Analysis

  • max time kernel
    879s
  • max time network
    733s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/02/2023, 19:39

General

  • Target

    TechnicLauncher.exe

  • Size

    6.7MB

  • MD5

    1c862976cb403f75c4d0a254f7d436f8

  • SHA1

    6aca30f3f524eb8028b65c64cc95d4dcf8bb200e

  • SHA256

    f897ccfbeba62f5e1abb3f0d7a72ab83b4b9ae3e9b2d5c4eac0b79cabd4036fd

  • SHA512

    e109f829a3a8287ddcceb640543fbecfb22fead9ed237f8af0e753b54d6bfdfcbf37ca51cbc9a6544feabdb20dddf88a61e4c954dd8509b347fe4bb75ee8c96e

  • SSDEEP

    98304:dNY+dGXz4c3fQy7kOd7BM0eSNbm89Wdn5ZCdqrZM75n+hb:d5e8cB7kOd7BVq89u5Z8Y4q

Malware Config

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 15 IoCs
  • Loads dropped DLL 64 IoCs
  • Registers COM server for autorun 1 TTPs 64 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Drops file in System32 directory 3 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 23 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 20 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 40 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 40 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 43 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TechnicLauncher.exe
    "C:\Users\Admin\AppData\Local\Temp\TechnicLauncher.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2104
    • C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
      "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -Djava.net.preferIPv4Stack=true -Dawt.useSystemAAFontSettings=lcd -Dswing.aatext=true -classpath "C:\Users\Admin\AppData\Local\Temp\TechnicLauncher.exe;anything" net.technicpack.launcher.LauncherMain
      2⤵
      • Drops file in Program Files directory
      • Suspicious use of SetWindowsHookEx
      PID:2516
  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2680
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff8b6f64f50,0x7ff8b6f64f60,0x7ff8b6f64f70
      2⤵
        PID:3984
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1660 /prefetch:2
        2⤵
          PID:4696
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2012 /prefetch:8
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:3028
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2300 /prefetch:8
          2⤵
            PID:1108
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2960 /prefetch:1
            2⤵
              PID:4652
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3156 /prefetch:1
              2⤵
                PID:3676
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3876 /prefetch:1
                2⤵
                  PID:3480
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4548 /prefetch:8
                  2⤵
                    PID:4992
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4660 /prefetch:8
                    2⤵
                      PID:3652
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4804 /prefetch:8
                      2⤵
                        PID:2748
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4912 /prefetch:8
                        2⤵
                          PID:4772
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4944 /prefetch:8
                          2⤵
                            PID:2448
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4936 /prefetch:8
                            2⤵
                              PID:4512
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4736 /prefetch:8
                              2⤵
                                PID:4672
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5152 /prefetch:8
                                2⤵
                                  PID:1012
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5140 /prefetch:8
                                  2⤵
                                    PID:3800
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5116 /prefetch:8
                                    2⤵
                                      PID:4196
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4804 /prefetch:8
                                      2⤵
                                        PID:3668
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
                                        2⤵
                                          PID:3816
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5456 /prefetch:8
                                          2⤵
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:2888
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4656 /prefetch:8
                                          2⤵
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:2908
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
                                          2⤵
                                            PID:3644
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4004 /prefetch:1
                                            2⤵
                                              PID:3488
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
                                              2⤵
                                                PID:4960
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3036 /prefetch:1
                                                2⤵
                                                  PID:2760
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5072 /prefetch:8
                                                  2⤵
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:2972
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3968 /prefetch:1
                                                  2⤵
                                                    PID:3988
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1576 /prefetch:8
                                                    2⤵
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:1524
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:8
                                                    2⤵
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:3312
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
                                                    2⤵
                                                      PID:1196
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1484 /prefetch:8
                                                      2⤵
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:4164
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
                                                      2⤵
                                                        PID:4620
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4720 /prefetch:8
                                                        2⤵
                                                          PID:3812
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3580 /prefetch:8
                                                          2⤵
                                                            PID:3688
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2560 /prefetch:2
                                                            2⤵
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:3200
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4628 /prefetch:1
                                                            2⤵
                                                              PID:3568
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3752 /prefetch:8
                                                              2⤵
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:2808
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5288 /prefetch:8
                                                              2⤵
                                                                PID:4344
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5060 /prefetch:8
                                                                2⤵
                                                                  PID:792
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3940 /prefetch:8
                                                                  2⤵
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:2804
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5592 /prefetch:8
                                                                  2⤵
                                                                    PID:4560
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5560 /prefetch:8
                                                                    2⤵
                                                                      PID:3472
                                                                    • C:\Users\Admin\Downloads\JavaSetup8u361.exe
                                                                      "C:\Users\Admin\Downloads\JavaSetup8u361.exe"
                                                                      2⤵
                                                                      • Executes dropped EXE
                                                                      PID:2080
                                                                      • C:\Users\Admin\AppData\Local\Temp\jds241073703.tmp\JavaSetup8u361.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\jds241073703.tmp\JavaSetup8u361.exe"
                                                                        3⤵
                                                                        • Executes dropped EXE
                                                                        • Modifies system certificate store
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        PID:1888
                                                                        • C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_361\LZMA_EXE
                                                                          "C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_361\LZMA_EXE" d "C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_361\au.msi" "C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_361\msi.tmp"
                                                                          4⤵
                                                                          • Executes dropped EXE
                                                                          PID:5004
                                                                        • C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_361\LZMA_EXE
