714106840033332038,10191314340082784356,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5172 /prefetch:8
2⤵
PID:1916

C:\Users\Admin\Downloads\dxwebsetup.exe
"C:\Users\Admin\Downloads\dxwebsetup.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2980

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
PID:4944

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe d3dx9_24_x64.inf
4⤵
- Executes dropped EXE
PID:2460

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe d3dx9_25_x64.inf
4⤵
- Executes dropped EXE
PID:3456

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe d3dx9_26_x64.inf
4⤵
- Executes dropped EXE
PID:3208

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe d3dx9_27_x64.inf
4⤵
- Executes dropped EXE
PID:3080

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe d3dx9_28_x64.inf
4⤵
- Executes dropped EXE
PID:4484

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe d3dx9_29_x64.inf
4⤵
- Executes dropped EXE
PID:1336

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe XACT_x64.inf
4⤵
- Executes dropped EXE
PID:4736

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_0.dll
4⤵
- Loads dropped DLL
- Modifies registry class
PID:2348

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe d3dx9_30_x64.inf
4⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3572

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe XACT2_1_x64.inf
4⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4464

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_1.dll
4⤵
- Registers COM server for autorun
- Loads dropped DLL
PID:1440

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe xinput1_1_x64.inf, Install_Driver
4⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4168

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe XACT2_2_x64.inf
4⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4420

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_2.dll
4⤵
- Registers COM server for autorun
- Loads dropped DLL
- Modifies registry class
PID:1516

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe xinput1_2_x64.inf, Install_Driver
4⤵
- Executes dropped EXE
PID:2420

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe XACT2_3_x64.inf
4⤵
- Executes dropped EXE
PID:3516

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_3.dll
4⤵
- Registers COM server for autorun
- Loads dropped DLL
PID:1560

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe d3dx9_31_x64.inf
4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3984

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe XACT2_4_x64.inf
4⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:224

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_4.dll
4⤵
- Registers COM server for autorun
- Loads dropped DLL
PID:516

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe d3dx9_32_x64.inf
4⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2364

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe d3dx10_00_x64.inf
4⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2704

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe XACT2_5_x64.inf
4⤵
- Executes dropped EXE
PID:5036

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_5.dll
4⤵
- Registers COM server for autorun
- Loads dropped DLL
- Modifies registry class
PID:2100

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe XACT2_6_x64.inf
4⤵
- Executes dropped EXE
PID:1860

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_6.dll
4⤵
- Registers COM server for autorun
- Loads dropped DLL
- Modifies registry class
PID:4492

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe d3dx9_33_x64.inf
4⤵
- Executes dropped EXE
PID:1112

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe d3dx10_33_x64.inf
4⤵
- Executes dropped EXE
PID:4976

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe XACT2_7_x64.inf
4⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3976

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_7.dll
4⤵
- Registers COM server for autorun
- Loads dropped DLL
PID:3492

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe xinput1_3_x64.inf, Install_Driver
4⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4092

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe d3dx9_34_x64.inf
4⤵
- Executes dropped EXE
PID:5060

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe d3dx10_34_x64.inf
4⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4376

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe XACT2_8_x64.inf
4⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3692

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_8.dll
4⤵
- Registers COM server for autorun
- Loads dropped DLL
- Modifies registry class
PID:1108

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe d3dx9_35_x64.inf
4⤵
- Executes dropped EXE
PID:1068

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe d3dx10_35_x64.inf
4⤵
- Executes dropped EXE
PID:4672

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe XACT2_9_x64.inf
4⤵
- Executes dropped EXE
PID:3616

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_9.dll
4⤵
PID:3256

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe d3dx9_36_x64.inf
4⤵
- Executes dropped EXE
PID:3992

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe d3dx10_36_x64.inf
4⤵
- Executes dropped EXE
PID:1640

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe X3DAudio1_2_x64.inf
4⤵
- Executes dropped EXE
PID:4160

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe XACT2_10_x64.inf
4⤵
- Executes dropped EXE
PID:4528

