hxxps://drive[.]google[.]com/file/d/1IjAzI4L72h-d9oGZGlrKIgIQ68z2XwaY/view?usp=share_link

Analysis

max time kernel
627s
max time network
630s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
04-12-2022 14:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1IjAzI4L72h-d9oGZGlrKIgIQ68z2XwaY/view?usp=share_link

Score

8^/10

bootkit discovery evasion persistence trojan

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

Processes:

msiexec.exe

flow pid process

500 3032 msiexec.exe
Downloads MZ/PE file

flow	pid	process
500	3032	msiexec.exe

Drops file in Drivers directory 6 IoCs

Processes:

MsiExec.exe

description	ioc	process
File opened for modification	C:\Windows\system32\DRIVERS\SETC0B9.tmp	MsiExec.exe
File created	C:\Windows\system32\DRIVERS\SETC0B9.tmp	MsiExec.exe
File opened for modification	C:\Windows\system32\DRIVERS\klif.sys	MsiExec.exe
File opened for modification	C:\Windows\system32\DRIVERS\SETC0C9.tmp	MsiExec.exe
File created	C:\Windows\system32\DRIVERS\SETC0C9.tmp	MsiExec.exe
File opened for modification	C:\Windows\system32\DRIVERS\klflt.sys	MsiExec.exe

Executes dropped EXE 5 IoCs

Processes:

ChromeRecovery.exeks4.021.3.10.391de_fr_nl_24977.exestartup.exeks4.021.3.10.391de_fr_nl_24977.exeTEST_WPF.EXE

pid process

3164 ChromeRecovery.exe
3100 ks4.021.3.10.391de_fr_nl_24977.exe
5032 startup.exe
1020 ks4.021.3.10.391de_fr_nl_24977.exe
1408 TEST_WPF.EXE

pid	process
3164	ChromeRecovery.exe
3100	ks4.021.3.10.391de_fr_nl_24977.exe
5032	startup.exe
1020	ks4.021.3.10.391de_fr_nl_24977.exe
1408	TEST_WPF.EXE

Loads dropped DLL 27 IoCs

Processes:

ks4.021.3.10.391de_fr_nl_24977.exestartup.exeTEST_WPF.EXEMsiExec.exeMsiExec.exeMsiExec.exerundll32.exe

pid	process
3100	ks4.021.3.10.391de_fr_nl_24977.exe
5032	startup.exe
1408	TEST_WPF.EXE
5032	startup.exe
5032	startup.exe
4768	MsiExec.exe
4768	MsiExec.exe
4768	MsiExec.exe
4768	MsiExec.exe
4768	MsiExec.exe
4768	MsiExec.exe
4768	MsiExec.exe
4768	MsiExec.exe
4768	MsiExec.exe
4768	MsiExec.exe
4768	MsiExec.exe
4768	MsiExec.exe
4768	MsiExec.exe
4768	MsiExec.exe
4768	MsiExec.exe
4768	MsiExec.exe
3716	MsiExec.exe
3716	MsiExec.exe
1796	MsiExec.exe
1796	MsiExec.exe
2212	rundll32.exe
5032	startup.exe

Checks for any installed AV software in registry 1 TTPs 64 IoCs

Security Software Discovery

T1063

Processes:

