agenttesla | hxxps://bazaar[.]abuse[.]ch/browse/

Analysis

max time kernel
1252s
max time network
1252s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
27-12-2022 20:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://bazaar.abuse.ch/browse/

Score

10^/10

agenttesla redline smokeloader @new@2023 backdoor collection discovery infostealer keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

@new@2023

77.73.133.62:22344

Attributes

auth_value
8284279aedaed026a9b7cb9c1c0be4e4

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detects Smokeloader packer 7 IoCs

resource	yara_rule
behavioral1/memory/500-2133-0x0000000000402DD8-mapping.dmp	family_smokeloader
behavioral1/memory/416-2136-0x0000000002030000-0x0000000002039000-memory.dmp	family_smokeloader
behavioral1/memory/500-2164-0x0000000000400000-0x0000000000409000-memory.dmp	family_smokeloader
behavioral1/memory/500-2165-0x0000000000400000-0x0000000000409000-memory.dmp	family_smokeloader
behavioral1/memory/5108-2194-0x0000000000402DD8-mapping.dmp	family_smokeloader
behavioral1/memory/5108-2225-0x0000000000400000-0x0000000000409000-memory.dmp	family_smokeloader
behavioral1/memory/5108-2226-0x0000000000400000-0x0000000000409000-memory.dmp	family_smokeloader

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/memory/4756-741-0x0000000004990000-0x00000000049DC000-memory.dmp	family_redline
behavioral1/memory/4756-748-0x0000000004A20000-0x0000000004A6A000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Executes dropped EXE 24 IoCs

pid	Process
3968	2fa992dea738a84ae8b297214ae3da1bc03591b05f4b2c0f3883270ece33a352.exe
4104	qlevblulz.exe
3708	qlevblulz.exe
3060	2fa992dea738a84ae8b297214ae3da1bc03591b05f4b2c0f3883270ece33a352.exe
2336	qlevblulz.exe
4924	qlevblulz.exe
1316	2fa992dea738a84ae8b297214ae3da1bc03591b05f4b2c0f3883270ece33a352.exe
2204	qlevblulz.exe
3632	qlevblulz.exe
4756	61a7fcc7fc8b643e115022a1c0e011ea2c3c53e44e7c96b9260378edba5e6ea7.exe
3356	61a7fcc7fc8b643e115022a1c0e011ea2c3c53e44e7c96b9260378edba5e6ea7.exe
364	2fa992dea738a84ae8b297214ae3da1bc03591b05f4b2c0f3883270ece33a352.exe
3384	qlevblulz.exe
1872	qlevblulz.exe
2704	qlevblulz.exe
4724	qlevblulz.exe
1688	qlevblulz.exe
2520	qlevblulz.exe
3412	qlevblulz.exe
2748	ChromeRecovery.exe
416	deeac2896e04b64a94004463b2332f27d9d96fae2c1c1179d54e492d715ce66a.exe
500	deeac2896e04b64a94004463b2332f27d9d96fae2c1c1179d54e492d715ce66a.exe
3528	deeac2896e04b64a94004463b2332f27d9d96fae2c1c1179d54e492d715ce66a.exe
5108	deeac2896e04b64a94004463b2332f27d9d96fae2c1c1179d54e492d715ce66a.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 12 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	qlevblulz.exe
Key opened	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	qlevblulz.exe
Key opened	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	qlevblulz.exe
Key opened	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	qlevblulz.exe
Key opened	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	qlevblulz.exe
Key opened	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	qlevblulz.exe
Key opened	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	qlevblulz.exe
Key opened	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	qlevblulz.exe
Key opened	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	qlevblulz.exe
Key opened	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	qlevblulz.exe
Key opened	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	qlevblulz.exe
Key opened	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	qlevblulz.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows\CurrentVersion\Run\RMBJLaF = "C:\\Users\\Admin\\AppData\\Roaming\\RMBJLaF\\RMBJLaF.exe"	qlevblulz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows\CurrentVersion\Run\RMBJLaF = "C:\\Users\\Admin\\AppData\\Roaming\\RMBJLaF\\RMBJLaF.exe"	qlevblulz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows\CurrentVersion\Run\RMBJLaF = "C:\\Users\\Admin\\AppData\\Roaming\\RMBJLaF\\RMBJLaF.exe"	qlevblulz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows\CurrentVersion\Run\RMBJLaF = "C:\\Users\\Admin\\AppData\\Roaming\\RMBJLaF\\RMBJLaF.exe"	qlevblulz.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 7 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
99	api.ipify.org
103	api.ipify.org
185	api.ipify.org
293	ipinfo.io
326	ipinfo.io
97	api.ipify.org
98	api.ipify.org

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 4104 set thread context of 3708	4104	qlevblulz.exe	102
PID 2336 set thread context of 4924	2336	qlevblulz.exe	106
PID 2204 set thread context of 3632	2204	qlevblulz.exe	110
PID 3384 set thread context of 3412	3384	qlevblulz.exe	166
PID 416 set thread context of 500	416	deeac2896e04b64a94004463b2332f27d9d96fae2c1c1179d54e492d715ce66a.exe	245
PID 3528 set thread context of 5108	3528	deeac2896e04b64a94004463b2332f27d9d96fae2c1c1179d54e492d715ce66a.exe	247

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1124_2005431505\ChromeRecoveryCRX.crx	elevation_service.exe
File created	C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1124_2005431505\ChromeRecovery.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1124_2005431505\ChromeRecovery.exe	elevation_service.exe
File created	C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1124_2005431505\manifest.json	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1124_2005431505\manifest.json	elevation_service.exe
File created	C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1124_2005431505\_metadata\verified_contents.json	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1124_2005431505\_metadata\verified_contents.json	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	deeac2896e04b64a94004463b2332f27d9d96fae2c1c1179d54e492d715ce66a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	deeac2896e04b64a94004463b2332f27d9d96fae2c1c1179d54e492d715ce66a.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	deeac2896e04b64a94004463b2332f27d9d96fae2c1c1179d54e492d715ce66a.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	deeac2896e04b64a94004463b2332f27d9d96fae2c1c1179d54e492d715ce66a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	deeac2896e04b64a94004463b2332f27d9d96fae2c1c1179d54e492d715ce66a.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	deeac2896e04b64a94004463b2332f27d9d96fae2c1c1179d54e492d715ce66a.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5008	chrome.exe
5008	chrome.exe
4248	chrome.exe
4248	chrome.exe
4616	chrome.exe
4616	chrome.exe
4456	chrome.exe
4456	chrome.exe
4700	chrome.exe
4700	chrome.exe
4748	chrome.exe
4748	chrome.exe
388	chrome.exe
388	chrome.exe
2160	chrome.exe
2160	chrome.exe
1908	chrome.exe
1908	chrome.exe
1944	chrome.exe
1944	chrome.exe
1944	chrome.exe
1944	chrome.exe
3708	qlevblulz.exe
3708	qlevblulz.exe
3708	qlevblulz.exe
4924	qlevblulz.exe
4924	qlevblulz.exe
4924	qlevblulz.exe
3632	qlevblulz.exe
3632	qlevblulz.exe
3632	qlevblulz.exe
1236	chrome.exe
1236	chrome.exe
4908	chrome.exe
4908	chrome.exe
4756	61a7fcc7fc8b643e115022a1c0e011ea2c3c53e44e7c96b9260378edba5e6ea7.exe
3356	61a7fcc7fc8b643e115022a1c0e011ea2c3c53e44e7c96b9260378edba5e6ea7.exe
2720	sdiagnhost.exe
2720	sdiagnhost.exe
4456	chrome.exe
4456	chrome.exe
800	chrome.exe
800	chrome.exe
3412	qlevblulz.exe
3412	qlevblulz.exe
3412	qlevblulz.exe
2056	chrome.exe
2056	chrome.exe
164	chrome.exe
164	chrome.exe
672	chrome.exe
672	chrome.exe
2768	chrome.exe
2768	chrome.exe
500	deeac2896e04b64a94004463b2332f27d9d96fae2c1c1179d54e492d715ce66a.exe
500	deeac2896e04b64a94004463b2332f27d9d96fae2c1c1179d54e492d715ce66a.exe
2588	Process not Found
2588	Process not Found
2588	Process not Found
2588	Process not Found
2588	Process not Found
2588	Process not Found
2588	Process not Found
2588	Process not Found