                                                                          "C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_361\LZMA_EXE" d "C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_361\jre1.8.0_361.msi" "C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_361\msi.tmp"
                                                                          4⤵
                                                                          • Executes dropped EXE
                                                                          PID:2296
                                                                        • C:\Program Files (x86)\Java\jre1.8.0_361\bin\javaw.exe
                                                                          -Djdk.disableLastUsageTracking -cp "C:\Program Files (x86)\Java\jre1.8.0_361\bin\..\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -getUserWebJavaStatus
                                                                          4⤵
                                                                          • Executes dropped EXE
                                                                          PID:2520
                                                                        • C:\Program Files (x86)\Java\jre1.8.0_361\bin\javaw.exe
                                                                          -Djdk.disableLastUsageTracking -cp "C:\Program Files (x86)\Java\jre1.8.0_361\bin\..\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -getUserPreviousDecisionsExist 30
                                                                          4⤵
                                                                          • Executes dropped EXE
                                                                          PID:4968
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5828 /prefetch:8
                                                                      2⤵
                                                                        PID:2464
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5800 /prefetch:8
                                                                        2⤵
                                                                          PID:4880
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5708 /prefetch:8
                                                                          2⤵
                                                                            PID:2972
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5936 /prefetch:8
                                                                            2⤵
                                                                              PID:1440
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
                                                                              2⤵
                                                                                PID:4624
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
                                                                                2⤵
                                                                                  PID:3956
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1488 /prefetch:1
                                                                                  2⤵
                                                                                    PID:1780
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
                                                                                    2⤵
                                                                                      PID:1088
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
                                                                                      2⤵
                                                                                        PID:3936
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1584 /prefetch:1
                                                                                        2⤵
                                                                                          PID:2740
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
                                                                                          2⤵
                                                                                            PID:5080
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:1
                                                                                            2⤵
                                                                                              PID:1964
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6176 /prefetch:1
                                                                                              2⤵
                                                                                                PID:5112
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6232 /prefetch:1
                                                                                                2⤵
                                                                                                  PID:4204
                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6184 /prefetch:1
                                                                                                  2⤵
                                                                                                    PID:928
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6260 /prefetch:1
                                                                                                    2⤵
                                                                                                      PID:5032
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6252 /prefetch:1
                                                                                                      2⤵
                                                                                                        PID:1616
                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6240 /prefetch:1
                                                                                                        2⤵
                                                                                                          PID:4704
                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
                                                                                                          2⤵
                                                                                                            PID:1696
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
                                                                                                            2⤵
                                                                                                              PID:4700
                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6448 /prefetch:1
                                                                                                              2⤵
                                                                                                                PID:4712
                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6464 /prefetch:1
                                                                                                                2⤵
                                                                                                                  PID:508
                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6452 /prefetch:1
                                                                                                                  2⤵
                                                                                                                    PID:392
                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7084 /prefetch:1
                                                                                                                    2⤵
                                                                                                                      PID:1716
                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7276 /prefetch:1
                                                                                                                      2⤵
                                                                                                                        PID:4648
                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8536 /prefetch:1
                                                                                                                        2⤵
                                                                                                                          PID:2832
                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=68 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7696 /prefetch:1
                                                                                                                          2⤵
                                                                                                                            PID:1600
                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=70 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8524 /prefetch:1
                                                                                                                            2⤵
                                                                                                                              PID:3228
                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=73 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8160 /prefetch:1
                                                                                                                              2⤵
                                                                                                                                PID:1008
                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=72 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8104 /prefetch:1
                                                                                                                                2⤵