ks4.021.3.10.391de_fr_nl_24977.exestartup.exemsiexec.exe

description	ioc	process
Key queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\KasperskyLab\IEOverride	ks4.021.3.10.391de_fr_nl_24977.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\KasperskyLab\IEOverride\Main\Play_Background_Sounds	ks4.021.3.10.391de_fr_nl_24977.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\KasperskyLab\IEOverride\Main\UseHR	ks4.021.3.10.391de_fr_nl_24977.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\KasperskyLab\IEOverride\Main\Cleanup HTCs	ks4.021.3.10.391de_fr_nl_24977.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\KasperskyLab\IEOverride\Text Scaling	startup.exe
Key enumerated	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\KasperskyLab\IEOverride	ks4.021.3.10.391de_fr_nl_24977.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\KasperskyLab\IEOverride\Main	ks4.021.3.10.391de_fr_nl_24977.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\KasperskyLab\IEOverride\Main\Expand Alt Text	startup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\KasperskyLab\IEOverride\Main\Q300829	startup.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\KasperskyLab\IEOverride\Styles	ks4.021.3.10.391de_fr_nl_24977.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\KasperskyLab\IEOverride\Main\Disable Diagnostics Mode	startup.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\KasperskyLab\IEOverride\MenuExt	startup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\KasperskyLab\IEOverride\Main	ks4.021.3.10.391de_fr_nl_24977.exe
Key deleted	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\KasperskyLab\IEOverride	ks4.021.3.10.391de_fr_nl_24977.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\KasperskyLab\IEOverride	startup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\KasperskyLab\IEOverride\Main\SmoothScroll	ks4.021.3.10.391de_fr_nl_24977.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\KasperskyLab\IEOverride\Text Scaling	ks4.021.3.10.391de_fr_nl_24977.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\KasperskyLab\IEOverride\AdvancedOptions\DISAMBIGUATION	ks4.021.3.10.391de_fr_nl_24977.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\KasperskyLab\IEOverride\Main	startup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\KasperskyLab\IEOverride\Main\DOMStorage	startup.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\KasperskyLab	ks4.021.3.10.391de_fr_nl_24977.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\KasperskyLab	startup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\KasperskyLab\IEOverride\Main	startup.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\KasperskyLab\IEOverride	ks4.021.3.10.391de_fr_nl_24977.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\KasperskyLab\IEOverride	ks4.021.3.10.391de_fr_nl_24977.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\KasperskyLab\IEOverride\Main\Disable Script Debugger	ks4.021.3.10.391de_fr_nl_24977.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\KasperskyLab\IEOverride\RtfConverterFlags	startup.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\KasperskyLab\IEOverride\Viewport	startup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\AVP18.0.0	msiexec.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\KasperskyLab\IEOverride\Styles	startup.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\KasperskyLab\IEOverride\AdvancedOptions\DISAMBIGUATION	startup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\KasperskyLab\IEOverride\Main\UseSWRender = "1"	ks4.021.3.10.391de_fr_nl_24977.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\KasperskyLab\IEOverride\Main\XMLHTTP	ks4.021.3.10.391de_fr_nl_24977.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\KasperskyLab\IEOverride\MenuExt	ks4.021.3.10.391de_fr_nl_24977.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\KasperskyLab\IEOverride\International\Scripts\4	ks4.021.3.10.391de_fr_nl_24977.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\KasperskyLab\IEOverride\Main\Display Inline Videos	startup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\KasperskyLab\IEOverride\Main\Print_Background	startup.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast	startup.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\KasperskyLab\IEOverride\Main	startup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\KasperskyLab\IEOverride	startup.exe
Key queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\KasperskyLab\IEOverride\Main	ks4.021.3.10.391de_fr_nl_24977.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\KasperskyLab\IEOverride\Main\Display Inline Images	ks4.021.3.10.391de_fr_nl_24977.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\KasperskyLab\IEOverride\Settings	ks4.021.3.10.391de_fr_nl_24977.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\KasperskyLab\IEOverride\Main	startup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\KasperskyLab\IEOverride\Main\Move System Caret	startup.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\KasperskyLab\IEOverride\Settings	startup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\KasperskyLab\IEOverride\Main\UseHR	startup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\KasperskyLab\IEOverride\Main\XDomainRequest	startup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\KasperskyLab\IEOverride\Main\CSS_Compat	ks4.021.3.10.391de_fr_nl_24977.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\KasperskyLab\IEOverride\Main\JScriptProfileCacheEventDelay	ks4.021.3.10.391de_fr_nl_24977.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\KasperskyLab\IEOverride\International\Scripts	ks4.021.3.10.391de_fr_nl_24977.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\KasperskyLab\IEOverride\Viewport	ks4.021.3.10.391de_fr_nl_24977.exe
Key queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\KasperskyLab\IEOverride\Main	startup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\KasperskyLab\IEOverride\Main\Disable Script Debugger	startup.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\KasperskyLab\IEOverride	ks4.021.3.10.391de_fr_nl_24977.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\KasperskyLab\IEOverride\Main\Enable Browser Extensions = "no"	ks4.021.3.10.391de_fr_nl_24977.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\KasperskyLab\IEOverride\Main\Play_Animations	ks4.021.3.10.391de_fr_nl_24977.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\KasperskyLab\IEOverride\Main\Use_DlgBox_Colors	startup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\KasperskyLab\IEOverride\Main\CSS_Compat	startup.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\KasperskyLab\IEOverride\Larger Hit Test	ks4.021.3.10.391de_fr_nl_24977.exe
Key queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\KasperskyLab\IEOverride	startup.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\KasperskyLab	ks4.021.3.10.391de_fr_nl_24977.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\KasperskyLab\IEOverride\Main\Use_DlgBox_Colors	ks4.021.3.10.391de_fr_nl_24977.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\KasperskyLab\IEOverride\Main\Print_Background	ks4.021.3.10.391de_fr_nl_24977.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

ks4.021.3.10.391de_fr_nl_24977.exestartup.exerundll32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ks4.021.3.10.391de_fr_nl_24977.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	startup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

Processes:

ks4.021.3.10.391de_fr_nl_24977.exestartup.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	ks4.021.3.10.391de_fr_nl_24977.exe
File opened for modification	\??\PhysicalDrive0	startup.exe

Drops file in Program Files directory 7 IoCs

Processes:

elevation_service.exe

description	ioc	process
File created	C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir4504_517285594\_metadata\verified_contents.json	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir4504_517285594\_metadata\verified_contents.json	elevation_service.exe
File created	C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir4504_517285594\ChromeRecoveryCRX.crx	elevation_service.exe
File created	C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir4504_517285594\ChromeRecovery.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir4504_517285594\ChromeRecovery.exe	elevation_service.exe
File created	C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir4504_517285594\manifest.json	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir4504_517285594\manifest.json	elevation_service.exe

Drops file in Windows directory 27 IoCs

Processes:

MsiExec.exemsiexec.exestartup.exe

description	ioc	process
File created	C:\Windows\Inf\oem0.PNF	MsiExec.exe
File created	C:\Windows\Installer\e5f919a.msi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSI95B3.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{4FC79BE9-AD63-46C0-9626-E4F6BCE6A976}	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\security\logs\scecomp.log	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSI9AE7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9F2F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA1E0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA2AC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI34FE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9525.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI95C4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9AA7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9AC7.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAE66.tmp	msiexec.exe
File created	C:\Windows\Inf\oem1.PNF	MsiExec.exe
File opened for modification	C:\Windows\Installer\e5f919a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9593.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9ED0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\installer	startup.exe
File opened for modification	C:\Windows\Installer\MSIA963.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB107.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBDF8.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

Processes:

msiexec.exe

description	ioc	process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

ks4.021.3.10.391de_fr_nl_24977.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d4304000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	ks4.021.3.10.391de_fr_nl_24977.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c00000001000000040000000008000004000000010000001000000087ce0b7b2a0e4900e158719b37a893720300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	ks4.021.3.10.391de_fr_nl_24977.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	ks4.021.3.10.391de_fr_nl_24977.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	ks4.021.3.10.391de_fr_nl_24977.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	ks4.021.3.10.391de_fr_nl_24977.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

chrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exeks4.021.3.10.391de_fr_nl_24977.exestartup.exeMsiExec.exe

pid	process
1536	chrome.exe
1536	chrome.exe
5040	chrome.exe
5040	chrome.exe
3136	chrome.exe
3136	chrome.exe
1208	chrome.exe
1208	chrome.exe
5000	chrome.exe
5000	chrome.exe
4504	chrome.exe
4504	chrome.exe
3128	chrome.exe
3128	chrome.exe
2960	chrome.exe
2960	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
4660	chrome.exe
4660	chrome.exe
2336	chrome.exe
2336	chrome.exe
3100	ks4.021.3.10.391de_fr_nl_24977.exe
3100	ks4.021.3.10.391de_fr_nl_24977.exe
3100	ks4.021.3.10.391de_fr_nl_24977.exe
3100	ks4.021.3.10.391de_fr_nl_24977.exe
3100	ks4.021.3.10.391de_fr_nl_24977.exe
3100	ks4.021.3.10.391de_fr_nl_24977.exe
3100	ks4.021.3.10.391de_fr_nl_24977.exe
3100	ks4.021.3.10.391de_fr_nl_24977.exe
5032	startup.exe
5032	startup.exe
5032	startup.exe
5032	startup.exe
5032	startup.exe
5032	startup.exe
5032	startup.exe
5032	startup.exe
5032	startup.exe
5032	startup.exe
5032	startup.exe
5032	startup.exe
5032	startup.exe
5032	startup.exe
5032	startup.exe
5032	startup.exe
5032	startup.exe
5032	startup.exe
5032	startup.exe
5032	startup.exe
5032	startup.exe
5032	startup.exe
3716	MsiExec.exe
3716	MsiExec.exe
3716	MsiExec.exe
3716	MsiExec.exe
5032	startup.exe
5032	startup.exe
5032	startup.exe
5032	startup.exe
5032	startup.exe
5032	startup.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

668

pid	process
668

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 59 IoCs

Processes:

chrome.exe

pid	process
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

startup.exemsiexec.exeMsiExec.exe

description	pid	process
Token: SeShutdownPrivilege	5032	startup.exe
Token: SeIncreaseQuotaPrivilege	5032	startup.exe
Token: SeSecurityPrivilege	3032	msiexec.exe
Token: SeCreateTokenPrivilege	5032	startup.exe
Token: SeAssignPrimaryTokenPrivilege	5032	startup.exe
Token: SeLockMemoryPrivilege	5032	startup.exe
Token: SeIncreaseQuotaPrivilege	5032	startup.exe
Token: SeMachineAccountPrivilege	5032	startup.exe
Token: SeTcbPrivilege	5032	startup.exe
Token: SeSecurityPrivilege	5032	startup.exe
Token: SeTakeOwnershipPrivilege	5032	startup.exe
Token: SeLoadDriverPrivilege	5032	startup.exe
Token: SeSystemProfilePrivilege	5032	startup.exe
Token: SeSystemtimePrivilege	5032	startup.exe
Token: SeProfSingleProcessPrivilege	5032	startup.exe
Token: SeIncBasePriorityPrivilege	5032	startup.exe
Token: SeCreatePagefilePrivilege	5032	startup.exe
Token: SeCreatePermanentPrivilege	5032	startup.exe
Token: SeBackupPrivilege	5032	startup.exe
Token: SeRestorePrivilege	5032	startup.exe
Token: SeShutdownPrivilege	5032	startup.exe
Token: SeDebugPrivilege	5032	startup.exe
Token: SeAuditPrivilege	5032	startup.exe
Token: SeSystemEnvironmentPrivilege	5032	startup.exe
Token: SeChangeNotifyPrivilege	5032	startup.exe
Token: SeRemoteShutdownPrivilege	5032	startup.exe
Token: SeUndockPrivilege	5032	startup.exe
Token: SeSyncAgentPrivilege	5032	startup.exe
Token: SeEnableDelegationPrivilege	5032	startup.exe
Token: SeManageVolumePrivilege	5032	startup.exe
Token: SeImpersonatePrivilege	5032	startup.exe
Token: SeCreateGlobalPrivilege	5032	startup.exe
Token: SeRestorePrivilege	3032	msiexec.exe
Token: SeTakeOwnershipPrivilege	3032	msiexec.exe
Token: SeRestorePrivilege	3032	msiexec.exe
Token: SeTakeOwnershipPrivilege	3032	msiexec.exe
Token: SeRestorePrivilege	3032	msiexec.exe
Token: SeTakeOwnershipPrivilege	3032	msiexec.exe
Token: SeRestorePrivilege	3032	msiexec.exe
Token: SeTakeOwnershipPrivilege	3032	msiexec.exe
Token: SeRestorePrivilege	3032	msiexec.exe
Token: SeTakeOwnershipPrivilege	3032	msiexec.exe
Token: SeRestorePrivilege	3032	msiexec.exe
Token: SeTakeOwnershipPrivilege	3032	msiexec.exe
Token: SeRestorePrivilege	3032	msiexec.exe
Token: SeTakeOwnershipPrivilege	3032	msiexec.exe
Token: SeRestorePrivilege	3032	msiexec.exe
Token: SeTakeOwnershipPrivilege	3032	msiexec.exe
Token: SeRestorePrivilege	3032	msiexec.exe
Token: SeTakeOwnershipPrivilege	3032	msiexec.exe
Token: SeRestorePrivilege	3032	msiexec.exe
Token: SeTakeOwnershipPrivilege	3032	msiexec.exe
Token: SeRestorePrivilege	3032	msiexec.exe
Token: SeTakeOwnershipPrivilege	3032	msiexec.exe
Token: SeRestorePrivilege	3032	msiexec.exe
Token: SeTakeOwnershipPrivilege	3032	msiexec.exe
Token: SeRestorePrivilege	3032	msiexec.exe
Token: SeTakeOwnershipPrivilege	3032	msiexec.exe
Token: SeRestorePrivilege	3032	msiexec.exe
Token: SeTakeOwnershipPrivilege	3032	msiexec.exe
Token: SeRestorePrivilege	3032	msiexec.exe
Token: SeTakeOwnershipPrivilege	3032	msiexec.exe
Token: SeDebugPrivilege	3716	MsiExec.exe
Token: SeDebugPrivilege	3716	MsiExec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

chrome.exe

pid	process
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe

Suspicious use of SendNotifyMessage 26 IoCs

Processes:

chrome.exe

pid	process
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe

Suspicious use of SetWindowsHookEx 39 IoCs

Processes:

ks4.021.3.10.391de_fr_nl_24977.exestartup.exe

pid	process
3100	ks4.021.3.10.391de_fr_nl_24977.exe
3100	ks4.021.3.10.391de_fr_nl_24977.exe
3100	ks4.021.3.10.391de_fr_nl_24977.exe
3100	ks4.021.3.10.391de_fr_nl_24977.exe
3100	ks4.021.3.10.391de_fr_nl_24977.exe
3100	ks4.021.3.10.391de_fr_nl_24977.exe
3100	ks4.021.3.10.391de_fr_nl_24977.exe
3100	ks4.021.3.10.391de_fr_nl_24977.exe
3100	ks4.021.3.10.391de_fr_nl_24977.exe
3100	ks4.021.3.10.391de_fr_nl_24977.exe
5032	startup.exe
5032	startup.exe
5032	startup.exe
5032	startup.exe
5032	startup.exe
5032	startup.exe
5032	startup.exe
5032	startup.exe
5032	startup.exe
5032	startup.exe
5032	startup.exe
5032	startup.exe
5032	startup.exe
5032	startup.exe
5032	startup.exe
5032	startup.exe
5032	startup.exe
5032	startup.exe
5032	startup.exe
5032	startup.exe
5032	startup.exe
5032	startup.exe
5032	startup.exe
5032	startup.exe
5032	startup.exe
5032	startup.exe
5032	startup.exe
5032	startup.exe
5032	startup.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 5040 wrote to memory of 4980	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 4980	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 372	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 372	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 372	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 372	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 372	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 372	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 372	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 372	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 372	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 372	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 372	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 372	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 372	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 372	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 372	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 372	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 372	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 372	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 372	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 372	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 372	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 372	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 372	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 372	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 372	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 372	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 372	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 372	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 372	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 372	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 372	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 372	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 372	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 372	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 372	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 372	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 372	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 372	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 372	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 372	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 1536	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 1536	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 3824	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 3824	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 3824	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 3824	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 3824	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 3824	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 3824	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 3824	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 3824	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 3824	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 3824	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 3824	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 3824	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 3824	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 3824	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 3824	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 3824	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 3824	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 3824	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 3824	5040	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" https://drive.google.com/file/d/1IjAzI4L72h-d9oGZGlrKIgIQ68z2XwaY/view?usp=share_link
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5040