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_10.dll
4⤵
- Registers COM server for autorun
PID:1760

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe D3DX9_37_x64.inf
4⤵
- Executes dropped EXE
PID:1404

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe d3dx10_37_x64.inf
4⤵
- Executes dropped EXE
PID:1960

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe X3DAudio1_3_x64.inf
4⤵
- Executes dropped EXE
PID:1420

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe XACT3_0_x64.inf
4⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2324

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_0.dll
4⤵
PID:3748

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe XAudio2_0_x64.inf
4⤵
- Executes dropped EXE
PID:3180

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_0.dll
4⤵
- Registers COM server for autorun
- Modifies registry class
PID:1768

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe D3DX9_38_x64.inf
4⤵
- Executes dropped EXE
PID:1200

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe d3dx10_38_x64.inf
4⤵
- Executes dropped EXE
PID:4216

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe X3DAudio1_4_x64.inf
4⤵
- Executes dropped EXE
PID:1060

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe XACT3_1_x64.inf
4⤵
- Executes dropped EXE
PID:4792

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_1.dll
4⤵
- Registers COM server for autorun
- Modifies registry class
PID:3548

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe XAudio2_1_x64.inf
4⤵
- Executes dropped EXE
PID:4064

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_1.dll
4⤵
- Registers COM server for autorun
- Modifies registry class
PID:3392

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe D3DX9_39_x64.inf
4⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3284

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe d3dx10_39_x64.inf
4⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2516

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe XACT3_2_x64.inf
4⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2044

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_2.dll
4⤵
- Registers COM server for autorun
- Modifies registry class
PID:3760

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe XAudio2_2_x64.inf
4⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3832

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_2.dll
4⤵
- Registers COM server for autorun
- Modifies registry class
PID:4532

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe X3DAudio1_5_x64.inf
4⤵
- Executes dropped EXE
PID:1144

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe XACT3_3_x64.inf
4⤵
- Executes dropped EXE
PID:748

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_3.dll
4⤵
- Registers COM server for autorun
- Modifies registry class
PID:1484

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe XAudio2_3_x64.inf
4⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2252

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_3.dll
4⤵
- Registers COM server for autorun
- Modifies registry class
PID:4504

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe D3DX9_40_x64.inf
4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2460

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe d3dx10_40_x64.inf
4⤵
- Executes dropped EXE
PID:3456

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe X3DAudio1_6_x64.inf
4⤵
- Executes dropped EXE
PID:4848

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe XACT3_4_x64.inf
4⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3904

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_4.dll
4⤵
- Registers COM server for autorun
PID:2408

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe XAudio2_4_x64.inf
4⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1728

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_4.dll
4⤵
- Registers COM server for autorun
- Modifies registry class
PID:4484

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe D3DX9_41_x64.inf
4⤵
- Executes dropped EXE
PID:2268

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe d3dx10_41_x64.inf
4⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4084

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe D3DX9_42_x64.inf
4⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1132

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe d3dx10_42_x64.inf
4⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2228

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe d3dx11_42_x64.inf
4⤵
- Executes dropped EXE
PID:3568

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe d3dcsx_42_x64.inf
4⤵
- Executes dropped EXE
PID:1504

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe D3DCompiler_42_x64.inf
4⤵
- Drops file in Windows directory
PID:2280

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe XACT3_5_x64.inf
4⤵
- Drops file in System32 directory
PID:1440

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_5.dll
4⤵
- Registers COM server for autorun
- Modifies registry class
PID:3212

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe XAudio2_5_x64.inf
4⤵
- Drops file in System32 directory
PID:308

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_5.dll
4⤵
- Registers COM server for autorun
- Modifies registry class
PID:2556

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe X3DAudio1_7_x64.inf
4⤵
- Drops file in System32 directory
PID:1308

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe XACT3_6_x64.inf
4⤵
PID:2420

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_6.dll
4⤵
- Registers COM server for autorun
- Modifies registry class
PID:5052

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe XAudio2_6_x64.inf
4⤵
PID:5108