Suspicious behavior: MapViewOfSection 11 IoCs

pid	Process
4104	qlevblulz.exe
2336	qlevblulz.exe
2204	qlevblulz.exe
3384	qlevblulz.exe
3384	qlevblulz.exe
3384	qlevblulz.exe
3384	qlevblulz.exe
3384	qlevblulz.exe
3384	qlevblulz.exe
500	deeac2896e04b64a94004463b2332f27d9d96fae2c1c1179d54e492d715ce66a.exe
5108	deeac2896e04b64a94004463b2332f27d9d96fae2c1c1179d54e492d715ce66a.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 39 IoCs

pid	Process
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe

Suspicious use of AdjustPrivilegeToken 31 IoCs

description	pid	Process
Token: SeRestorePrivilege	3904	7zG.exe
Token: 35	3904	7zG.exe
Token: SeSecurityPrivilege	3904	7zG.exe
Token: SeSecurityPrivilege	3904	7zG.exe
Token: SeDebugPrivilege	3708	qlevblulz.exe
Token: SeDebugPrivilege	4924	qlevblulz.exe
Token: SeDebugPrivilege	3632	qlevblulz.exe
Token: SeRestorePrivilege	3484	7zG.exe
Token: 35	3484	7zG.exe
Token: SeSecurityPrivilege	3484	7zG.exe
Token: SeSecurityPrivilege	3484	7zG.exe
Token: SeDebugPrivilege	4756	61a7fcc7fc8b643e115022a1c0e011ea2c3c53e44e7c96b9260378edba5e6ea7.exe
Token: SeDebugPrivilege	3356	61a7fcc7fc8b643e115022a1c0e011ea2c3c53e44e7c96b9260378edba5e6ea7.exe
Token: SeDebugPrivilege	2720	sdiagnhost.exe
Token: SeDebugPrivilege	3412	qlevblulz.exe
Token: SeRestorePrivilege	1888	7zG.exe
Token: 35	1888	7zG.exe
Token: SeSecurityPrivilege	1888	7zG.exe
Token: SeSecurityPrivilege	1888	7zG.exe
Token: SeRestorePrivilege	3408	7zG.exe
Token: 35	3408	7zG.exe
Token: SeSecurityPrivilege	3408	7zG.exe
Token: SeSecurityPrivilege	3408	7zG.exe
Token: SeShutdownPrivilege	2588	Process not Found
Token: SeCreatePagefilePrivilege	2588	Process not Found
Token: SeShutdownPrivilege	2588	Process not Found
Token: SeCreatePagefilePrivilege	2588	Process not Found
Token: SeShutdownPrivilege	2588	Process not Found
Token: SeCreatePagefilePrivilege	2588	Process not Found
Token: SeShutdownPrivilege	2588	Process not Found
Token: SeCreatePagefilePrivilege	2588	Process not Found

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
3904	7zG.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
3484	7zG.exe
4372	msdt.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
2832	OpenWith.exe
2832	OpenWith.exe
2832	OpenWith.exe
2832	OpenWith.exe
2832	OpenWith.exe
2832	OpenWith.exe
2832	OpenWith.exe
3200	AcroRd32.exe
3200	AcroRd32.exe
3200	AcroRd32.exe
3200	AcroRd32.exe
3200	AcroRd32.exe
2588	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4248 wrote to memory of 4996	4248	chrome.exe	66
PID 4248 wrote to memory of 4996	4248	chrome.exe	66
PID 4248 wrote to memory of 4508	4248	chrome.exe	68
PID 4248 wrote to memory of 4508	4248	chrome.exe	68
PID 4248 wrote to memory of 4508	4248	chrome.exe	68
PID 4248 wrote to memory of 4508	4248	chrome.exe	68
PID 4248 wrote to memory of 4508	4248	chrome.exe	68
PID 4248 wrote to memory of 4508	4248	chrome.exe	68
PID 4248 wrote to memory of 4508	4248	chrome.exe	68
PID 4248 wrote to memory of 4508	4248	chrome.exe	68
PID 4248 wrote to memory of 4508	4248	chrome.exe	68
PID 4248 wrote to memory of 4508	4248	chrome.exe	68
PID 4248 wrote to memory of 4508	4248	chrome.exe	68
PID 4248 wrote to memory of 4508	4248	chrome.exe	68
PID 4248 wrote to memory of 4508	4248	chrome.exe	68
PID 4248 wrote to memory of 4508	4248	chrome.exe	68
PID 4248 wrote to memory of 4508	4248	chrome.exe	68
PID 4248 wrote to memory of 4508	4248	chrome.exe	68
PID 4248 wrote to memory of 4508	4248	chrome.exe	68
PID 4248 wrote to memory of 4508	4248	chrome.exe	68
PID 4248 wrote to memory of 4508	4248	chrome.exe	68
PID 4248 wrote to memory of 4508	4248	chrome.exe	68
PID 4248 wrote to memory of 4508	4248	chrome.exe	68
PID 4248 wrote to memory of 4508	4248	chrome.exe	68
PID 4248 wrote to memory of 4508	4248	chrome.exe	68
PID 4248 wrote to memory of 4508	4248	chrome.exe	68
PID 4248 wrote to memory of 4508	4248	chrome.exe	68
PID 4248 wrote to memory of 4508	4248	chrome.exe	68
PID 4248 wrote to memory of 4508	4248	chrome.exe	68
PID 4248 wrote to memory of 4508	4248	chrome.exe	68
PID 4248 wrote to memory of 4508	4248	chrome.exe	68
PID 4248 wrote to memory of 4508	4248	chrome.exe	68
PID 4248 wrote to memory of 4508	4248	chrome.exe	68
PID 4248 wrote to memory of 4508	4248	chrome.exe	68
PID 4248 wrote to memory of 4508	4248	chrome.exe	68
PID 4248 wrote to memory of 4508	4248	chrome.exe	68
PID 4248 wrote to memory of 4508	4248	chrome.exe	68
PID 4248 wrote to memory of 4508	4248	chrome.exe	68
PID 4248 wrote to memory of 4508	4248	chrome.exe	68
PID 4248 wrote to memory of 4508	4248	chrome.exe	68
PID 4248 wrote to memory of 4508	4248	chrome.exe	68
PID 4248 wrote to memory of 4508	4248	chrome.exe	68
PID 4248 wrote to memory of 5008	4248	chrome.exe	69
PID 4248 wrote to memory of 5008	4248	chrome.exe	69
PID 4248 wrote to memory of 3576	4248	chrome.exe	70
PID 4248 wrote to memory of 3576	4248	chrome.exe	70
PID 4248 wrote to memory of 3576	4248	chrome.exe	70
PID 4248 wrote to memory of 3576	4248	chrome.exe	70
PID 4248 wrote to memory of 3576	4248	chrome.exe	70
PID 4248 wrote to memory of 3576	4248	chrome.exe	70
PID 4248 wrote to memory of 3576	4248	chrome.exe	70
PID 4248 wrote to memory of 3576	4248	chrome.exe	70
PID 4248 wrote to memory of 3576	4248	chrome.exe	70
PID 4248 wrote to memory of 3576	4248	chrome.exe	70
PID 4248 wrote to memory of 3576	4248	chrome.exe	70
PID 4248 wrote to memory of 3576	4248	chrome.exe	70
PID 4248 wrote to memory of 3576	4248	chrome.exe	70
PID 4248 wrote to memory of 3576	4248	chrome.exe	70
PID 4248 wrote to memory of 3576	4248	chrome.exe	70
PID 4248 wrote to memory of 3576	4248	chrome.exe	70
PID 4248 wrote to memory of 3576	4248	chrome.exe	70
PID 4248 wrote to memory of 3576	4248	chrome.exe	70
PID 4248 wrote to memory of 3576	4248	chrome.exe	70
PID 4248 wrote to memory of 3576	4248	chrome.exe	70