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff3d064f50,0x7fff3d064f60,0x7fff3d064f70
2⤵
PID:4980

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1660 /prefetch:2
2⤵
PID:372

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2016 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1536

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2364 /prefetch:8
2⤵
PID:3824

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3036 /prefetch:1
2⤵
PID:4512

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3068 /prefetch:1
2⤵
PID:3944

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4308 /prefetch:8
2⤵
PID:3840

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4328 /prefetch:1
2⤵
PID:1736

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
2⤵
PID:1876

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5384 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3136

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5464 /prefetch:8
2⤵
PID:404

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4876 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1208

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4584 /prefetch:8
2⤵
PID:3708

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4888 /prefetch:8
2⤵
PID:4076

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4848 /prefetch:8
2⤵
PID:3564

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4484 /prefetch:1
2⤵
PID:3208

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
2⤵
PID:3224

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
2⤵
PID:1624

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6400 /prefetch:8
2⤵
PID:3132

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6264 /prefetch:8
2⤵
PID:480

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6256 /prefetch:8
2⤵
PID:736

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6096 /prefetch:1
2⤵
PID:3160

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
2⤵
PID:3564

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
2⤵
PID:1448

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
2⤵
PID:700

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5888 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5000

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5916 /prefetch:8
2⤵
PID:5016

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6460 /prefetch:1
2⤵
PID:4904

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
2⤵
PID:736

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6712 /prefetch:8
2⤵
PID:4000

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6692 /prefetch:8
2⤵
PID:3752

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
2⤵
PID:2920

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6228 /prefetch:8
2⤵
PID:4144

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
2⤵
PID:5084

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6744 /prefetch:1
2⤵
PID:1720

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6888 /prefetch:1
2⤵
PID:5068

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
2⤵
PID:1112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6840 /prefetch:1
2⤵
PID:2844

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7308 /prefetch:1
2⤵
PID:1036

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7344 /prefetch:1
2⤵
PID:3128

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7608 /prefetch:1
2⤵
PID:556

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7772 /prefetch:1
2⤵
PID:4680

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7740 /prefetch:1
2⤵
PID:2940

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7732 /prefetch:1
2⤵
PID:3872

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1
2⤵
PID:4208

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
2⤵
PID:2212

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6172 /prefetch:8
2⤵
PID:2040

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8820 /prefetch:1
2⤵
PID:4284

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8652 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4504

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8536 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3128

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8644 /prefetch:1
2⤵
PID:4208

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8552 /prefetch:1
2⤵
PID:2892

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6092 /prefetch:8
2⤵
PID:5000

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8996 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2960

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=8932 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2316

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4244 /prefetch:1
2⤵
PID:3908

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6876 /prefetch:1
2⤵
PID:1108

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6464 /prefetch:1
2⤵
PID:2856

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8560 /prefetch:8
2⤵
PID:2040

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8508 /prefetch:1
2⤵
PID:2244

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4244 /prefetch:1
2⤵
PID:4476

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8948 /prefetch:1
2⤵
PID:3504

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
2⤵
PID:3388

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
2⤵
PID:3160

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8608 /prefetch:1
2⤵
PID:3788

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8960 /prefetch:1
2⤵
PID:3644

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8508 /prefetch:1
2⤵
PID:3180

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=68 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4568 /prefetch:1
2⤵
PID:1068

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6864 /prefetch:1
2⤵
PID:400

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2388 /prefetch:8
2⤵
PID:4768

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=71 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9176 /prefetch:1
2⤵
PID:3144

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=72 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7556 /prefetch:1
2⤵
PID:744

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=73 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8996 /prefetch:1
2⤵
PID:4376

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=75 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8876 /prefetch:1
2⤵
PID:1336

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=74 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8860 /prefetch:1
2⤵
PID:3784

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=76 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6184 /prefetch:1
2⤵
PID:1740

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=77 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9052 /prefetch:1
2⤵
PID:3804

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=78 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6872 /prefetch:1
2⤵
PID:2360

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7488 /prefetch:8
2⤵
PID:4376

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8292 /prefetch:8
2⤵
PID:4052

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7552 /prefetch:8
2⤵
PID:744

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7520 /prefetch:8
2⤵
PID:3368

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=9260 /prefetch:8
2⤵
PID:1576

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5112 /prefetch:8
2⤵
PID:2164

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=9628 /prefetch:8
2⤵
PID:2704

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=9572 /prefetch:8
2⤵
PID:4856

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=9496 /prefetch:8
2⤵
PID:1312

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=9604 /prefetch:8
2⤵
PID:2960

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=9680 /prefetch:8
2⤵
PID:4584

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8388 /prefetch:8
2⤵
PID:2824

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=91 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9556 /prefetch:1
2⤵
PID:1364

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=92 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8108 /prefetch:1
2⤵
PID:3828

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=93 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7756 /prefetch:1
2⤵
PID:560

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=94 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5976 /prefetch:1
2⤵
PID:928

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=95 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7584 /prefetch:1
2⤵
PID:4432

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=96 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8688 /prefetch:1
2⤵
PID:4300