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_6.dll
4⤵
- Registers COM server for autorun
- Modifies registry class
PID:1508

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe D3DX9_43_x64.inf
4⤵
PID:3720

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe d3dx10_43_x64.inf
4⤵
- Drops file in Windows directory
PID:5044

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe d3dx11_43_x64.inf
4⤵
PID:368

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe d3dcsx_43_x64.inf
4⤵
- Drops file in Windows directory
PID:516

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe D3DCompiler_43_x64.inf
4⤵
PID:1668

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe XACT3_7_x64.inf
4⤵
PID:2680

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_7.dll
4⤵
- Registers COM server for autorun
PID:2704

C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DX4862.tmp\infinst.exe XAudio2_7_x64.inf
4⤵
- Drops file in System32 directory
PID:1860

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_7.dll
4⤵
- Registers COM server for autorun
- Modifies registry class
PID:4492

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,16714106840033332038,10191314340082784356,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
2⤵
PID:1860

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,16714106840033332038,10191314340082784356,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5512 /prefetch:8
2⤵
PID:1264

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1636,16714106840033332038,10191314340082784356,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5560 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2736

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1108

C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"
1⤵
- Drops file in Program Files directory
PID:3144

C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir3144_871166837\ChromeRecovery.exe
"C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir3144_871166837\ChromeRecovery.exe" --appguid={8A69D345-D564-463c-AFF1-A69D9E530F96} --browser-version=89.0.4389.114 --sessionid={d0bf75b7-ad9b-4b69-941e-410478e56f9d} --system
2⤵
- Executes dropped EXE
PID:5004

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2560

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4196

C:\Users\Admin\Desktop\SDT2 0.1.0\SDT2.exe
"C:\Users\Admin\Desktop\SDT2 0.1.0\SDT2.exe"
1⤵
PID:1092

C:\Users\Admin\Desktop\SDT2 0.1.0\Sex_Simulator\Binaries\Win64\Sex_Simulator-Win64-Shipping.exe
"C:\Users\Admin\Desktop\SDT2 0.1.0\Sex_Simulator/Binaries/Win64/Sex_Simulator-Win64-Shipping.exe" Sex_Simulator
2⤵
PID:2208

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Filesize
40B

MD5
2141e916c95cfa9ad154136321e16bab

SHA1
e5eca565f7d6e04aacb92e2d334f0dbf39c799b0

SHA256
dadff5e5eaa502c91cf8cc77b20dbd3b166efcf1f4f39536d98e73121895d275

SHA512
0b59ccda76d76ab5142273153d4a57bbd8eb112b3d2c46d08448113fb0fb178c5927d5855d33e43dc3376c9196dde6c924bbf021b914363c2d7e2f931b2c07a7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\000003.log
Filesize
399B

MD5
a15ac2782bb6b4407d11979316f678fd

SHA1
b64eaf0810e180d99b83bba8e366b2e3416c5881

SHA256
55f8fa21c3f0d42c973aedf538f1ade32563ae4a1e7107c939ab82b4a4d7859a

SHA512
370b43c7e434c6cc9328d266c1c9db327621e2c95ad13d953c4d63457a141fbf2be0b35072de96becc29048224d3646535a149229fc2ba367c7903d3e3e79bdb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG
Filesize
314B

MD5
0cb0ae21be5321f657132437a94db012

SHA1
c007e5610cd90a928bc706c000771a3e1bc94e84

SHA256
aa46ee9b14e33900ae97252a75f39e3b693aba49862dd091ec881429031d16b7

SHA512
217541d8a80f316a523921f5340e6f9ae1cf2fc25d7e0d5d2971503d1908e8f61fcd060bfc278790846bc5a89938b93af58b1e3f2163113fc0e942410c6f68de

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata\computed_hashes.json
Filesize
10KB