                                                                                                                                  PID:4500
                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=71 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8448 /prefetch:1
                                                                                                                                  2⤵
                                                                                                                                    PID:176
                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=74 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8180 /prefetch:1
                                                                                                                                    2⤵
                                                                                                                                      PID:536
                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=75 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6412 /prefetch:1
                                                                                                                                      2⤵
                                                                                                                                        PID:5036
                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=9744 /prefetch:8
                                                                                                                                        2⤵
                                                                                                                                          PID:2520
                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=9428 /prefetch:8
                                                                                                                                          2⤵
                                                                                                                                            PID:3636
                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=9716 /prefetch:8
                                                                                                                                            2⤵
                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                            PID:2912
                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=9548 /prefetch:8
                                                                                                                                            2⤵
                                                                                                                                              PID:4784
                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=9468 /prefetch:8
                                                                                                                                              2⤵
                                                                                                                                                PID:700
                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=81 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7128 /prefetch:1
                                                                                                                                                2⤵
                                                                                                                                                  PID:3916
                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,1120196302970409689,11732548004862628453,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6820 /prefetch:8
                                                                                                                                                  2⤵
                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                  PID:1604
                                                                                                                                              • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                1⤵
                                                                                                                                                  PID:1088
                                                                                                                                                • C:\Windows\System32\rundll32.exe
                                                                                                                                                  C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                                                                  1⤵
                                                                                                                                                    PID:4008
                                                                                                                                                  • C:\Windows\system32\msiexec.exe
                                                                                                                                                    C:\Windows\system32\msiexec.exe /V
                                                                                                                                                    1⤵
                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                    • Enumerates connected drives
                                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                    • Checks processor information in registry
                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                    PID:2528
                                                                                                                                                    • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                      C:\Windows\syswow64\MsiExec.exe -Embedding 708C28F650C8D53463B087E920625CA8
                                                                                                                                                      2⤵
                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                      PID:4860
                                                                                                                                                    • C:\Program Files (x86)\Java\jre1.8.0_361\installer.exe
                                                                                                                                                      "C:\Program Files (x86)\Java\jre1.8.0_361\installer.exe" /s INSTALLDIR="C:\Program Files (x86)\Java\jre1.8.0_361\\" INSTALL_SILENT=1 REPAIRMODE=0 ProductCode={26A24AE4-039D-4CA4-87B4-2F32180361F0}
                                                                                                                                                      2⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                      • Installs/modifies Browser Helper Object
                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                      • Modifies Internet Explorer settings
                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                      • Modifies registry class
                                                                                                                                                      PID:2316
                                                                                                                                                      • C:\Program Files (x86)\Java\jre1.8.0_361\bin\javaw.exe
                                                                                                                                                        "C:\Program Files (x86)\Java\jre1.8.0_361\bin\javaw.exe" -Xshare:dump -Djdk.disableLastUsageTracking
                                                                                                                                                        3⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                        PID:3544
                                                                                                                                                      • C:\Program Files (x86)\Java\jre1.8.0_361\bin\ssvagent.exe
                                                                                                                                                        "C:\Program Files (x86)\Java\jre1.8.0_361\bin\ssvagent.exe" -doHKCUSSVSetup
                                                                                                                                                        3⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                        • Registers COM server for autorun
                                                                                                                                                        • Modifies registry class
                                                                                                                                                        PID:2172
                                                                                                                                                      • C:\Program Files (x86)\Java\jre1.8.0_361\bin\javaws.exe
                                                                                                                                                        "C:\Program Files (x86)\Java\jre1.8.0_361\bin\javaws.exe" -wait -fix -permissions -silent
                                                                                                                                                        3⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                        PID:3336
                                                                                                                                                        • C:\Program Files (x86)\Java\jre1.8.0_361\bin\jp2launcher.exe
