Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

09/07/2024, 00:58

240709-bbhtgszgph 1

09/07/2024, 00:56

240709-baklpazgmf 1

Analysis

  • max time kernel
    58s
  • max time network
    60s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    09/07/2024, 00:56

General

  • Target

    https://www.speedrun.com/redball1/resources/w5scc

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 49 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 33 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 23 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.speedrun.com/redball1/resources/w5scc
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4704
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffb27329758,0x7ffb27329768,0x7ffb27329778
      2⤵
        PID:4568
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1516 --field-trial-handle=1776,i,7508762439617886636,2853482957169876532,131072 /prefetch:2
        2⤵
          PID:360
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1928 --field-trial-handle=1776,i,7508762439617886636,2853482957169876532,131072 /prefetch:8
          2⤵
            PID:5088
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1668 --field-trial-handle=1776,i,7508762439617886636,2853482957169876532,131072 /prefetch:8
            2⤵
              PID:3156
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2912 --field-trial-handle=1776,i,7508762439617886636,2853482957169876532,131072 /prefetch:1
              2⤵
                PID:200
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2920 --field-trial-handle=1776,i,7508762439617886636,2853482957169876532,131072 /prefetch:1
                2⤵
                  PID:196
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4948 --field-trial-handle=1776,i,7508762439617886636,2853482957169876532,131072 /prefetch:1
                  2⤵
                    PID:4416
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3548 --field-trial-handle=1776,i,7508762439617886636,2853482957169876532,131072 /prefetch:1
                    2⤵
                      PID:3696
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5276 --field-trial-handle=1776,i,7508762439617886636,2853482957169876532,131072 /prefetch:1
                      2⤵
                        PID:916
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5496 --field-trial-handle=1776,i,7508762439617886636,2853482957169876532,131072 /prefetch:1
                        2⤵
                          PID:2524
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5616 --field-trial-handle=1776,i,7508762439617886636,2853482957169876532,131072 /prefetch:8
                          2⤵
                            PID:4872
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5752 --field-trial-handle=1776,i,7508762439617886636,2853482957169876532,131072 /prefetch:1
                            2⤵
                              PID:2900
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5492 --field-trial-handle=1776,i,7508762439617886636,2853482957169876532,131072 /prefetch:1
                              2⤵
                                PID:2636
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=6276 --field-trial-handle=1776,i,7508762439617886636,2853482957169876532,131072 /prefetch:1
                                2⤵
                                  PID:1892
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=6184 --field-trial-handle=1776,i,7508762439617886636,2853482957169876532,131072 /prefetch:1
                                  2⤵
                                    PID:4272
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=6608 --field-trial-handle=1776,i,7508762439617886636,2853482957169876532,131072 /prefetch:1
                                    2⤵
                                      PID:5100
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=6632 --field-trial-handle=1776,i,7508762439617886636,2853482957169876532,131072 /prefetch:1
                                      2⤵
                                        PID:2596
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=6912 --field-trial-handle=1776,i,7508762439617886636,2853482957169876532,131072 /prefetch:1
                                        2⤵
                                          PID:3000
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=6936 --field-trial-handle=1776,i,7508762439617886636,2853482957169876532,131072 /prefetch:1
                                          2⤵
                                            PID:984
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=7256 --field-trial-handle=1776,i,7508762439617886636,2853482957169876532,131072 /prefetch:1
                                            2⤵
                                              PID:5148
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=7448 --field-trial-handle=1776,i,7508762439617886636,2853482957169876532,131072 /prefetch:1
                                              2⤵
                                                PID:5276
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=6292 --field-trial-handle=1776,i,7508762439617886636,2853482957169876532,131072 /prefetch:1
                                                2⤵
                                                  PID:5352
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=7664 --field-trial-handle=1776,i,7508762439617886636,2853482957169876532,131072 /prefetch:1
                                                  2⤵
                                                    PID:5372
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=7872 --field-trial-handle=1776,i,7508762439617886636,2853482957169876532,131072 /prefetch:1
                                                    2⤵
                                                      PID:5392
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=7880 --field-trial-handle=1776,i,7508762439617886636,2853482957169876532,131072 /prefetch:1
                                                      2⤵
                                                        PID:5420
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=8152 --field-trial-handle=1776,i,7508762439617886636,2853482957169876532,131072 /prefetch:1
                                                        2⤵
                                                          PID:5428
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=8300 --field-trial-handle=1776,i,7508762439617886636,2853482957169876532,131072 /prefetch:1
                                                          2⤵
                                                            PID:5436
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=8444 --field-trial-handle=1776,i,7508762439617886636,2853482957169876532,131072 /prefetch:1
                                                            2⤵
                                                              PID:5448
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=8476 --field-trial-handle=1776,i,7508762439617886636,2853482957169876532,131072 /prefetch:1
                                                              2⤵
                                                                PID:5456
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --mojo-platform-channel-handle=8492 --field-trial-handle=1776,i,7508762439617886636,2853482957169876532,131072 /prefetch:1
                                                                2⤵
                                                                  PID:5464
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --mojo-platform-channel-handle=9120 --field-trial-handle=1776,i,7508762439617886636,2853482957169876532,131072 /prefetch:1
                                                                  2⤵
                                                                    PID:6224
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --mojo-platform-channel-handle=6204 --field-trial-handle=1776,i,7508762439617886636,2853482957169876532,131072 /prefetch:1
                                                                    2⤵
                                                                      PID:6288
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=9148 --field-trial-handle=1776,i,7508762439617886636,2853482957169876532,131072 /prefetch:8
                                                                      2⤵
                                                                        PID:6432
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6616 --field-trial-handle=1776,i,7508762439617886636,2853482957169876532,131072 /prefetch:8
                                                                        2⤵
                                                                          PID:6616