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	qlevblulz.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	qlevblulz.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" https://bazaar.abuse.ch/browse/
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffb275c4f50,0x7ffb275c4f60,0x7ffb275c4f70
  2⤵
  PID:4996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1636 /prefetch:2
  2⤵
  PID:4508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1684 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1672 /prefetch:8
  2⤵
  PID:3576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2808 /prefetch:1
  2⤵
  PID:4020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2800 /prefetch:1
  2⤵
  PID:3700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4324 /prefetch:8
  2⤵
  PID:2552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4040 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4152 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4688 /prefetch:8
  2⤵
  PID:700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5076 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4652 /prefetch:8
  2⤵
  PID:3800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:4596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4672 /prefetch:8
  2⤵
  PID:4804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4168 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4724 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=772 /prefetch:8
  2⤵
  PID:1736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2028 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1628 /prefetch:8
  2⤵
  PID:1836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4564 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4164 /prefetch:8
  2⤵
  PID:1460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3492 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2484 /prefetch:8
  2⤵
  PID:3412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4536 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2032 /prefetch:8
  2⤵
  PID:2380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4724 /prefetch:8
  2⤵
  PID:820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4992 /prefetch:8
  2⤵
  PID:4784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4724 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4724 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3088 /prefetch:8
  2⤵
  PID:1128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:2892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4036 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4180 /prefetch:8
  2⤵
  PID:1356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4344 /prefetch:8
  2⤵
  PID:1132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  PID:616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  PID:3348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5756 /prefetch:8
  2⤵
  PID:3344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5748 /prefetch:8
  2⤵
  PID:2464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  PID:4492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5640 /prefetch:8
  2⤵
  PID:3200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5532 /prefetch:8
  2⤵
  PID:212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  PID:2340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:2204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4320 /prefetch:1
  2⤵
  PID:3968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:3712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3156 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:3888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1968 /prefetch:8
  2⤵
  PID:1044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4544 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4040 /prefetch:1
  2⤵
  PID:3584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5732 /prefetch:8
  2⤵
  PID:232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5976 /prefetch:8
  2⤵
  PID:4104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:2744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:4840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:2960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6004 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4860 /prefetch:8
  2⤵
  PID:4400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
  2⤵
  PID:416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5972 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4032 /prefetch:8
  2⤵
  PID:4244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6112 /prefetch:8
  2⤵
  PID:4424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4184 /prefetch:8
  2⤵
  PID:4732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6248 /prefetch:8
  2⤵
  PID:940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4256 /prefetch:8
  2⤵
  PID:420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5616 /prefetch:8
  2⤵
  PID:4920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4180 /prefetch:8
  2⤵
  PID:2756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6276 /prefetch:8
  2⤵
  PID:588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6268 /prefetch:8
  2⤵
  PID:1476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6296 /prefetch:8
  2⤵
  PID:4536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6180 /prefetch:8
  2⤵
  PID:1584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6252 /prefetch:8
  2⤵
  PID:4492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=76 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=77 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=78 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:1692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=79 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=80 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6244 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=81 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:1464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=82 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6240 /prefetch:1
  2⤵
  PID:3296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=83 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4664 /prefetch:8
  2⤵
  PID:4704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=85 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:3060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4548 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=87 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2852 /prefetch:1
  2⤵
  PID:396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=88 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=89 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6588 /prefetch:1
  2⤵
  PID:1000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=90 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6656 /prefetch:1
  2⤵
  PID:1812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=91 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7120 /prefetch:1
  2⤵
  PID:2784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4928 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=93 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:2544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=94 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7060 /prefetch:8
  2⤵
  PID:2768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7148 /prefetch:8
  2⤵
  PID:376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6740 /prefetch:8
  2⤵
  PID:3628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6812 /prefetch:8
  2⤵
  PID:1508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6800 /prefetch:8
  2⤵
  PID:3952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6976 /prefetch:8
  2⤵
  PID:3840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6836 /prefetch:8
  2⤵
  PID:1316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7052 /prefetch:8
  2⤵
  PID:308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7124 /prefetch:8
  2⤵
  PID:4004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6472 /prefetch:8
  2⤵
  PID:3240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=105 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7108 /prefetch:1
  2⤵
  PID:1324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=106 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=107 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:4916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7120 /prefetch:8
  2⤵
  PID:4660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6920 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5728 /prefetch:8
  2⤵
  PID:3236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:3736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7112 /prefetch:8
  2⤵
  PID:2028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6516 /prefetch:8
  2⤵
  PID:1360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6264 /prefetch:8
  2⤵
  PID:1868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4136 /prefetch:8
  2⤵
  PID:4492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6644 /prefetch:8
  2⤵
  PID:1624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6592 /prefetch:8
  2⤵
  PID:348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  PID:2748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6520 /prefetch:8
  2⤵
  PID:800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=121 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=122 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6996 /prefetch:1
  2⤵
  PID:1916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1624,14901127334871456360,3563709581862115663,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2768

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:308

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap21012:190:7zEvent9129
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3904

C:\Users\Admin\Downloads\2fa992dea738a84ae8b297214ae3da1bc03591b05f4b2c0f3883270ece33a352.exe
"C:\Users\Admin\Downloads\2fa992dea738a84ae8b297214ae3da1bc03591b05f4b2c0f3883270ece33a352.exe"
1⤵
- Executes dropped EXE
PID:3968
- C:\Users\Admin\AppData\Local\Temp\qlevblulz.exe
  "C:\Users\Admin\AppData\Local\Temp\qlevblulz.exe" C:\Users\Admin\AppData\Local\Temp\lrnfelc.qi
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  PID:4104
- - C:\Users\Admin\AppData\Local\Temp\qlevblulz.exe
    "C:\Users\Admin\AppData\Local\Temp\qlevblulz.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3708

C:\Users\Admin\Downloads\2fa992dea738a84ae8b297214ae3da1bc03591b05f4b2c0f3883270ece33a352.exe
"C:\Users\Admin\Downloads\2fa992dea738a84ae8b297214ae3da1bc03591b05f4b2c0f3883270ece33a352.exe"
1⤵
- Executes dropped EXE
PID:3060
- C:\Users\Admin\AppData\Local\Temp\qlevblulz.exe
  "C:\Users\Admin\AppData\Local\Temp\qlevblulz.exe" C:\Users\Admin\AppData\Local\Temp\lrnfelc.qi
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  PID:2336
- - C:\Users\Admin\AppData\Local\Temp\qlevblulz.exe
    "C:\Users\Admin\AppData\Local\Temp\qlevblulz.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4924