                                                                                                                                                          "C:\Program Files (x86)\Java\jre1.8.0_361\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files (x86)\Java\jre1.8.0_361" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfMzYxXGxpYlxkZXBsb3kuamFyAC1EamF2YS5zZWN1cml0eS5wb2xpY3k9ZmlsZTpDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfMzYxXGxpYlxzZWN1cml0eVxqYXZhd3MucG9saWN5AC1EdHJ1c3RQcm94eT10cnVlAC1YdmVyaWZ5OnJlbW90ZQAtRGpubHB4LmhvbWU9QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxKYXZhXGpyZTEuOC4wXzM2MVxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXMgKHg4NilcSmF2YVxqcmUxLjguMF8zNjFcbGliXGphdmF3cy5qYXI7QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxKYXZhXGpyZTEuOC4wXzM2MVxsaWJcZGVwbG95LmphcjtDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfMzYxXGxpYlxwbHVnaW4uamFyAC1EamF2YS5hd3QuaGVhZGxlc3M9dHJ1ZQAtRGpubHB4Lmp2bT1DOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfMzYxXGJpblxqYXZhdy5leGU= -ma LXdhaXQALWZpeAAtcGVybWlzc2lvbnMALXNpbGVudAAtbm90V2ViSmF2YQ==
                                                                                                                                                          4⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                          PID:2532
                                                                                                                                                      • C:\Program Files (x86)\Java\jre1.8.0_361\bin\javaws.exe
                                                                                                                                                        "C:\Program Files (x86)\Java\jre1.8.0_361\bin\javaws.exe" -wait -fix -shortcut -silent
                                                                                                                                                        3⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                        PID:1732
                                                                                                                                                        • C:\Program Files (x86)\Java\jre1.8.0_361\bin\jp2launcher.exe
                                                                                                                                                          "C:\Program Files (x86)\Java\jre1.8.0_361\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files (x86)\Java\jre1.8.0_361" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfMzYxXGxpYlxkZXBsb3kuamFyAC1EamF2YS5zZWN1cml0eS5wb2xpY3k9ZmlsZTpDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfMzYxXGxpYlxzZWN1cml0eVxqYXZhd3MucG9saWN5AC1EdHJ1c3RQcm94eT10cnVlAC1YdmVyaWZ5OnJlbW90ZQAtRGpubHB4LmhvbWU9QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxKYXZhXGpyZTEuOC4wXzM2MVxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXMgKHg4NilcSmF2YVxqcmUxLjguMF8zNjFcbGliXGphdmF3cy5qYXI7QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxKYXZhXGpyZTEuOC4wXzM2MVxsaWJcZGVwbG95LmphcjtDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfMzYxXGxpYlxwbHVnaW4uamFyAC1EamF2YS5hd3QuaGVhZGxlc3M9dHJ1ZQAtRGpubHB4Lmp2bT1DOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfMzYxXGJpblxqYXZhdy5leGU= -ma LXdhaXQALWZpeAAtc2hvcnRjdXQALXNpbGVudAAtbm90V2ViSmF2YQ==
                                                                                                                                                          4⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                          PID:4284
                                                                                                                                                    • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                      C:\Windows\syswow64\MsiExec.exe -Embedding D12A2FF8DF5551A0C12A4535CB5A8A8C E Global\MSI0000
                                                                                                                                                      2⤵
                                                                                                                                                        PID:4800
                                                                                                                                                      • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                        C:\Windows\syswow64\MsiExec.exe -Embedding 85F9D484E77C0EB389A637EAFB9871BB
                                                                                                                                                        2⤵
                                                                                                                                                          PID:2860
                                                                                                                                                        • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                          C:\Windows\syswow64\MsiExec.exe -Embedding 675D4506115E4F959693928E4FE1BBC0 E Global\MSI0000
                                                                                                                                                          2⤵
                                                                                                                                                            PID:4988
                                                                                                                                                          • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                            C:\Windows\syswow64\MsiExec.exe -Embedding BE5044DDC09C018EE518CC141A9558B2
                                                                                                                                                            2⤵
                                                                                                                                                              PID:3836
                                                                                                                                                            • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                              C:\Windows\syswow64\MsiExec.exe -Embedding 614CD7F211B600495FC1AAEAC7C57353 E Global\MSI0000
                                                                                                                                                              2⤵
                                                                                                                                                                PID:3228
                                                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
                                                                                                                                                              1⤵
                                                                                                                                                              • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                                                                                              PID:404
                                                                                                                                                            • C:\Users\Admin\Downloads\TechnicLauncher.exe
                                                                                                                                                              "C:\Users\Admin\Downloads\TechnicLauncher.exe"
                                                                                                                                                              1⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              PID:2448
                                                                                                                                                              • C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
                                                                                                                                                                "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -Djava.net.preferIPv4Stack=true -Dawt.useSystemAAFontSettings=lcd -Dswing.aatext=true -classpath "C:\Users\Admin\Downloads\TechnicLauncher.exe;anything" net.technicpack.launcher.LauncherMain
                                                                                                                                                                2⤵
                                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                PID:4900
                                                                                                                                                            • C:\Users\Admin\Downloads\TechnicLauncher.exe
                                                                                                                                                              "C:\Users\Admin\Downloads\TechnicLauncher.exe"
                                                                                                                                                              1⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              PID:3112
                                                                                                                                                              • C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
                                                                                                                                                                "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -Djava.net.preferIPv4Stack=true -Dawt.useSystemAAFontSettings=lcd -Dswing.aatext=true -classpath "C:\Users\Admin\Downloads\TechnicLauncher.exe;anything" net.technicpack.launcher.LauncherMain
                                                                                                                                                                2⤵
                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                PID:844