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --mojo-platform-channel-handle=4940 --field-trial-handle=1776,i,7508762439617886636,2853482957169876532,131072 /prefetch:1
                                                                          2⤵
                                                                            PID:6684
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=9640 --field-trial-handle=1776,i,7508762439617886636,2853482957169876532,131072 /prefetch:8
                                                                            2⤵
                                                                              PID:6712
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --mojo-platform-channel-handle=9444 --field-trial-handle=1776,i,7508762439617886636,2853482957169876532,131072 /prefetch:1
                                                                              2⤵
                                                                                PID:6784
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --mojo-platform-channel-handle=9756 --field-trial-handle=1776,i,7508762439617886636,2853482957169876532,131072 /prefetch:1
                                                                                2⤵
                                                                                  PID:6792
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --mojo-platform-channel-handle=9772 --field-trial-handle=1776,i,7508762439617886636,2853482957169876532,131072 /prefetch:1
                                                                                  2⤵
                                                                                    PID:6800
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --mojo-platform-channel-handle=10216 --field-trial-handle=1776,i,7508762439617886636,2853482957169876532,131072 /prefetch:1
                                                                                    2⤵
                                                                                      PID:7044
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --mojo-platform-channel-handle=10208 --field-trial-handle=1776,i,7508762439617886636,2853482957169876532,131072 /prefetch:1
                                                                                      2⤵
                                                                                        PID:7052
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --mojo-platform-channel-handle=10500 --field-trial-handle=1776,i,7508762439617886636,2853482957169876532,131072 /prefetch:1
                                                                                        2⤵
                                                                                          PID:7060
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --mojo-platform-channel-handle=10540 --field-trial-handle=1776,i,7508762439617886636,2853482957169876532,131072 /prefetch:1
                                                                                          2⤵
                                                                                            PID:7068
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --mojo-platform-channel-handle=10648 --field-trial-handle=1776,i,7508762439617886636,2853482957169876532,131072 /prefetch:1
                                                                                            2⤵
                                                                                              PID:7076
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --mojo-platform-channel-handle=10656 --field-trial-handle=1776,i,7508762439617886636,2853482957169876532,131072 /prefetch:1
                                                                                              2⤵
                                                                                                PID:7084
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --mojo-platform-channel-handle=10952 --field-trial-handle=1776,i,7508762439617886636,2853482957169876532,131072 /prefetch:1
                                                                                                2⤵
                                                                                                  PID:7028
                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --mojo-platform-channel-handle=10348 --field-trial-handle=1776,i,7508762439617886636,2853482957169876532,131072 /prefetch:1
                                                                                                  2⤵
                                                                                                    PID:7096
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --mojo-platform-channel-handle=11400 --field-trial-handle=1776,i,7508762439617886636,2853482957169876532,131072 /prefetch:1
                                                                                                    2⤵
                                                                                                      PID:7036
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --mojo-platform-channel-handle=11532 --field-trial-handle=1776,i,7508762439617886636,2853482957169876532,131072 /prefetch:1
                                                                                                      2⤵
                                                                                                        PID:7120
                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --mojo-platform-channel-handle=11664 --field-trial-handle=1776,i,7508762439617886636,2853482957169876532,131072 /prefetch:1
                                                                                                        2⤵
                                                                                                          PID:5872
                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --mojo-platform-channel-handle=11796 --field-trial-handle=1776,i,7508762439617886636,2853482957169876532,131072 /prefetch:1
                                                                                                          2⤵
                                                                                                            PID:6676
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --mojo-platform-channel-handle=11956 --field-trial-handle=1776,i,7508762439617886636,2853482957169876532,131072 /prefetch:1
                                                                                                            2⤵
                                                                                                              PID:7220
                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --mojo-platform-channel-handle=12148 --field-trial-handle=1776,i,7508762439617886636,2853482957169876532,131072 /prefetch:1
                                                                                                              2⤵
                                                                                                                PID:7440
                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --mojo-platform-channel-handle=12272 --field-trial-handle=1776,i,7508762439617886636,2853482957169876532,131072 /prefetch:1
                                                                                                                2⤵
                                                                                                                  PID:7456
                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --mojo-platform-channel-handle=12396 --field-trial-handle=1776,i,7508762439617886636,2853482957169876532,131072 /prefetch:1
                                                                                                                  2⤵
                                                                                                                    PID:7464
                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --mojo-platform-channel-handle=12404 --field-trial-handle=1776,i,7508762439617886636,2853482957169876532,131072 /prefetch:1
                                                                                                                    2⤵
                                                                                                                      PID:7500
                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --mojo-platform-channel-handle=13076 --field-trial-handle=1776,i,7508762439617886636,2853482957169876532,131072 /prefetch:1
                                                                                                                      2⤵