MD5
90f880064a42b29ccff51fe5425bf1a3

SHA1
6a3cae3996e9fff653a1ddf731ced32b2be2acbf

SHA256
965203d541e442c107dbc6d5b395168123d0397559774beae4e5b9abc44ef268

SHA512
d9cbfcd865356f19a57954f8fd952caf3d31b354112766c41892d1ef40bd2533682d4ec3f4da0e59a5397364f67a484b45091ba94e6c69ed18ab681403dfd3f3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata\verified_contents.json
Filesize
7KB

MD5
0834821960cb5c6e9d477aef649cb2e4

SHA1
7d25f027d7cee9e94e9cbdee1f9220c8d20a1588

SHA256
52a24fa2fb3bcb18d9d8571ae385c4a830ff98ce4c18384d40a84ea7f6ba7f69

SHA512
9aeafc3ece295678242d81d71804e370900a6d4c6a618c5a81cacd869b84346feac92189e01718a7bb5c8226e9be88b063d2ece7cb0c84f17bb1af3c5b1a3fc4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1
Filesize
264KB

MD5
3f787ae4f4670f134548bbcb45f01e17

SHA1
62a3eed1197c1bb47ffe719f009d61c420c79247

SHA256
9d4264f8b4629f422af74b174d7940ecfb1ae5a02bb15dec95d2ec51275cf21c

SHA512
1e72204a5e15dc1c28a6349cd0a817d03b4fe5c3aa5cbcc85355e4179ec775171a671b0318019beaa607820979a7b3b83d4d38b7aa1edc4f113e3697bb6184d6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History
Filesize
116KB

MD5
9e734e29bd2f7a7802eec88eef5532ef

SHA1
e9cdf2a41c98d4438a5402cb9388b88c28fd12a1

SHA256
e796d8d3b04a73771105c5f8b8b4c39d430155ffa28fcff0ff38d9dd2997d19e

SHA512
eb9a39810206f8447b7f56b0176a971028342ab81c729ed7d067e3c2fdf72180481e4c5122b8efecff4fed5fbf07242460f8cc8d6c03edc367d557ea736d3120

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG
Filesize
329B

MD5
6024980e6136cbe9664a8fa0fd60baeb

SHA1
7ae0b39633f29ddf551b9fd0ed9fe2678f80a649

SHA256
ce4b15dcdd3cf5c809d1338ddacc7be2afdf64bd37de609597975bcb61859a7e

SHA512
6ddb9dece3bf18e8b8da96441792820e155ceb94f17ccdd11da38ea9b681e3ad701a18504b3399fd6209c21ccb85cac74c561b43f0332b7a01f0b26ba753303f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications\LOG
Filesize
331B

MD5
23cc49094b3cfa9b3f761f2de5ad2ffc

SHA1
7a5e4399df2028a181a3e446595c55011153ec5c

SHA256
0a168954afcda86f831af7d12883f2122dad2cbb9d4bd734a5b72c6c642bcc87

SHA512
5aa772b4126254d3c9996643592805fd630c7344682b884f3591c6ac4e1271892d90931f952239ff074f306373c6004785f3e671b0ced408768c259d848204d7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
5KB

MD5
6783ba7300642b4a346614c8aa9bb2c3

SHA1
3385a2f4d3169506b79730a20518f30709454c11

SHA256
ddc5b05a95db0ebf5fec8783761c46ed0c05f04e5fbb162a08d652dbe62be64f

SHA512
e3dd7e51dd6c475e00252289607f1042f21f6d44734e297fe21d75de1d530a3ea3fcc576c2b18261d0ef907521e49c249883a92b23284cd7e58abd0f75351500

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferredApps
Filesize
33B

MD5
2b432fef211c69c745aca86de4f8e4ab

SHA1
4b92da8d4c0188cf2409500adcd2200444a82fcc

SHA256
42b55d126d1e640b1ed7a6bdcb9a46c81df461fa7e131f4f8c7108c2c61c14de

SHA512
948502de4dc89a7e9d2e1660451fcd0f44fd3816072924a44f145d821d0363233cc92a377dba3a0a9f849e3c17b1893070025c369c8120083a622d025fe1eacf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Filesize
17KB