                                                                                                                                                            Network

                                                                                                                                                            MITRE ATT&CK Enterprise v6

                                                                                                                                                            Replay Monitor

                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                            Downloads

                                                                                                                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

                                                                                                                                                              Filesize

                                                                                                                                                              471B

                                                                                                                                                              MD5

                                                                                                                                                              0b62afcd79676f5087b4695044167f67

                                                                                                                                                              SHA1

                                                                                                                                                              4716d44604f6576c9e2257a8e38d72d4479ef0c8

                                                                                                                                                              SHA256

                                                                                                                                                              e97b4c39e7462ea110b319543200658a4a057d77084ef9126b80ff0ffe1f0456

                                                                                                                                                              SHA512

                                                                                                                                                              0808f48a1bcce30cbfb41dec153a841cbdd054c64bffa54b2239bf42672cf193bfb897852d2e8d9ba999fca0a7ead312fb36c1214c2953d1cc256257d859b2f2

                                                                                                                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

                                                                                                                                                              Filesize

                                                                                                                                                              430B

                                                                                                                                                              MD5

                                                                                                                                                              887e9aff334144ac9aa2a98178cf4953

                                                                                                                                                              SHA1

                                                                                                                                                              6bff2932d7e3cd568210ba00d198ab62ac1bf62e

                                                                                                                                                              SHA256

                                                                                                                                                              6f011a0d294ffcd9f7c86b73d8aff5105b30e0c35215beb241d3f177655f2469

                                                                                                                                                              SHA512

                                                                                                                                                              5a8b01ac6b0edb5f98b28a3e6175b3070cdccbde4ae0bc2c2b6c259f16fb712b2f09d650b7dc831866ca6343f580f97a45513fc5092e62d0a592c57bddd16eed

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\jds241073703.tmp\JavaSetup8u361.exe