                                                                                                                        PID:2444
                                                                                                                    • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                                                                                      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                                                                                                      1⤵
                                                                                                                        PID:2360
                                                                                                                      • C:\Windows\system32\AUDIODG.EXE
                                                                                                                        C:\Windows\system32\AUDIODG.EXE 0x3d4
                                                                                                                        1⤵
                                                                                                                          PID:4528
                                                                                                                        • C:\Windows\System32\rundll32.exe
                                                                                                                          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                                          1⤵
                                                                                                                            PID:6916
                                                                                                                          • C:\Windows\system32\OpenWith.exe
                                                                                                                            C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                            1⤵
                                                                                                                            • Modifies registry class
                                                                                                                            • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                            PID:8040
                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_igt-nomusic-deterministic_e55bf090.zip\Red Ball - IGT Edition.swf"
                                                                                                                              2⤵
                                                                                                                              • Checks processor information in registry
                                                                                                                              • Modifies Internet Explorer settings
                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                              PID:8036
                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
                                                                                                                                3⤵
                                                                                                                                  PID:1628
                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=CB6859F0809D4020935A525990891A19 --mojo-platform-channel-handle=1596 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                                                                                                                                    4⤵
                                                                                                                                      PID:6132
                                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=19853EC0A2637672388C53B93536F4C1 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=19853EC0A2637672388C53B93536F4C1 --renderer-client-id=2 --mojo-platform-channel-handle=1604 --allow-no-sandbox-job /prefetch:1
                                                                                                                                      4⤵
                                                                                                                                        PID:7988
                                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=6EC7342DD81DC7F19C14208F4B9C457F --mojo-platform-channel-handle=2212 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                                                                                                                                        4⤵
                                                                                                                                          PID:6028
                                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F92E67028DC9A2CBEAAEDA1860864C71 --mojo-platform-channel-handle=1736 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                                                                                                                                          4⤵
                                                                                                                                            PID:6532
                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=36A99F1A2F692E2E6D135AEB8C15301D --mojo-platform-channel-handle=1812 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                                                                                                                                            4⤵
                                                                                                                                              PID:2092
                                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
                                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_igt-nomusic-deterministic_e55bf090.zip\Red Ball - IGT Edition.swf"
                                                                                                                                        1⤵
                                                                                                                                        • Checks processor information in registry
                                                                                                                                        • Modifies Internet Explorer settings
                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                        PID:6080
                                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
                                                                                                                                          2⤵
                                                                                                                                            PID:3732
                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A3CA16732EC4F9F6E7035731CA91A7F7 --mojo-platform-channel-handle=1612 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                                                                                                                                              3⤵
                                                                                                                                                PID:4644
                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=2749B8FC0121CB113ABB10010BD1EAC9 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=2749B8FC0121CB113ABB10010BD1EAC9 --renderer-client-id=2 --mojo-platform-channel-handle=1604 --allow-no-sandbox-job /prefetch:1
                                                                                                                                                3⤵
                                                                                                                                                  PID:1284
                                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=094CD132243FB6F053D6DB36C6575884 --mojo-platform-channel-handle=2292 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                                                                                                                                                  3⤵
                                                                                                                                                    PID:5164