MD5
031108e03f9753f783e337b0da4e2138

SHA1
0bc03bd8d386a50c3c7295985172d36c0bb64663

SHA256
cdcfddb987e74c52e82568ad2ffeb942711b49168c1adbd8b84cf25c13651217

SHA512
8a320711ec6f2a4c3860757ab8bff849903fe311a1ef48d72ecad4261456152a373f910d5ae55ae2543f73d2271dcf7189377d943278a590729ad42dd995d748

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000003.log
Filesize
194B

MD5
d7d9437445aa960dcea52ffe772822dc

SHA1
c2bbf4ac0732d905d998c4f645fd60f95a675d02

SHA256
4ff49903bec1197017a35995d5c5fc703caf9d496467345d783f754b723d21c1

SHA512
335eb1ba85670550ed1e1e4e14ea4b5d14f8306125bf147a42de4def5e5f75f14c422b014414030cf30378c04f748ac875cf056adda196511a0b057b3598fe9a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG
Filesize
314B

MD5
d1a2087aff309561890fbcd47ecb7fd0

SHA1
de56c3857c19bed764da81b1bbc3c24fc2a02b4e

SHA256
c61436643f4690d393e793a81d19ff6ff2c4e0699635ae121f4e7b3c7a203d00

SHA512
78191e2f709eb779f92ff74f2877c3ca60fbefa49fb54055074118b58384d1e8f38775fd5977d9fde42b7d29fbe8618c358d5300838847cd0e06bbd3475e2746

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions\Tabs_13314182465983189
Filesize
1KB

MD5
8769c9701da396054c82e8ec0f9d2ebf

SHA1
cd4718fec1ed16adf637cc36a2bef0146914722f

SHA256
4ca91ea047d1e30f1236940044267258d85ad8038973fec50b96ee36ce319b0b

SHA512
0ecce7194359a688f81118b7eda85d9db1ad76329c1ade5ae223b611ff4e8fd49b2c30f4796fecd5f4c772125ae630f6a386700287e1372529b5ef5c77ffb56b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000003.log
Filesize
112B

MD5
45acf5fede04b79fa963d2cc9c08268c

SHA1
9236bbdb1e00b43cb2917e4c212bb35d4204460f

SHA256
77ae846ec4d0b9ee3bce39e5adca3c38f57b8fa424b85eed99cabe3c6571e0f4

SHA512
0481f0770b0a92e6aacce0ad05b944dac0d13f2ba8a41e49b39ff6b3163bfd6c152e85f155e63fa2e640d3e4f479f8575dc23cd68efb30896f766f3e4dd86faf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG
Filesize
345B

MD5
827b2a777b2d3c437e65e5feea448aa6

SHA1
25480d21247b53cf5ca83c88e518c684d2b0dac3

SHA256
3fe0c775b6b453b1c159f940d5661ae9d23b09ed7fb3ac65a91d60c20020207e

SHA512
d83b7c2354a8a8a5afb25a023eeb548f2a11a3e57d3f62c3385d00c9da1e789afd69b2e31b9c00fd95032cfbb57e369f88e23be9c49649746ba764edd4db660c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000003.log
Filesize
160B

MD5
de92ad90be6d3364745b2f73f4c3cf73

SHA1
9158681463bd30e5af4dda4baac81f93cedbda77

SHA256
0025a3e0d3b834401b3b5f820e1991ef7e810d9a4b8b6b579e6301c94e7031a0

SHA512
9e81cefc195439439f4b23ee7696309d7bc3c08e5b444d2abde26d2f12b2d3bcfd124fb9a2d40c6389e9f787741676fad366a2e9982674e7b931028c014d8a79

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG
Filesize
321B

MD5
2310d89c2da67124847399abcc3ad522

SHA1
af037998f2daea7b493914c53a3feba22409514d

SHA256
56dd2498bee72e471abe756c90703159739cbb60c0b492d21cc5d471d8264b80

SHA512
cbd1fbfe10d8345b9a25ed264024980deb529f508f9f9d7ec5708b1975218bab0c37afa031051cfa1f94be728901e6a1ea3bcf620bec78e471631897246fcfd8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Visited Links
Filesize
128KB