C:\Users\Admin\Downloads\2fa992dea738a84ae8b297214ae3da1bc03591b05f4b2c0f3883270ece33a352.exe
"C:\Users\Admin\Downloads\2fa992dea738a84ae8b297214ae3da1bc03591b05f4b2c0f3883270ece33a352.exe"
1⤵
- Executes dropped EXE
PID:1316
- C:\Users\Admin\AppData\Local\Temp\qlevblulz.exe
  "C:\Users\Admin\AppData\Local\Temp\qlevblulz.exe" C:\Users\Admin\AppData\Local\Temp\lrnfelc.qi
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  PID:2204
- - C:\Users\Admin\AppData\Local\Temp\qlevblulz.exe
    "C:\Users\Admin\AppData\Local\Temp\qlevblulz.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3632

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\61a7fcc7fc8b643e115022a1c0e011ea2c3c53e44e7c96b9260378edba5e6ea7\" -spe -an -ai#7zMap32605:190:7zEvent21458
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3484

C:\Users\Admin\Downloads\61a7fcc7fc8b643e115022a1c0e011ea2c3c53e44e7c96b9260378edba5e6ea7\61a7fcc7fc8b643e115022a1c0e011ea2c3c53e44e7c96b9260378edba5e6ea7.exe
"C:\Users\Admin\Downloads\61a7fcc7fc8b643e115022a1c0e011ea2c3c53e44e7c96b9260378edba5e6ea7\61a7fcc7fc8b643e115022a1c0e011ea2c3c53e44e7c96b9260378edba5e6ea7.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4756

C:\Users\Admin\Downloads\61a7fcc7fc8b643e115022a1c0e011ea2c3c53e44e7c96b9260378edba5e6ea7\61a7fcc7fc8b643e115022a1c0e011ea2c3c53e44e7c96b9260378edba5e6ea7.exe
"C:\Users\Admin\Downloads\61a7fcc7fc8b643e115022a1c0e011ea2c3c53e44e7c96b9260378edba5e6ea7\61a7fcc7fc8b643e115022a1c0e011ea2c3c53e44e7c96b9260378edba5e6ea7.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3356

C:\Windows\system32\pcwrun.exe
C:\Windows\system32\pcwrun.exe "C:\Users\Admin\Downloads\61a7fcc7fc8b643e115022a1c0e011ea2c3c53e44e7c96b9260378edba5e6ea7\61a7fcc7fc8b643e115022a1c0e011ea2c3c53e44e7c96b9260378edba5e6ea7.exe" ContextMenu
1⤵
PID:4596
- C:\Windows\System32\msdt.exe
  C:\Windows\System32\msdt.exe -path C:\Windows\diagnostics\index\PCWDiagnostic.xml -af C:\Users\Admin\AppData\Local\Temp\PCW5030.xml /skip TRUE
  2⤵
  - Suspicious use of FindShellTrayWindow
  PID:4372

C:\Windows\System32\sdiagnhost.exe
C:\Windows\System32\sdiagnhost.exe -Embedding
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2720
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\taagmgpt\taagmgpt.cmdline"
  2⤵
  PID:4416
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5792.tmp" "c:\Users\Admin\AppData\Local\Temp\taagmgpt\CSCF38629E1CF424AF69AA658BBD2858262.TMP"
    3⤵
    PID:5092
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wjl2yzay\wjl2yzay.cmdline"
  2⤵
  PID:3556
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES58AC.tmp" "c:\Users\Admin\AppData\Local\Temp\wjl2yzay\CSC9535DD1A0F4785A75CC9FB60199B.TMP"
    3⤵
    PID:4740
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\30x0t3jo\30x0t3jo.cmdline"
  2⤵
  PID:4104
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5D9D.tmp" "c:\Users\Admin\AppData\Local\Temp\30x0t3jo\CSCADD9EE43EE434A8788CBDCE36A25D95.TMP"
    3⤵
    PID:1124

C:\Users\Admin\Downloads\2fa992dea738a84ae8b297214ae3da1bc03591b05f4b2c0f3883270ece33a352.exe
"C:\Users\Admin\Downloads\2fa992dea738a84ae8b297214ae3da1bc03591b05f4b2c0f3883270ece33a352.exe"
1⤵
- Executes dropped EXE
PID:364
- C:\Users\Admin\AppData\Local\Temp\qlevblulz.exe
  "C:\Users\Admin\AppData\Local\Temp\qlevblulz.exe" C:\Users\Admin\AppData\Local\Temp\lrnfelc.qi
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  PID:3384
- - C:\Users\Admin\AppData\Local\Temp\qlevblulz.exe
    "C:\Users\Admin\AppData\Local\Temp\qlevblulz.exe"
    3⤵
    - Executes dropped EXE
    PID:1872
- - C:\Users\Admin\AppData\Local\Temp\qlevblulz.exe
    "C:\Users\Admin\AppData\Local\Temp\qlevblulz.exe"
    3⤵
    - Executes dropped EXE
    PID:2704
- - C:\Users\Admin\AppData\Local\Temp\qlevblulz.exe
    "C:\Users\Admin\AppData\Local\Temp\qlevblulz.exe"
    3⤵
    - Executes dropped EXE
    PID:4724
- - C:\Users\Admin\AppData\Local\Temp\qlevblulz.exe
    "C:\Users\Admin\AppData\Local\Temp\qlevblulz.exe"
    3⤵
    - Executes dropped EXE
    PID:1688
- - C:\Users\Admin\AppData\Local\Temp\qlevblulz.exe
    "C:\Users\Admin\AppData\Local\Temp\qlevblulz.exe"
    3⤵
    - Executes dropped EXE
    PID:2520
- - C:\Users\Admin\AppData\Local\Temp\qlevblulz.exe
    "C:\Users\Admin\AppData\Local\Temp\qlevblulz.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:3412

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2832

C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"
1⤵
- Drops file in Program Files directory
PID:1124
- C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1124_2005431505\ChromeRecovery.exe
  "C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1124_2005431505\ChromeRecovery.exe" --appguid={8A69D345-D564-463c-AFF1-A69D9E530F96} --browser-version=89.0.4389.114 --sessionid={71a63db2-83e9-486c-ab9b-d6aabd3a8bb0} --system
  2⤵
  - Executes dropped EXE
  PID:2748

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\APT.Collection.2010\" -spe -an -ai#7zMap18496:98:7zEvent15832
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1888

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Downloads\APT.Collection.2010\2010\2010.01.01\Paper\Case Study Operation Aurora.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3200
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  PID:4768
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=910E6F531B987E509E2D472F6E957B57 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=910E6F531B987E509E2D472F6E957B57 --renderer-client-id=2 --mojo-platform-channel-handle=1624 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:2716
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=5F8B9BDEFE08DD0C595E327513812A00 --mojo-platform-channel-handle=1672 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1632
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=6D605AD1147CA179DBDA158B3EA2BA7B --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=6D605AD1147CA179DBDA158B3EA2BA7B --renderer-client-id=4 --mojo-platform-channel-handle=1988 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:2028
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  PID:4488
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=640C97E78ED4CB0902990CE09EABE246 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=640C97E78ED4CB0902990CE09EABE246 --renderer-client-id=2 --mojo-platform-channel-handle=1576 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:4928
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=8B1B6DB53B7F62228952E4E1403B006E --mojo-platform-channel-handle=1660 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1352
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=7A483FB0175CA4805FBF7C292F167CDA --mojo-platform-channel-handle=2236 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3632
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0CC115F74AFDFE05576C428A8A61481B --mojo-platform-channel-handle=1944 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2832
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=03CD6A9DFCDAC67AAAC53C5D3B9A2BE1 --mojo-platform-channel-handle=1988 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1584