                                                                                                                                              Network

                                                                                                                                              MITRE ATT&CK Enterprise v15

                                                                                                                                              Replay Monitor

                                                                                                                                              Loading Replay Monitor...

                                                                                                                                              Downloads

                                                                                                                                              • C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\UserCache.bin

                                                                                                                                                Filesize

                                                                                                                                                38KB

                                                                                                                                                MD5

                                                                                                                                                401a898190dac713572ec69a53ca39b6

                                                                                                                                                SHA1

                                                                                                                                                0653d10f804a724ce29ab0b78bde78f86a158447

                                                                                                                                                SHA256

                                                                                                                                                9f4e11ca9669a51cd8033496596eeb852adb56679d81a40e665498b55ab68060

                                                                                                                                                SHA512

                                                                                                                                                a7d3fdc020b1e78aa9ac1d7190581d4bed8aa4eabf3157ec739b8866bcf243a70d8bd649bba0ebc9bcfa78f3b671241436450edbf54e90a0efd7bed5114af6ab

                                                                                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                                                                Filesize

                                                                                                                                                1KB

                                                                                                                                                MD5

                                                                                                                                                021f2a4c12d1f65c6511a537ff70d998

                                                                                                                                                SHA1

                                                                                                                                                b76f76699ac79638e78b098173b19040ece7491e

                                                                                                                                                SHA256

                                                                                                                                                419d1ab3062355e2e7f5a09e6f2ee4f1d8d91c40124a78dcc27ae0c37b1dd04b

                                                                                                                                                SHA512

                                                                                                                                                fce6038ed606dba2526ce6be86cf6f876a6673f372d1a05bee1a02dfea32ad572aa250bf578c03fe990e583476c7a29e9331f6498d036c7b727068174563f74a

                                                                                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                                                                                Filesize