                                                                                                                                                              Filesize

                                                                                                                                                              1.9MB

                                                                                                                                                              MD5

                                                                                                                                                              442dcacd62016db76c61af770301626f

                                                                                                                                                              SHA1

                                                                                                                                                              1ef7a54bb0fb6395b271d88e4d87e7ac3b76e58a

                                                                                                                                                              SHA256

                                                                                                                                                              8aa49738b3efd4a2e2b3d71991c209db46e082e1739de43147041f9af2a7fff7

                                                                                                                                                              SHA512

                                                                                                                                                              3c21efe1f3422107bddc48d0edd842924dfdf6682b1e81ace83aa992ba49e224d45fd0fc6a73be9de6806effe71d8a1908f550c8b1cf520df4972c252b721bf9

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\jds241073703.tmp\JavaSetup8u361.exe

                                                                                                                                                              Filesize

                                                                                                                                                              1.9MB

                                                                                                                                                              MD5

                                                                                                                                                              442dcacd62016db76c61af770301626f

                                                                                                                                                              SHA1

                                                                                                                                                              1ef7a54bb0fb6395b271d88e4d87e7ac3b76e58a

                                                                                                                                                              SHA256

                                                                                                                                                              8aa49738b3efd4a2e2b3d71991c209db46e082e1739de43147041f9af2a7fff7

                                                                                                                                                              SHA512

                                                                                                                                                              3c21efe1f3422107bddc48d0edd842924dfdf6682b1e81ace83aa992ba49e224d45fd0fc6a73be9de6806effe71d8a1908f550c8b1cf520df4972c252b721bf9

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\jusched.log

                                                                                                                                                              Filesize

                                                                                                                                                              267KB

                                                                                                                                                              MD5

                                                                                                                                                              eed5e12321a5283949e453e0799d9a1a

                                                                                                                                                              SHA1

                                                                                                                                                              6a67157262a4477e854b9c094bab83e44b102166

                                                                                                                                                              SHA256

                                                                                                                                                              2c0c0d550c851f522d7d5d983f680f04e3147fa787bc64ba0f119578789213fb

                                                                                                                                                              SHA512

                                                                                                                                                              061f1c0bc3edbddfbd10bd8aa4afd7d984a3d36b8bbfe18d7959750409366069f633e8e30f8eed662e08ff0dcb4aa5909f5d2fdaeac33b7ebd332531f047dafd

                                                                                                                                                            • C:\Users\Admin\Downloads\JavaSetup8u361.exe

                                                                                                                                                              Filesize

                                                                                                                                                              2.2MB

                                                                                                                                                              MD5

                                                                                                                                                              d3809baddaf7b1e7d94484160043328b

                                                                                                                                                              SHA1

                                                                                                                                                              e1979f5248d3b20858b11386ce22b1ccb0a9bfb5

                                                                                                                                                              SHA256

                                                                                                                                                              e28f198ca200445ab45dd4e94d49993ad1a9a21548908ca9c09ade6419c2e079

                                                                                                                                                              SHA512

                                                                                                                                                              96350ef6c81a1bc7d3c6b29c2a66ffaa1cf4f86172d3f52d39bcbf3886da41208b75cfe16bbf4ea23e04b2e0616637083eeacdefb8c0edc3ce6d0f2f89f881c6

                                                                                                                                                            • C:\Users\Admin\Downloads\JavaSetup8u361.exe

                                                                                                                                                              Filesize

                                                                                                                                                              2.2MB

                                                                                                                                                              MD5

                                                                                                                                                              d3809baddaf7b1e7d94484160043328b

                                                                                                                                                              SHA1

                                                                                                                                                              e1979f5248d3b20858b11386ce22b1ccb0a9bfb5

                                                                                                                                                              SHA256

                                                                                                                                                              e28f198ca200445ab45dd4e94d49993ad1a9a21548908ca9c09ade6419c2e079

                                                                                                                                                              SHA512

                                                                                                                                                              96350ef6c81a1bc7d3c6b29c2a66ffaa1cf4f86172d3f52d39bcbf3886da41208b75cfe16bbf4ea23e04b2e0616637083eeacdefb8c0edc3ce6d0f2f89f881c6

                                                                                                                                                            • memory/844-398-0x0000000002800000-0x0000000003800000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              16.0MB