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\deeac2896e04b64a94004463b2332f27d9d96fae2c1c1179d54e492d715ce66a\" -spe -an -ai#7zMap31752:190:7zEvent24867
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3408

C:\Users\Admin\Downloads\deeac2896e04b64a94004463b2332f27d9d96fae2c1c1179d54e492d715ce66a\deeac2896e04b64a94004463b2332f27d9d96fae2c1c1179d54e492d715ce66a.exe
"C:\Users\Admin\Downloads\deeac2896e04b64a94004463b2332f27d9d96fae2c1c1179d54e492d715ce66a\deeac2896e04b64a94004463b2332f27d9d96fae2c1c1179d54e492d715ce66a.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:416
- C:\Users\Admin\Downloads\deeac2896e04b64a94004463b2332f27d9d96fae2c1c1179d54e492d715ce66a\deeac2896e04b64a94004463b2332f27d9d96fae2c1c1179d54e492d715ce66a.exe
  "C:\Users\Admin\Downloads\deeac2896e04b64a94004463b2332f27d9d96fae2c1c1179d54e492d715ce66a\deeac2896e04b64a94004463b2332f27d9d96fae2c1c1179d54e492d715ce66a.exe"
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:500

C:\Users\Admin\Downloads\deeac2896e04b64a94004463b2332f27d9d96fae2c1c1179d54e492d715ce66a\deeac2896e04b64a94004463b2332f27d9d96fae2c1c1179d54e492d715ce66a.exe
"C:\Users\Admin\Downloads\deeac2896e04b64a94004463b2332f27d9d96fae2c1c1179d54e492d715ce66a\deeac2896e04b64a94004463b2332f27d9d96fae2c1c1179d54e492d715ce66a.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3528
- C:\Users\Admin\Downloads\deeac2896e04b64a94004463b2332f27d9d96fae2c1c1179d54e492d715ce66a\deeac2896e04b64a94004463b2332f27d9d96fae2c1c1179d54e492d715ce66a.exe
  "C:\Users\Admin\Downloads\deeac2896e04b64a94004463b2332f27d9d96fae2c1c1179d54e492d715ce66a\deeac2896e04b64a94004463b2332f27d9d96fae2c1c1179d54e492d715ce66a.exe"
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Suspicious behavior: MapViewOfSection
  PID:5108

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cookies

Filesize
20KB

MD5
cf131102f4bb58ebeba4bf5c8ce8f9c2

SHA1
a8c14190fa6bacbf7ce17b226a7fa5970a74fee4

SHA256
324a8105b828d44b887d4b6f14562a6d7e63900636cbe449ccea397c60afd219

SHA512
31c76f818a3c25b234f3dc4ec418f7368b21f9ce9c53aa102e2b5fa293a7d6160c65f3d1b7a7c90fb6bb4262499689e8c40a7b549421a378e192fcddc9143540

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
109KB

MD5
a179ae8b72ce7a065947ef1da8fb2298

SHA1
b6e5a6bd4e96b541c7f4add4922834977e41f6e9

SHA256
dc0fc70f880335c7d991d876d8c84e840ec085bc9acd8b1fcd10516c59f135ab

SHA512
6625dad03126ce9fb77e8b224fdc7ee4d759a4d7e740a7c7e8dd2ba59fc714a311a79b719a8fa98ebd3cce3fdd84b832bb181017a7439f1ba9d95abefd79f8f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\61a7fcc7fc8b643e115022a1c0e011ea2c3c53e44e7c96b9260378edba5e6ea7.exe.log

Filesize
2KB

MD5
f585046548c16f43eccb9c5fe3d8a523

SHA1
1de8138f79265ec26e84b16001c20ffa6035e62a

SHA256
d3cb12e2623a0dedf798ab16f1dfb46cfff6a5126d5ccaefc47a01e64c6a2c99

SHA512
df3c720e46b2c08ca741aaed34617fcc374c419db78375a22eb3a44686244d3bd519cd241390366bb922f5b6bb717900c8e2506b9af0b4fa60ea994dfe7e2fec

Download Submit
C:\Users\Admin\AppData\Local\Temp\PCW5030.xml

Filesize
956B

MD5
8aa488983f89810525daa79c0eba8d59

SHA1
9faeb52eb1c0de5b407dbc0bd6f7eabe87f5b9cf

SHA256
cf1f7bd10d4694712b155c61c9b446334b7eef300df87e2393a1d000ccb13171

SHA512
3c64266ae70d7c4948eb0a8d853e8d6df45ba48898219fbcde15c5a11ee6f9b3ff4f3678e451bb42d5ccea9bcc3a83459764bc1edd228820b9ec06476bba4ca5

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES5792.tmp

Filesize
1KB

MD5
b1d8647d4aaea84b668ae8837367360e

SHA1
c6a08e176ab95405d47ef8b6c60ba7528ee23981

SHA256
0c67c0cad2024245c734ce73665ea2ffc8bcc2f975d0beb7462f96da74e1d248

SHA512
16fd8617179ce5d0fbbd620a435234918b7bc1213d5d78e2f6be7183c38c3ff502cb90dc3ee913400b5aaaa29b09dfec40d7c37a9725c5bb95ef8b07ddd9c05a

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES58AC.tmp

Filesize
1KB

MD5
cc26a3e4c8c8d899607ce27c3fe101d4

SHA1
1e620d864ed306602362758b39d34473fe72f84b

SHA256
4b351cc205b1c300189e6af5a894ed57936b56c51cc5fbfce0aa385dada8e0bf

SHA512
9bdfcba0accb8470f77f8d2c592908b72ea91f693a919eb857eb96fea431838b40201514512d9de099b407a717d445b9874410d344cb50ac713361ad597a8e12

Download Submit
C:\Users\Admin\AppData\Local\Temp\hurby.rp

Filesize
258KB

MD5
7716b139bf69194e1e4a912b5fe356ad

SHA1
0f14856e7b267e083354765993b0610349f8de47

SHA256
0784e12085014bca3f4cc0f84c84d16fe816531551ff74f147536e654706fbd3

SHA512
b76c5885228b780e25c1eb2be87b1e7f98fa4993cbd72ed8517531db4fd981257db6bc662df8948f67541ff8313e0d9b167dc02296f3310ddb7a8adcc43b0a42

Download Submit
C:\Users\Admin\AppData\Local\Temp\lrnfelc.qi

Filesize
5KB

MD5
c752cad844aa23df14753f3a853bceb5

SHA1
9adf811f5e4473de5f898493eb18594b1f275187

SHA256
f2478acd28357b5edf692e0f56ebec934f40bb2281419cb6fca93c4b4a213b7c

SHA512
cd91f31fdea7367e20edbaef1d168b4808b1552451b9234db00b869d3db91e163db414e78520d8e398b299d20ec1055d8efe81f95107f589f4d267ced8eb4b64

Download Submit
C:\Users\Admin\AppData\Local\Temp\qlevblulz.exe

Filesize
12KB

MD5
c31efc7da96f370d02425c1c70fc4d23

SHA1
1d7d818b5430442ea5c1ce4cf685a0033b9b0b18

SHA256
59fa08469aaf924187d9d28a4a2e829aa2ce9b6083d9b7ced5e98302ca4eefab

SHA512
2d96fd98a8ee366eac2de9394b8244b394b9610752c400e2257f31ebe5802f21fa95990cf44062f3840b7468be747f629fab0be81963b9a7b9e3faac06d7c26c