                                                                                                                                                4KB

                                                                                                                                                MD5

                                                                                                                                                f9864a5d38a86b55ed3b8b3d9dd71735

                                                                                                                                                SHA1

                                                                                                                                                2d895c18f9f9f72c9aa185a9815f57d48fc34ba5

                                                                                                                                                SHA256

                                                                                                                                                41d132f1b0dc9099c44e0d7247c21ab612accb33c2f4ae24e4a7dfd951d622c3

                                                                                                                                                SHA512

                                                                                                                                                a86c19f4a0411e00f0a534909922f711d01a4d123e091b295a473b3985d385567610aa6d2864977206574e79da1c6e65644c7b0cce9c89b5dc94374d3158b7d3

                                                                                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                                                                                Filesize

                                                                                                                                                3KB

                                                                                                                                                MD5

                                                                                                                                                08fe005caf39c0d3e42feb5966b8e712

                                                                                                                                                SHA1

                                                                                                                                                dc209d45f364c7517759fc90d42492713e9b9170

                                                                                                                                                SHA256

                                                                                                                                                2cbf81e059e18897c80ed880b22de763d09c093ba1fb751c3f2cee5129f8bdf8

                                                                                                                                                SHA512

                                                                                                                                                6505db860af48efc14a9cf2fba5cf2a6288d00dd4c83bf530d0a01ff8e8ceecaa4667209c2fef9345935202d64ee2e97eaa1a6ee8aca13e00662696b06fe76ff

                                                                                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                                                                                Filesize

                                                                                                                                                2KB

                                                                                                                                                MD5

                                                                                                                                                2ea755c377a87b3296054877b4cb3892

                                                                                                                                                SHA1

                                                                                                                                                897f1ae47c3324c86010a8d478922ce6791301bb

                                                                                                                                                SHA256

                                                                                                                                                c4e05b53d32fbd40e22753c7c4f0806d2ec727524c09012909d8ad8d95963335

                                                                                                                                                SHA512

                                                                                                                                                5b4f6dbcbf0c80b122822e88572ecdf32c89c20dc4220e36f8f4e5b8edb1854023b2eedf891b403d0634dfb86fc198df281eeb69d8cccac4a8de9570dd69e604

                                                                                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                                                                                Filesize

                                                                                                                                                4KB

                                                                                                                                                MD5

                                                                                                                                                edd749d10b995184c4c7c228bd58575d

                                                                                                                                                SHA1

                                                                                                                                                a0b1261c41d58b3cac0e9d882415d9afd7135e94

                                                                                                                                                SHA256

                                                                                                                                                50cd3fb6178794154a276f4d866e3897b8e1efdbab5a485dc11f86d5bae8b7df

                                                                                                                                                SHA512

                                                                                                                                                706fccdaca7ed4d4b706349f44196617fee79708ac4ef16c5537e9efbf34cef129ac56ecf01f62d5b00e3c21642aa9d4a9265bb10baa8f04d0ae4410b1f89294

                                                                                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\d8045142-73c4-4a01-bc8e-70a4cb38a9a8.tmp

                                                                                                                                                Filesize

                                                                                                                                                4KB

                                                                                                                                                MD5

                                                                                                                                                40f17f01e050689296abab9a9ddef84b

                                                                                                                                                SHA1

                                                                                                                                                cc61f69d5d49631eff26ef5ec9ab128e6c2d90f4

                                                                                                                                                SHA256

                                                                                                                                                e9ac37b2fa90d442e2699015a2d1be56b40aa2a9bba46d686b4ca26423fd895d

                                                                                                                                                SHA512

                                                                                                                                                a3aa011f8fd49d6bde1d532281a951cf2c1ee7ceafed5e97030f5ad852a12582086b1d8e2fe944b0baf318df4f869c6c0684b9b1276f2825da69f22927fb1910

                                                                                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                                                Filesize