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=97 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9620 /prefetch:1
2⤵
PID:2312

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=98 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4568 /prefetch:1
2⤵
PID:3804

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6012 /prefetch:8
2⤵
PID:432

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=8888 /prefetch:8
2⤵
PID:1300

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6064 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4660

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=9036 /prefetch:8
2⤵
PID:4280

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1564 /prefetch:8
2⤵
PID:1532

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=9632 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2336

C:\Users\Admin\Downloads\ks4.021.3.10.391de_fr_nl_24977.exe
"C:\Users\Admin\Downloads\ks4.021.3.10.391de_fr_nl_24977.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3100

C:\ProgramData\Kaspersky Lab Setup Files\SAAS21.3.10.391.0.1701.0\au_setup_A0A86A32-73E0-11ED-A0EE-CE8FEF2919E2\startup.exe
"C:\ProgramData\Kaspersky Lab Setup Files\SAAS21.3.10.391.0.1701.0\au_setup_A0A86A32-73E0-11ED-A0EE-CE8FEF2919E2\startup.exe" -auto_update_mode="C:\Users\Admin\Downloads\ks4.021.3.10.391de_fr_nl_24977.exe" /-self_remove -l=nl-NL -xpos=346 -ypos=71 -prevsetupver=21.3.10.391.0.184.0
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5032

C:\Users\Admin\AppData\Local\Temp\ECA0C784-73E0-11ED-A0EE-CE8FEF2919E2\TEST_WPF.EXE
"C:\Users\Admin\AppData\Local\Temp\ECA0C784-73E0-11ED-A0EE-CE8FEF2919E2\TEST_WPF.EXE" "C:\Users\Admin\AppData\Local\Temp\6E59F61A0E37DE110AEEECF8FE92912E\setup.dll"
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1408

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\496788DE-73E1-11ED-A0EE-CE8FEF2919E2\GetSI.dll",SaveReportRunDllEntry "C:\Users\Admin\AppData\Local\Temp\496788DE-73E1-11ED-A0EE-CE8FEF2919E2\496788DF-73E1-11ED-A0EE-CE8FEF2919E2"
4⤵
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2212

C:\Users\Admin\Downloads\ks4.021.3.10.391de_fr_nl_24977.exe
"C:\Users\Admin\Downloads\ks4.021.3.10.391de_fr_nl_24977.exe" -cleanup="C:\Users\Admin\AppData\Local\Temp\1FA283890E37DE110AEEECF8FE92912E;3100"
3⤵
- Executes dropped EXE
PID:1020

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7732 /prefetch:8
2⤵
PID:3212

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5456 /prefetch:8
2⤵
PID:1328

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8224 /prefetch:8
2⤵
PID:2212

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8420 /prefetch:8
2⤵
PID:1488

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=9348 /prefetch:8
2⤵
PID:2160

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=9608 /prefetch:8
2⤵
PID:864

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7732 /prefetch:8
2⤵
PID:4992

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=9412 /prefetch:8
2⤵
PID:4396

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=9488 /prefetch:8
2⤵
PID:2412

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1596,9305030904878590243,7980882738636697563,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=9416 /prefetch:8
2⤵
PID:3544

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2892

C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"
1⤵
- Drops file in Program Files directory
PID:4504

C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir4504_517285594\ChromeRecovery.exe
"C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir4504_517285594\ChromeRecovery.exe" --appguid={8A69D345-D564-463c-AFF1-A69D9E530F96} --browser-version=89.0.4389.114 --sessionid={76f94f16-8b1b-4ff6-84ef-37ae4f70e4bb} --system
2⤵
- Executes dropped EXE
PID:3164

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Checks for any installed AV software in registry
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3032

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding ABAD6B7F6E354E89915685E220ED3F14
2⤵
- Loads dropped DLL
PID:4768

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 9944B39B2A8F23E7AC58669CF9D7DF6F E Global\MSI0000
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3716

C:\Windows\System32\MsiExec.exe
C:\Windows\System32\MsiExec.exe -Embedding 6954BE4564C0441AC08526EE9E6356FB E Global\MSI0000
2⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in Windows directory
PID:1796

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Security Software Discovery

T1063

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir4504_517285594\ChromeRecovery.exe
Filesize
253KB

MD5
49ac3c96d270702a27b4895e4ce1f42a

SHA1
55b90405f1e1b72143c64113e8bc65608dd3fd76

SHA256
82aa3fd6a25cda9e16689cfadea175091be010cecae537e517f392e0bef5ba0f

SHA512
b62f6501cb4c992d42d9097e356805c88ac4ac5a46ead4a8eee9f8cbae197b2305da8aab5b4a61891fe73951588025f2d642c32524b360687993f98c913138a0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\RecoveryImproved\1.3.36.141\Recovery.crx3
Filesize
141KB