Download Submit
C:\Users\Admin\AppData\Local\Temp\qlevblulz.exe

Filesize
12KB

MD5
c31efc7da96f370d02425c1c70fc4d23

SHA1
1d7d818b5430442ea5c1ce4cf685a0033b9b0b18

SHA256
59fa08469aaf924187d9d28a4a2e829aa2ce9b6083d9b7ced5e98302ca4eefab

SHA512
2d96fd98a8ee366eac2de9394b8244b394b9610752c400e2257f31ebe5802f21fa95990cf44062f3840b7468be747f629fab0be81963b9a7b9e3faac06d7c26c

Download Submit
C:\Users\Admin\AppData\Local\Temp\qlevblulz.exe

Filesize
12KB

MD5
c31efc7da96f370d02425c1c70fc4d23

SHA1
1d7d818b5430442ea5c1ce4cf685a0033b9b0b18

SHA256
59fa08469aaf924187d9d28a4a2e829aa2ce9b6083d9b7ced5e98302ca4eefab

SHA512
2d96fd98a8ee366eac2de9394b8244b394b9610752c400e2257f31ebe5802f21fa95990cf44062f3840b7468be747f629fab0be81963b9a7b9e3faac06d7c26c

Download Submit
C:\Users\Admin\AppData\Local\Temp\qlevblulz.exe

Filesize
12KB

MD5
c31efc7da96f370d02425c1c70fc4d23

SHA1
1d7d818b5430442ea5c1ce4cf685a0033b9b0b18

SHA256
59fa08469aaf924187d9d28a4a2e829aa2ce9b6083d9b7ced5e98302ca4eefab

SHA512
2d96fd98a8ee366eac2de9394b8244b394b9610752c400e2257f31ebe5802f21fa95990cf44062f3840b7468be747f629fab0be81963b9a7b9e3faac06d7c26c

Download Submit
C:\Users\Admin\AppData\Local\Temp\qlevblulz.exe

Filesize
12KB

MD5
c31efc7da96f370d02425c1c70fc4d23

SHA1
1d7d818b5430442ea5c1ce4cf685a0033b9b0b18

SHA256
59fa08469aaf924187d9d28a4a2e829aa2ce9b6083d9b7ced5e98302ca4eefab

SHA512
2d96fd98a8ee366eac2de9394b8244b394b9610752c400e2257f31ebe5802f21fa95990cf44062f3840b7468be747f629fab0be81963b9a7b9e3faac06d7c26c

Download Submit
C:\Users\Admin\AppData\Local\Temp\qlevblulz.exe

Filesize
12KB

MD5
c31efc7da96f370d02425c1c70fc4d23

SHA1
1d7d818b5430442ea5c1ce4cf685a0033b9b0b18

SHA256
59fa08469aaf924187d9d28a4a2e829aa2ce9b6083d9b7ced5e98302ca4eefab

SHA512
2d96fd98a8ee366eac2de9394b8244b394b9610752c400e2257f31ebe5802f21fa95990cf44062f3840b7468be747f629fab0be81963b9a7b9e3faac06d7c26c

Download Submit
C:\Users\Admin\AppData\Local\Temp\qlevblulz.exe

Filesize
12KB

MD5
c31efc7da96f370d02425c1c70fc4d23

SHA1
1d7d818b5430442ea5c1ce4cf685a0033b9b0b18

SHA256
59fa08469aaf924187d9d28a4a2e829aa2ce9b6083d9b7ced5e98302ca4eefab

SHA512
2d96fd98a8ee366eac2de9394b8244b394b9610752c400e2257f31ebe5802f21fa95990cf44062f3840b7468be747f629fab0be81963b9a7b9e3faac06d7c26c

Download Submit
C:\Users\Admin\AppData\Local\Temp\taagmgpt\taagmgpt.dll

Filesize
5KB

MD5
6dbc89da19b6bfbeaf384788c35962aa

SHA1
8d8a434bf32310886c635dda2224a99b34b59223

SHA256
5a718b5cd0d65b20937fe689a4cdf3a76d554769e029e0b2c45b12b11ef9c797

SHA512
1174d077ea3edc5129d23a8813fc626636305f89f27753d172d9018e0e84ff6a23927a46da0ff11dda947465da11a867bac65980a1ec5e24fe12b0a64faf715f

Download Submit
C:\Users\Admin\Downloads\2fa992dea738a84ae8b297214ae3da1bc03591b05f4b2c0f3883270ece33a352.exe

Filesize
291KB

MD5
8dd5f9676ab2da3104ae70bd658d8634

SHA1
62d25fbc9cc6da5cd1e30a244216a39838265bc6

SHA256
2fa992dea738a84ae8b297214ae3da1bc03591b05f4b2c0f3883270ece33a352

SHA512
6e50b15b6bcc8e9d73b9b8c2b7f88517b7fd181c7ebe7c1b5cb06431bc84bdc11a7c20bae345243bd97df657c1ba67338431bb3b1c29ac5a82a2941e241e50e6

Download Submit
C:\Users\Admin\Downloads\2fa992dea738a84ae8b297214ae3da1bc03591b05f4b2c0f3883270ece33a352.exe

Filesize
291KB

MD5
8dd5f9676ab2da3104ae70bd658d8634

SHA1
62d25fbc9cc6da5cd1e30a244216a39838265bc6

SHA256
2fa992dea738a84ae8b297214ae3da1bc03591b05f4b2c0f3883270ece33a352

SHA512
6e50b15b6bcc8e9d73b9b8c2b7f88517b7fd181c7ebe7c1b5cb06431bc84bdc11a7c20bae345243bd97df657c1ba67338431bb3b1c29ac5a82a2941e241e50e6

Download Submit
C:\Users\Admin\Downloads\2fa992dea738a84ae8b297214ae3da1bc03591b05f4b2c0f3883270ece33a352.exe

Filesize
291KB

MD5
8dd5f9676ab2da3104ae70bd658d8634

SHA1
62d25fbc9cc6da5cd1e30a244216a39838265bc6

SHA256
2fa992dea738a84ae8b297214ae3da1bc03591b05f4b2c0f3883270ece33a352

SHA512
6e50b15b6bcc8e9d73b9b8c2b7f88517b7fd181c7ebe7c1b5cb06431bc84bdc11a7c20bae345243bd97df657c1ba67338431bb3b1c29ac5a82a2941e241e50e6

Download Submit
C:\Users\Admin\Downloads\2fa992dea738a84ae8b297214ae3da1bc03591b05f4b2c0f3883270ece33a352.exe

Filesize
291KB

MD5
8dd5f9676ab2da3104ae70bd658d8634

SHA1
62d25fbc9cc6da5cd1e30a244216a39838265bc6

SHA256
2fa992dea738a84ae8b297214ae3da1bc03591b05f4b2c0f3883270ece33a352

SHA512
6e50b15b6bcc8e9d73b9b8c2b7f88517b7fd181c7ebe7c1b5cb06431bc84bdc11a7c20bae345243bd97df657c1ba67338431bb3b1c29ac5a82a2941e241e50e6

Download Submit
C:\Users\Admin\Downloads\2fa992dea738a84ae8b297214ae3da1bc03591b05f4b2c0f3883270ece33a352.zip

Filesize
260KB

MD5
214a8c540194b707f32509eff8d77366

SHA1
15c5d39b2e1afda91977c7f4b77ba35bba0718b9

SHA256
8f1d553f28e1fdb0b6176fee317a3310cceb3796ce39455e6a8ed7f4f6cad32a

SHA512
16cbbaf9090cb70e6e53cb3317a48825174d46339ac7442cf4362e24d4abfa4bcd1144c4149c48666012a737289a122c6eab7ebda7894ba2986cb8af647d8bbc