MD5
f639f718acdd3bf682703e6d07686d38

SHA1
248ccec0a73af00f000e9507f12fc855ea43e5e6

SHA256
53828b4103bd45fc3aef3cc0ac87023c78a42ee334ccc7d29250116bc24d5a64

SHA512
37ced58f91e1db2e9100b99419af905398430f4d4114cb99b47f5a0057a9a7963e37bc0d1898743b04654a4cd0983ed63e92204199097911df73799dd178a0f3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG
Filesize
46B

MD5
3827c8c524f3f520898fabef0863d88f

SHA1
8ca48eb45bb9f8631f2c6de16376b6f29b0c58c0

SHA256
beaa045d94af153c83ca74cb834fa2518f42cb346cfb66fd0d42e58063ba850f

SHA512
fdde205ebe72a296d5a124fa9a9c2aee4c0b54f9f4b1accac5196879e585fc2c81d6f3b0d44b659a3a4c373f22d9ead75eb179c344dbfba79c5a39befadd87c4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\GPUCache\data_1
Filesize
264KB

MD5
f77c4cce18038e0f5e7e1cbc53725c05

SHA1
ec92a771be91378d0dd19059a09ac7d350fb9abf

SHA256
988743d19b53f68bc1806d2a8f3eaec7786a8df700a2567d3df4304f9c2675c7

SHA512
2b55b402a5abe38b1d239384cc4edf017c3453367c7eb13d2d9fc8f2e37acd1f917e1b4f5803d42e0b18e114dafd07b6eb3859b5a3176e4885eb7725e03d1821

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Filesize
13B

MD5
b63048c4e7e52c52053d25da30d9c5ab

SHA1
679a44d402f5ec24605719e06459f5a707989187

SHA256
389caa40ea458e84bc624a9af1e0dec60fa652b2db2b81c09b1dfe22822cc3d1

SHA512
e86c58c5a25e24f21ad79ed526a90c120a09c115f4820663bd2ebbc59e7bb1c4c418267eb77645522aa20b2c1b53fba8e31690db7bae9b21e4eff3db06316359

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
107KB

MD5
28f225fdc9612c985eb14cc32b144312

SHA1
52a8542a6b04301f77941697fd5821f231a3e01f

SHA256
3060b6733ee81dd70ed649c63e3c902cbf62283402aa0adf3188c5d9353181e3

SHA512
35c45a00365fa0d3f6334926f90f54dfc75a4362f1c9889ae245ce61ca7d05fda4ab07673ee95a42db13bf8856799580cb613f8397bac1ebb395b1b5fd914f66

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SafetyTips\2894\manifest.fingerprint
Filesize
66B

MD5
4b7dbca45e28dcedadf7ee53cdb88f09

SHA1
97691b53cd7e1b378b4ac06db1efe64e5607899b

SHA256
c645698cd7095cc6253da06b31e21bc2f5453e336b87204f3878380bdf6d5bde

SHA512
dec86fb3e5001eadfdde552206e9f69a032085a881c4ae460849ef11de15bbed95f14fd603a29bbab77dec3354f7abb68b9c338df74f1345a342344756de612b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SafetyTips\2894\manifest.json
Filesize
72B

MD5
a64364e707de0971a97c3e5b7c1c9082

SHA1
ae886bb8078cc83387ed404f1d07e2c840196a79

SHA256
00b6b7a19869c945401c4982c83e4b039743f327ffbb164822783f2ce612de40

SHA512
b7d34e53c27963c163e317cc0c77b6e0c1c6ece06268519fd32d287ed0b291c13b0d5a4cc87cc652c123d74e7685b36749e89c626bc55fe8b72765808519483a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_1
Filesize
264KB