MD5
ea1c1ffd3ea54d1fb117bfdbb3569c60

SHA1
10958b0f690ae8f5240e1528b1ccffff28a33272

SHA256
7c3a6a7d16ac44c3200f572a764bce7d8fa84b9572dd028b15c59bdccbc0a77d

SHA512
6c30728cac9eac53f0b27b7dbe2222da83225c3b63617d6b271a6cfedf18e8f0a8dffa1053e1cbc4c5e16625f4bbc0d03aa306a946c9d72faa4ceb779f8ffcaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\pipe\crashpad_5040_YDCXSFPAZDKUQYHY
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1020-146-0x00000000771E0000-0x00000000771F0000-memory.dmp

Filesize
64KB

Download
memory/1020-145-0x0000000000000000-mapping.dmp

Download
memory/1020-147-0x00000000771E0000-0x00000000771F0000-memory.dmp

Filesize
64KB

Download
memory/1020-148-0x00000000771E0000-0x00000000771F0000-memory.dmp

Filesize
64KB

Download
memory/1408-175-0x00000000771B0000-0x00000000771C0000-memory.dmp

Filesize
64KB

Download
memory/1408-172-0x00000000771B0000-0x00000000771C0000-memory.dmp

Filesize
64KB

Download
memory/1408-224-0x0000000007DC0000-0x0000000007DCE000-memory.dmp

Filesize
56KB

Download
memory/1408-223-0x0000000007D00000-0x0000000007D08000-memory.dmp

Filesize
32KB

Download
memory/1408-222-0x0000000007BD0000-0x0000000007C10000-memory.dmp

Filesize
256KB

Download
memory/1408-184-0x00000000771B0000-0x00000000771C0000-memory.dmp

Filesize
64KB

Download
memory/1408-221-0x0000000006630000-0x0000000006668000-memory.dmp

Filesize
224KB

Download
memory/1408-149-0x0000000000000000-mapping.dmp

Download
memory/1408-150-0x0000000005810000-0x0000000005D7C000-memory.dmp

Filesize
5.4MB

Download
memory/1408-151-0x0000000000A70000-0x0000000000A78000-memory.dmp

Filesize
32KB

Download
memory/1408-152-0x00000000771B0000-0x00000000771C0000-memory.dmp

Filesize
64KB

Download
memory/1408-153-0x00000000771B0000-0x00000000771C0000-memory.dmp

Filesize
64KB

Download
memory/1408-154-0x00000000771B0000-0x00000000771C0000-memory.dmp

Filesize
64KB

Download
memory/1408-155-0x00000000771B0000-0x00000000771C0000-memory.dmp

Filesize
64KB

Download
memory/1408-156-0x00000000771B0000-0x00000000771C0000-memory.dmp

Filesize
64KB

Download
memory/1408-157-0x00000000771B0000-0x00000000771C0000-memory.dmp

Filesize
64KB

Download
memory/1408-158-0x00000000771B0000-0x00000000771C0000-memory.dmp

Filesize
64KB

Download
memory/1408-159-0x00000000771B0000-0x00000000771C0000-memory.dmp

Filesize
64KB

Download
memory/1408-161-0x00000000771B0000-0x00000000771C0000-memory.dmp

Filesize
64KB

Download
memory/1408-162-0x00000000771B0000-0x00000000771C0000-memory.dmp

Filesize
64KB

Download
memory/1408-160-0x00000000771B0000-0x00000000771C0000-memory.dmp

Filesize
64KB

Download
memory/1408-163-0x00000000771B0000-0x00000000771C0000-memory.dmp

Filesize
64KB

Download
memory/1408-164-0x00000000771B0000-0x00000000771C0000-memory.dmp

Filesize
64KB

Download
memory/1408-165-0x00000000771B0000-0x00000000771C0000-memory.dmp

Filesize
64KB

Download
memory/1408-166-0x00000000771B0000-0x00000000771C0000-memory.dmp

Filesize
64KB

Download
memory/1408-167-0x00000000771B0000-0x00000000771C0000-memory.dmp

Filesize
64KB

Download
memory/1408-168-0x00000000771B0000-0x00000000771C0000-memory.dmp

Filesize
64KB

Download
memory/1408-169-0x00000000771B0000-0x00000000771C0000-memory.dmp

Filesize
64KB

Download
memory/1408-171-0x00000000771B0000-0x00000000771C0000-memory.dmp

Filesize
64KB

Download
memory/1408-170-0x00000000771B0000-0x00000000771C0000-memory.dmp

Filesize
64KB

Download
memory/1408-183-0x00000000771B0000-0x00000000771C0000-memory.dmp

Filesize
64KB

Download
memory/1408-173-0x00000000771B0000-0x00000000771C0000-memory.dmp

Filesize
64KB

Download
memory/1408-174-0x00000000771B0000-0x00000000771C0000-memory.dmp

Filesize
64KB

Download
memory/1408-176-0x00000000771B0000-0x00000000771C0000-memory.dmp

Filesize
64KB

Download
memory/1408-177-0x00000000771B0000-0x00000000771C0000-memory.dmp

Filesize
64KB

Download
memory/1408-178-0x00000000771B0000-0x00000000771C0000-memory.dmp

Filesize
64KB

Download