Download Submit
C:\Users\Admin\Downloads\61a7fcc7fc8b643e115022a1c0e011ea2c3c53e44e7c96b9260378edba5e6ea7.zip

Filesize
331KB

MD5
9ecf5e5a4b30895a6a7e2934cd961a38

SHA1
fa0d4894ea06a96a1a382784a44a2e6689f3e6fa

SHA256
ea7ee1c661397841119abcd6a4c9293a7481079dfc8a896020bac44c51db5720

SHA512
e482e433c158de8f0af028e3c4a30c009d92e24f9afa7eccf769608e4e67d3b1f346f61ffa0b5b580c083b50043849a2297e89eeca796d37bf84b6e0d77ad103

Download Submit
C:\Users\Admin\Downloads\61a7fcc7fc8b643e115022a1c0e011ea2c3c53e44e7c96b9260378edba5e6ea7\61a7fcc7fc8b643e115022a1c0e011ea2c3c53e44e7c96b9260378edba5e6ea7.exe

Filesize
435KB

MD5
607ec2353929f2a88fed4594dca904f0

SHA1
cf4cbc188edb0ca4ceefa6234189fe5cf4762bc0

SHA256
61a7fcc7fc8b643e115022a1c0e011ea2c3c53e44e7c96b9260378edba5e6ea7

SHA512
2265cdfb9f56735bd23e2db38d50ba4989c0f73a8e234658237d86f36086c5ea27c1515bd42e9b10547e264df89616e16d998e99367ac515d731e83b01d0e51a

Download Submit
C:\Users\Admin\Downloads\61a7fcc7fc8b643e115022a1c0e011ea2c3c53e44e7c96b9260378edba5e6ea7\61a7fcc7fc8b643e115022a1c0e011ea2c3c53e44e7c96b9260378edba5e6ea7.exe

Filesize
435KB

MD5
607ec2353929f2a88fed4594dca904f0

SHA1
cf4cbc188edb0ca4ceefa6234189fe5cf4762bc0

SHA256
61a7fcc7fc8b643e115022a1c0e011ea2c3c53e44e7c96b9260378edba5e6ea7

SHA512
2265cdfb9f56735bd23e2db38d50ba4989c0f73a8e234658237d86f36086c5ea27c1515bd42e9b10547e264df89616e16d998e99367ac515d731e83b01d0e51a

Download Submit
C:\Users\Admin\Downloads\61a7fcc7fc8b643e115022a1c0e011ea2c3c53e44e7c96b9260378edba5e6ea7\61a7fcc7fc8b643e115022a1c0e011ea2c3c53e44e7c96b9260378edba5e6ea7.exe

Filesize
435KB

MD5
607ec2353929f2a88fed4594dca904f0

SHA1
cf4cbc188edb0ca4ceefa6234189fe5cf4762bc0

SHA256
61a7fcc7fc8b643e115022a1c0e011ea2c3c53e44e7c96b9260378edba5e6ea7

SHA512
2265cdfb9f56735bd23e2db38d50ba4989c0f73a8e234658237d86f36086c5ea27c1515bd42e9b10547e264df89616e16d998e99367ac515d731e83b01d0e51a

Download Submit
C:\Windows\TEMP\SDIAG_62a0a2c3-bbe4-4074-bb4a-103337c613cf\TS_ProgramCompatibilityWizard.ps1

Filesize
16KB

MD5
2c245de268793272c235165679bf2a22

SHA1
5f31f80468f992b84e491c9ac752f7ac286e3175

SHA256
4a6e9f400c72abc5b00d8b67ea36c06e3bc43ba9468fe748aebd704947ba66a0

SHA512
aaecb935c9b4c27021977f211441ff76c71ba9740035ec439e9477ae707109ca5247ea776e2e65159dcc500b0b4324f3733e1dfb05cef10a39bb11776f74f03c

Download Submit
C:\Windows\TEMP\SDIAG_62a0a2c3-bbe4-4074-bb4a-103337c613cf\en-US\CL_LocalizationData.psd1

Filesize
6KB

MD5
5202c2aaa0bbfbcbdc51e271e059b066

SHA1
3f6a9ffb0455edc6a7e4170b54def16fd6e09a28

SHA256
7fd5c0595d76d6dec1fcbace5bbcd8ff531d5acf97e53234c0008ff5a89d20e2

SHA512
77500b97fcd6fe985962f8430f97627fedcf5af72d73d5e2b03e130bca1b6b552971b569be5fca5c9ece75ab92c2e4be416d67a0f24d3830d9579e5f96103ac9

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\taagmgpt\CSCF38629E1CF424AF69AA658BBD2858262.TMP

Filesize
652B

MD5
d27386233b3e5bdaf7e66cf98e1329fb

SHA1
095c574f43cb87e4f2c720dd5481d15f6b067266

SHA256
06470f16cadd6331dfa9ea769dfc56eb0e2381409db673911ef1407fc2a709cc

SHA512
be1f01f92ca9dfec007159edb366c2541b9bda648c9a39a98c671d037495855f500501c87d6d041811ad859dea4fb1382091127544097af13b80089e53d544b4

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\taagmgpt\taagmgpt.0.cs

Filesize
5KB

MD5
26294ce6366662ebde6319c51362d56c

SHA1
c571c0ffa13e644eed87523cbd445f4afb1983d1

SHA256
685699daafafa281093b5c368c4d92715949fc300b182d234e800e613be5d8dc

SHA512
bc91bb591368bc511ca5169b3c23cd69a163eeb77f0d7a083fe09cc6aa15d7044a24f95811fa1518f44368dffda6d346f44e1568e7a5373a6450a63ae31883ee

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\taagmgpt\taagmgpt.cmdline

Filesize
356B

MD5
7c84a80e2507c76efd0f64636ef94ad4

SHA1
bf61455ecf81c795ba26f600248d6a8d12401e0a

SHA256
a9c4c777c3d9a97bad5cec0a3e502499a9d58c5823aff3976f7722b7de3a4d9b

SHA512
b9163fde4c27914a5e7f6bef133e49ff09d5c463ba6576fbb7c4bd8eb684fee7dcc86b36aada0de19db8f26431eefc7603672773d49d4a2cc325515e4d5826a4

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\wjl2yzay\CSC9535DD1A0F4785A75CC9FB60199B.TMP

Filesize
652B

MD5
3c5d0da876e3fc2f21464266a34ebfe7

SHA1
844519d986f09b8c25dd93a5d9c8833dab363e83

SHA256
150a7b2e3fe8c3199072cd287d869de3fe337d21d47480f0cd6cdb1192f90058

SHA512
c86f4a412578afa5e905bc610d2d7f67c1e07c4cd230b526dd7ee614d8308695efc64a78db9d1bbd1b81a8f7c04edc333c32ae27d77b19b5bd2409a37e7f27df

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\wjl2yzay\wjl2yzay.0.cs

Filesize
791B

MD5
3880de647b10555a534f34d5071fe461

SHA1
38b108ee6ea0f177b5dd52343e2ed74ca6134ca1

SHA256
f73390c091cd7e45dac07c22b26bf667054eacda31119513505390529744e15e

SHA512
2bf0a33982ade10ad49b368d313866677bca13074cd988e193b54ab0e1f507116d8218603b62b4e0561f481e8e7e72bdcda31259894552f1e3677627c12a9969