                                                                                                                                                6KB

                                                                                                                                                MD5

                                                                                                                                                63f2d0402df28626114a7b0e0b97c0cf

                                                                                                                                                SHA1

                                                                                                                                                6078f6c97164b04bb25e74006b4c0d8a81cc399c

                                                                                                                                                SHA256

                                                                                                                                                a353fd9679d619f254d2814cc5d56a80850d75629ad4fa06e598bb2f4e22bdb1

                                                                                                                                                SHA512

                                                                                                                                                4616053ed5107cb83b2cadb0ed415e1026a42cc0dd0854be869fe38faca774d36053d77e9982fd19ed0af38a18acfc67195ef4454558499fa7c90a3fe40622b8

                                                                                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                                                Filesize

                                                                                                                                                6KB

                                                                                                                                                MD5

                                                                                                                                                4f395d0e93a4a06278dedf4397c74331

                                                                                                                                                SHA1

                                                                                                                                                0e22b6f8d79c223fed3e6ca886fa674c047c05d2

                                                                                                                                                SHA256

                                                                                                                                                c432b2a8de2289cf83b359b232d4a22ec7a8fae661ae366c0186b8d55ad1ec96

                                                                                                                                                SHA512

                                                                                                                                                29cfac508b5994c309ccbf1d3634bbc7d729386f920bd821cadbdce7d83c759b70730f428dcc61ac59559a847d5c2fc847e7f62543a8e5cca1eca200268dfe74

                                                                                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                                                Filesize

                                                                                                                                                6KB

                                                                                                                                                MD5

                                                                                                                                                664b5ee980c2b4e4b2181d46e8528e5d

                                                                                                                                                SHA1

                                                                                                                                                00632b14ff02bce7ce996c75eaebac64f201e4d9

                                                                                                                                                SHA256

                                                                                                                                                24ec65fdd05bdade833b3ae4b4f2ec869c21effe179abbbc75c27c90ad6a0146

                                                                                                                                                SHA512

                                                                                                                                                56d79be32a78d95ba7b13a7f277aa7bc2a0b6b719179c6719b26f5741e5997f10c5cf5828266b204ad049e279a688e339643e639301ff9fa83907527b642dc53

                                                                                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                                                                                                Filesize

                                                                                                                                                136KB

                                                                                                                                                MD5

                                                                                                                                                ed34840ef8a945b32030c3975f502371

                                                                                                                                                SHA1

                                                                                                                                                77bb422064dddfe8f1dba394b5f281a9719dd389

                                                                                                                                                SHA256

                                                                                                                                                6d18b6c2712d27432499635da9263e1a0b26ab1dacc1d64f7cccb6a3c3a18f22

                                                                                                                                                SHA512

                                                                                                                                                9c0c827cb8fcf0dc615cb1dc60cd390fdcfb014906e23da11094c16556f1a02dc826f8916d39ca309d6b43a790b6bb624f518f1c6425bd0843d8bd0f4e75c230

                                                                                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                                                                                                                                Filesize

                                                                                                                                                2B

                                                                                                                                                MD5

                                                                                                                                                99914b932bd37a50b983c5e7c90ae93b

                                                                                                                                                SHA1

                                                                                                                                                bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                                                                                                                                SHA256

                                                                                                                                                44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                                                                                                                                SHA512

                                                                                                                                                27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                                                                                                                                              • C:\Users\Admin\Downloads\igt-nomusic-deterministic_e55bf090.zip.crdownload

                                                                                                                                                Filesize

                                                                                                                                                1008KB

                                                                                                                                                MD5

                                                                                                                                                e55bf090301eb49631e43970e1093bd5

                                                                                                                                                SHA1

                                                                                                                                                ed9bf9761ce3351b7c121f17d315cf05b58cecce

                                                                                                                                                SHA256

                                                                                                                                                cba452a10943055350ff7a2204a1966ab664e636877ee54f4f8ffc46edaf1f6f

                                                                                                                                                SHA512

                                                                                                                                                29a376f1a9ab6eed2cdf262393f4a6c5d7857fbd90f88c1e6c84f7ce6815caae0f6af6c51c0b81fc74d6f7868533f859f2aba4a6219b1636fb9dd93ef9585cef