memory/1408-220-0x0000000007080000-0x00000000071FC000-memory.dmp

Filesize
1.5MB

Download
memory/1408-179-0x00000000771B0000-0x00000000771C0000-memory.dmp

Filesize
64KB

Download
memory/1408-180-0x00000000771B0000-0x00000000771C0000-memory.dmp

Filesize
64KB

Download
memory/1408-181-0x00000000771B0000-0x00000000771C0000-memory.dmp

Filesize
64KB

Download
memory/1408-190-0x00000000771B0000-0x00000000771C0000-memory.dmp

Filesize
64KB

Download
memory/1408-219-0x00000000063A0000-0x0000000006626000-memory.dmp

Filesize
2.5MB

Download
memory/1408-218-0x0000000005760000-0x00000000057C6000-memory.dmp

Filesize
408KB

Download
memory/1408-188-0x00000000771B0000-0x00000000771C0000-memory.dmp

Filesize
64KB

Download
memory/1408-187-0x00000000771B0000-0x00000000771C0000-memory.dmp

Filesize
64KB

Download
memory/1408-191-0x00000000771B0000-0x00000000771C0000-memory.dmp

Filesize
64KB

Download
memory/1408-195-0x00000000771B0000-0x00000000771C0000-memory.dmp

Filesize
64KB

Download
memory/1408-197-0x00000000771B0000-0x00000000771C0000-memory.dmp

Filesize
64KB

Download
memory/1408-198-0x00000000771B0000-0x00000000771C0000-memory.dmp

Filesize
64KB

Download
memory/1408-199-0x00000000771B0000-0x00000000771C0000-memory.dmp

Filesize
64KB

Download
memory/1408-201-0x00000000771B0000-0x00000000771C0000-memory.dmp

Filesize
64KB

Download
memory/1408-200-0x00000000771B0000-0x00000000771C0000-memory.dmp

Filesize
64KB

Download
memory/1408-196-0x00000000771B0000-0x00000000771C0000-memory.dmp

Filesize
64KB

Download
memory/1408-194-0x00000000771B0000-0x00000000771C0000-memory.dmp

Filesize
64KB

Download
memory/1408-193-0x00000000771B0000-0x00000000771C0000-memory.dmp

Filesize
64KB

Download
memory/1408-192-0x00000000771B0000-0x00000000771C0000-memory.dmp

Filesize
64KB

Download
memory/1408-182-0x00000000771B0000-0x00000000771C0000-memory.dmp

Filesize
64KB

Download
memory/1408-186-0x00000000771B0000-0x00000000771C0000-memory.dmp

Filesize
64KB

Download
memory/1408-189-0x00000000771B0000-0x00000000771C0000-memory.dmp

Filesize
64KB

Download
memory/1408-185-0x00000000771B0000-0x00000000771C0000-memory.dmp

Filesize
64KB

Download
memory/1408-202-0x00000000771B0000-0x00000000771C0000-memory.dmp

Filesize
64KB

Download
memory/1408-203-0x00000000771B0000-0x00000000771C0000-memory.dmp

Filesize
64KB

Download
memory/1408-204-0x00000000771B0000-0x00000000771C0000-memory.dmp

Filesize
64KB

Download
memory/1408-205-0x00000000771B0000-0x00000000771C0000-memory.dmp

Filesize
64KB

Download
memory/1408-206-0x00000000771B0000-0x00000000771C0000-memory.dmp

Filesize
64KB

Download
memory/1408-213-0x0000000005D80000-0x0000000006101000-memory.dmp

Filesize
3.5MB

Download
memory/1408-214-0x00000000054E0000-0x0000000005620000-memory.dmp

Filesize
1.2MB

Download
memory/1408-215-0x0000000006710000-0x0000000006D0E000-memory.dmp

Filesize
6.0MB

Download
memory/1408-216-0x0000000006D10000-0x0000000007076000-memory.dmp

Filesize
3.4MB

Download
memory/1408-217-0x00000000056C0000-0x000000000575C000-memory.dmp

Filesize
624KB

Download
memory/1796-227-0x0000000000000000-mapping.dmp

Download
memory/2212-228-0x0000000000000000-mapping.dmp

Download
memory/3100-140-0x00000000771E0000-0x00000000771F0000-memory.dmp

Filesize
64KB

Download
memory/3100-137-0x0000000000000000-mapping.dmp

Download
memory/3100-138-0x00000000771E0000-0x00000000771F0000-memory.dmp

Filesize
64KB

Download
memory/3100-139-0x00000000771E0000-0x00000000771F0000-memory.dmp

Filesize
64KB

Download
memory/3164-135-0x0000000000000000-mapping.dmp

Download
memory/3716-226-0x0000000000000000-mapping.dmp

Download
memory/4768-225-0x0000000000000000-mapping.dmp

Download
memory/5032-141-0x0000000000000000-mapping.dmp

Download
memory/5032-142-0x00000000771C0000-0x00000000771D0000-memory.dmp

Filesize
64KB

Download
memory/5032-143-0x00000000771C0000-0x00000000771D0000-memory.dmp

Filesize
64KB

Download
memory/5032-144-0x00000000771C0000-0x00000000771D0000-memory.dmp

Filesize
64KB

Download