MD5
6bafae0137e3e8f99b181c343f96bb34

SHA1
087bb3c304842fadd4c6410b8bcbc3216794d96c

SHA256
c90fbd93e7a8e6db1b6aa8221d9d2b9e77d29b62f7b60c4ae0494fae2ea24dc3

SHA512
dec209719d8ba0d5eecc376560b0e55261aec9edb7dc8bc2bab0b6942da2150bc8710db09770d5c35cc14ff4a359fbbfdbb680d0d10ac6ed395c1343c8ba6ec8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Subresource Filter\Indexed Rules\27\9.41.0\Ruleset Data
Filesize
149KB

MD5
ab5d6dc1de506209301837e42c5fae25

SHA1
d17f6eb616031b971e9b82334f63157031e1dff7

SHA256
b7b0a93637e7816af4d0eda530c8f7591bd61283ae5fdb22d2295f1bdd9f533d

SHA512
a70cd41a582cc09fe2c72f123545261a2130e7bd105ac04f76331b73607f9a4a27bc10e565cb43e7b2cd27d1e616a355ef79c1010f7ccb85eff67fae33aaa6a0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Subresource Filter\Unindexed Rules\9.41.0\manifest.fingerprint
Filesize
66B

MD5
25b4a4b1b8ba29ebac0980e36183c068

SHA1
125226bab315c2d17434f259e79ee4987fa691dc

SHA256
985b93e0e2399b5e6c63b62e1a998c4c92b630644baeb33d717c84e58cb68b87

SHA512
fa22b53a233c1dd01a2e34704c0263cdc933a654a96b57520f2315c9a6fbdac12d4f544fa9b171cbcd6af63306309e7ed23ea93b88b1d8e279eeff1b8da5a2d1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Subresource Filter\Unindexed Rules\9.41.0\manifest.json
Filesize
114B

MD5
9e1208bf9f524e07634644780904b571

SHA1
b81ba1a8ccc175c183bb27b883787bc3778328f2

SHA256
93ffaf90efcb48dfa95ad1567077941191ed025b7eda1e11f60bee2985336343

SHA512
e67c529bb1bf46d3472ed6b746df9ee3958cb768bb04e8a018d07f73ce10ce3d8d9c42f1f34af96b4de4d8159c32d7bf41b4580813c536cc4c957c2c41352fea

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\chrome_shutdown_ms.txt
Filesize
4B

MD5
0399c3649556fd491299c8698e5b434e

SHA1
4e43775f7fac8bb6d62b04b482129d790cd44322

SHA256
248c4640b7971d5ea83662a25d3cba1b80bef19c821245d77889314fdd0eae20

SHA512
ab41d2f0620b5bf247aa57303f9a82ca2c8c18d34aa85138742f4670de16e8eedbed00803e25eafc8b957dd87b88e700050278a0f5962a0df87cad9f14b966dc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.acl
Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
\??\pipe\crashpad_2952_TOOQJNKIDFTAEYOM
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\pipe\crashpad_4780_TMZDMUQPOKWBFBIY
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/224-191-0x0000000000000000-mapping.dmp