                                                                                                                                                            • memory/844-399-0x0000000002800000-0x0000000003800000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              16.0MB

                                                                                                                                                            • memory/844-402-0x0000000002800000-0x0000000003800000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              16.0MB

                                                                                                                                                            • memory/844-385-0x0000000002800000-0x0000000003800000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              16.0MB

                                                                                                                                                            • memory/844-401-0x0000000002800000-0x0000000003800000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              16.0MB

                                                                                                                                                            • memory/844-400-0x0000000002800000-0x0000000003800000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              16.0MB

                                                                                                                                                            • memory/2516-137-0x0000000002E10000-0x0000000003E10000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              16.0MB

                                                                                                                                                            • memory/2520-357-0x0000000002E80000-0x0000000004E80000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              32.0MB

                                                                                                                                                            • memory/2520-320-0x0000000002E80000-0x0000000004E80000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              32.0MB

                                                                                                                                                            • memory/2520-301-0x0000000002E80000-0x0000000004E80000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              32.0MB

                                                                                                                                                            • memory/2520-306-0x0000000002E80000-0x0000000004E80000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              32.0MB

                                                                                                                                                            • memory/2520-316-0x0000000002E80000-0x0000000004E80000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              32.0MB

                                                                                                                                                            • memory/2532-204-0x00000000029F0000-0x00000000049F0000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              32.0MB

                                                                                                                                                            • memory/2532-190-0x00000000029F0000-0x00000000049F0000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              32.0MB

                                                                                                                                                            • memory/2532-196-0x00000000029F0000-0x00000000049F0000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              32.0MB

                                                                                                                                                            • memory/2532-210-0x00000000029F0000-0x00000000049F0000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              32.0MB

                                                                                                                                                            • memory/2532-223-0x00000000029F0000-0x00000000049F0000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              32.0MB

                                                                                                                                                            • memory/2532-222-0x00000000029F0000-0x00000000049F0000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              32.0MB

                                                                                                                                                            • memory/2532-217-0x00000000029F0000-0x00000000049F0000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              32.0MB

                                                                                                                                                            • memory/2532-282-0x00000000029F0000-0x00000000049F0000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              32.0MB

                                                                                                                                                            • memory/3544-169-0x0000000002C50000-0x0000000004C50000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              32.0MB

                                                                                                                                                            • memory/4284-279-0x0000000002F30000-0x0000000004F30000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              32.0MB

                                                                                                                                                            • memory/4284-277-0x0000000002F30000-0x0000000004F30000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              32.0MB

                                                                                                                                                            • memory/4284-273-0x0000000002F30000-0x0000000004F30000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              32.0MB

                                                                                                                                                            • memory/4284-285-0x0000000002F30000-0x0000000004F30000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              32.0MB

                                                                                                                                                            • memory/4284-244-0x0000000002F30000-0x0000000004F30000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              32.0MB

                                                                                                                                                            • memory/4284-249-0x0000000002F30000-0x0000000004F30000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              32.0MB

                                                                                                                                                            • memory/4284-264-0x0000000002F30000-0x0000000004F30000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              32.0MB

                                                                                                                                                            • memory/4284-270-0x0000000002F30000-0x0000000004F30000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              32.0MB

                                                                                                                                                            • memory/4900-369-0x0000000002980000-0x0000000003980000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              16.0MB

                                                                                                                                                            • memory/4968-358-0x0000000002780000-0x0000000004780000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              32.0MB

                                                                                                                                                            • memory/4968-356-0x0000000002780000-0x0000000004780000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              32.0MB

                                                                                                                                                            • memory/4968-355-0x0000000002780000-0x0000000004780000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              32.0MB

                                                                                                                                                            • memory/4968-350-0x0000000002780000-0x0000000004780000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              32.0MB

                                                                                                                                                            • memory/4968-345-0x0000000002780000-0x0000000004780000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              32.0MB

                                                                                                                                                            • memory/4968-340-0x0000000002780000-0x0000000004780000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              32.0MB

                                                                                                                                                            • memory/4968-324-0x0000000016800000-0x0000000016810000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              64KB