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\wjl2yzay\wjl2yzay.cmdline

Filesize
356B

MD5
25b978428b8e5ff3a4ba1035c2b6171e

SHA1
235e0a9a07c8cbfe9a3577f0c23b49f04a15885a

SHA256
979f526afa564c05b1d26c022e47bbcc72e948cd860c90c8eb812f3d211dfe85

SHA512
865d596ada3e6834c295d7f652369b9eaf525afbce7f042069fa07b78dbdd32d09f6b8d42b0963ce05cf1affb87b4ca5155a6ab1c3ef906da059353733219522

Download Submit
memory/416-2136-0x0000000002030000-0x0000000002039000-memory.dmp

Filesize
36KB

Download
memory/500-2164-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/500-2165-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/500-2133-0x0000000000402DD8-mapping.dmp

Download
memory/1124-920-0x0000000000000000-mapping.dmp

Download
memory/1352-1669-0x0000000000000000-mapping.dmp

Download
memory/1584-2014-0x0000000000000000-mapping.dmp

Download
memory/1632-1452-0x0000000000000000-mapping.dmp

Download
memory/2028-1478-0x0000000000000000-mapping.dmp

Download
memory/2204-555-0x0000000000000000-mapping.dmp

Download
memory/2336-369-0x0000000000000000-mapping.dmp

Download
memory/2716-1444-0x0000000000000000-mapping.dmp

Download
memory/2720-895-0x000001E96D690000-0x000001E96D698000-memory.dmp

Filesize
32KB

Download
memory/2720-902-0x000001E96D6A0000-0x000001E96D6A8000-memory.dmp

Filesize
32KB

Download
memory/2720-877-0x000001E96D660000-0x000001E96D682000-memory.dmp

Filesize
136KB

Download
memory/2720-878-0x000001E96D850000-0x000001E96D8C6000-memory.dmp

Filesize
472KB

Download
memory/2720-921-0x000001E96DC30000-0x000001E96DC38000-memory.dmp

Filesize
32KB

Download
memory/2748-1150-0x0000000000000000-mapping.dmp

Download
memory/2832-1923-0x0000000000000000-mapping.dmp

Download
memory/3356-866-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/3356-865-0x0000000000660000-0x0000000000697000-memory.dmp

Filesize
220KB

Download
memory/3356-839-0x0000000000660000-0x0000000000697000-memory.dmp

Filesize
220KB

Download
memory/3356-842-0x0000000000500000-0x000000000064A000-memory.dmp

Filesize
1.3MB

Download
memory/3356-844-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/3356-850-0x00000000057F0000-0x000000000583B000-memory.dmp

Filesize
300KB

Download
memory/3384-1011-0x0000000000000000-mapping.dmp

Download
memory/3412-1053-0x0000000000401896-mapping.dmp

Download
memory/3412-1108-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3528-2197-0x000000000076E000-0x000000000077F000-memory.dmp

Filesize
68KB

Download
memory/3528-2166-0x0000000000000000-mapping.dmp

Download
memory/3556-896-0x0000000000000000-mapping.dmp

Download
memory/3632-665-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3632-1832-0x0000000000000000-mapping.dmp

Download
memory/3632-598-0x0000000000401896-mapping.dmp

Download
memory/3708-318-0x0000000006AB0000-0x0000000006B00000-memory.dmp

Filesize
320KB

Download
memory/3708-317-0x00000000065A0000-0x00000000065AA000-memory.dmp

Filesize
40KB

Download
memory/3708-275-0x0000000005050000-0x00000000050EC000-memory.dmp

Filesize
624KB

Download
memory/3708-314-0x0000000006700000-0x0000000006792000-memory.dmp

Filesize
584KB

Download
memory/3708-289-0x0000000005D10000-0x0000000005D76000-memory.dmp

Filesize
408KB

Download
memory/3708-287-0x0000000000D80000-0x0000000000D98000-memory.dmp

Filesize
96KB

Download
memory/3708-218-0x0000000000401896-mapping.dmp

Download
memory/3708-260-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3708-263-0x0000000000AB0000-0x0000000000ADE000-memory.dmp

Filesize
184KB

Download
memory/3708-266-0x00000000054B0000-0x00000000059AE000-memory.dmp

Filesize
5.0MB

Download
memory/3968-169-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/3968-140-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/3968-141-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/3968-142-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/3968-146-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/3968-143-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/3968-139-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/3968-144-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/3968-138-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/3968-137-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/3968-126-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/3968-167-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/3968-136-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/3968-135-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/3968-168-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/3968-134-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/3968-166-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/3968-145-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/3968-133-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/3968-132-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/3968-131-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/3968-164-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/3968-122-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/3968-163-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/3968-162-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/3968-161-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/3968-160-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/3968-159-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/3968-123-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/3968-158-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/3968-124-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/3968-130-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/3968-157-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/3968-156-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/3968-129-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/3968-155-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/3968-125-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/3968-154-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/3968-153-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/3968-128-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/3968-127-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/3968-152-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/3968-151-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/3968-150-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/3968-149-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/3968-148-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/3968-147-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4104-182-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4104-185-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4104-170-0x0000000000000000-mapping.dmp

Download
memory/4104-172-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4104-174-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4104-173-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4104-189-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4104-175-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4104-176-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4104-177-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4104-179-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4104-180-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4104-919-0x0000000000000000-mapping.dmp

Download
memory/4104-181-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4104-183-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4104-184-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4104-188-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4104-187-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4104-186-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4372-867-0x0000000000000000-mapping.dmp

Download
memory/4416-888-0x0000000000000000-mapping.dmp

Download
memory/4488-1415-0x0000000000000000-mapping.dmp

Download
memory/4740-899-0x0000000000000000-mapping.dmp

Download
memory/4756-753-0x0000000005650000-0x000000000575A000-memory.dmp

Filesize
1.0MB

Download
memory/4756-752-0x0000000005620000-0x0000000005632000-memory.dmp

Filesize
72KB

Download
memory/4756-787-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4756-739-0x0000000000500000-0x00000000005AE000-memory.dmp

Filesize
696KB

Download
memory/4756-741-0x0000000004990000-0x00000000049DC000-memory.dmp

Filesize
304KB

Download
memory/4756-786-0x0000000000500000-0x00000000005AE000-memory.dmp

Filesize
696KB

Download
memory/4756-742-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4756-740-0x0000000002070000-0x00000000020C9000-memory.dmp

Filesize
356KB

Download
memory/4756-748-0x0000000004A20000-0x0000000004A6A000-memory.dmp

Filesize
296KB

Download
memory/4756-751-0x0000000004FC0000-0x00000000055C6000-memory.dmp

Filesize
6.0MB

Download
memory/4756-784-0x0000000006D30000-0x0000000006D4E000-memory.dmp

Filesize
120KB

Download
memory/4756-783-0x0000000006C80000-0x0000000006CF6000-memory.dmp

Filesize
472KB

Download
memory/4756-779-0x00000000064D0000-0x00000000069FC000-memory.dmp

Filesize
5.2MB

Download
memory/4756-756-0x0000000005760000-0x000000000579E000-memory.dmp

Filesize
248KB

Download
memory/4756-765-0x00000000057F0000-0x000000000583B000-memory.dmp

Filesize
300KB

Download
memory/4756-778-0x0000000006300000-0x00000000064C2000-memory.dmp

Filesize
1.8MB

Download
memory/4768-1305-0x0000000000000000-mapping.dmp

Download
memory/4924-412-0x0000000000401896-mapping.dmp

Download
memory/4924-479-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4928-1663-0x0000000000000000-mapping.dmp

Download
memory/5092-891-0x0000000000000000-mapping.dmp

Download
memory/5108-2194-0x0000000000402DD8-mapping.dmp

Download
memory/5108-2225-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/5108-2226-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download