Download
memory/516-194-0x00000000006D1000-0x0000000000722000-memory.dmp

Filesize
324KB

Download
memory/516-193-0x00000000006D0000-0x000000000072E000-memory.dmp

Filesize
376KB

Download
memory/516-192-0x0000000000000000-mapping.dmp

Download
memory/1060-230-0x0000000000000000-mapping.dmp

Download
memory/1068-210-0x0000000000000000-mapping.dmp

Download
memory/1108-209-0x0000000000000000-mapping.dmp

Download
memory/1112-201-0x0000000000000000-mapping.dmp

Download
memory/1200-228-0x0000000000000000-mapping.dmp

Download
memory/1336-176-0x0000000000000000-mapping.dmp

Download
memory/1404-221-0x0000000000000000-mapping.dmp

Download
memory/1420-223-0x0000000000000000-mapping.dmp

Download
memory/1440-181-0x0000000000000000-mapping.dmp

Download
memory/1516-184-0x0000000000000000-mapping.dmp

Download
memory/1560-187-0x0000000000000000-mapping.dmp

Download
memory/1560-188-0x0000000001D80000-0x0000000001DDE000-memory.dmp

Filesize
376KB

Download
memory/1560-189-0x0000000001D81000-0x0000000001DD2000-memory.dmp

Filesize
324KB

Download
memory/1640-215-0x0000000000000000-mapping.dmp

Download
memory/1760-218-0x0000000000000000-mapping.dmp

Download
memory/1760-220-0x00000000007F1000-0x000000000084C000-memory.dmp

Filesize
364KB

Download
memory/1760-219-0x00000000007F0000-0x0000000000859000-memory.dmp

Filesize
420KB

Download
memory/1768-227-0x0000000000000000-mapping.dmp

Download
memory/1860-199-0x0000000000000000-mapping.dmp

Download
memory/1960-222-0x0000000000000000-mapping.dmp

Download
memory/2044-237-0x0000000000000000-mapping.dmp

Download
memory/2100-198-0x0000000000000000-mapping.dmp

Download
memory/2324-224-0x0000000000000000-mapping.dmp

Download
memory/2348-178-0x0000000000000000-mapping.dmp

Download
memory/2364-195-0x0000000000000000-mapping.dmp

Download
memory/2420-185-0x0000000000000000-mapping.dmp

Download
memory/2460-171-0x0000000000000000-mapping.dmp

Download
memory/2516-236-0x0000000000000000-mapping.dmp

Download
memory/2704-196-0x0000000000000000-mapping.dmp

Download
memory/2980-169-0x0000000000000000-mapping.dmp

Download
memory/3080-174-0x0000000000000000-mapping.dmp

Download
memory/3180-226-0x0000000000000000-mapping.dmp

Download
memory/3208-173-0x0000000000000000-mapping.dmp

Download
memory/3256-213-0x0000000000000000-mapping.dmp

Download
memory/3284-235-0x0000000000000000-mapping.dmp

Download
memory/3392-234-0x0000000000000000-mapping.dmp

Download
memory/3456-172-0x0000000000000000-mapping.dmp

Download
memory/3492-204-0x0000000000000000-mapping.dmp

Download
memory/3516-186-0x0000000000000000-mapping.dmp

Download
memory/3548-232-0x0000000000000000-mapping.dmp

Download
memory/3572-179-0x0000000000000000-mapping.dmp

Download
memory/3616-212-0x0000000000000000-mapping.dmp

Download
memory/3692-208-0x0000000000000000-mapping.dmp

Download
memory/3748-225-0x0000000000000000-mapping.dmp

Download
memory/3976-203-0x0000000000000000-mapping.dmp

Download
memory/3984-190-0x0000000000000000-mapping.dmp

Download
memory/3992-214-0x0000000000000000-mapping.dmp

Download
memory/4064-233-0x0000000000000000-mapping.dmp

Download
memory/4092-205-0x0000000000000000-mapping.dmp

Download
memory/4160-216-0x0000000000000000-mapping.dmp

Download
memory/4168-182-0x0000000000000000-mapping.dmp

Download
memory/4216-229-0x0000000000000000-mapping.dmp

Download
memory/4376-207-0x0000000000000000-mapping.dmp

Download
memory/4420-183-0x0000000000000000-mapping.dmp

Download
memory/4464-180-0x0000000000000000-mapping.dmp

Download
memory/4484-175-0x0000000000000000-mapping.dmp

Download
memory/4492-200-0x0000000000000000-mapping.dmp

Download
memory/4528-217-0x0000000000000000-mapping.dmp

Download
memory/4672-211-0x0000000000000000-mapping.dmp

Download
memory/4736-177-0x0000000000000000-mapping.dmp

Download
memory/4792-231-0x0000000000000000-mapping.dmp

Download
memory/4944-170-0x0000000000000000-mapping.dmp

Download
memory/4976-202-0x0000000000000000-mapping.dmp

Download
memory/5004-168-0x0000000000000000-mapping.dmp

Download
memory/5036-197-0x0000000000000000-mapping.dmp

Download
memory/5060-206-0x0000000000000000-mapping.dmp

Download