Overview

overview

10

Static

static

10

b2bd3de3e5...bb.exe

windows10-2004-x64

10

cd9ccf8681...f7.exe

windows10-2004-x64

10

cobaltstri...de.exe

windows10-2004-x64

10

default.exe

windows10-2004-x64

10

ec4f09f82d...d3.exe

windows10-2004-x64

10

emotet_exe...04.exe

windows10-2004-x64

10

emotet_exe...23.exe

windows10-2004-x64

10

eupdate.exe

windows10-2004-x64

7

f4f47c67be...3f.exe

windows10-2004-x64

10

fb5d110ced...9c.exe

windows10-2004-x64

6

fee15285c3...35.exe

windows10-2004-x64

10

file(1).exe

windows10-2004-x64

1

file.exe

windows10-2004-x64

7

gjMEi6eG.exe

windows10-2004-x64

10

good.exe

windows10-2004-x64

10

hyundai st...1).exe

windows10-2004-x64

10

hyundai st...10.exe

windows10-2004-x64

10

infected d...er.exe

windows10-2004-x64

10

inps_979.xls

windows10-2004-x64

1

june9.dll

windows10-2004-x64

10

mouse_2.exe

windows10-2004-x64

10

oof.exe

windows10-2004-x64

10

openme.exe

windows10-2004-x64

10

ou55sg33s_1.exe

windows10-2004-x64

10

senate.dll

windows10-2004-x64

10

starticon3.exe

windows10-2004-x64

10

update.exe

windows10-2004-x64

10

vir1.xlsx

windows10-2004-x64

1

wwf[1].exe

windows10-2004-x64

10

xNet.dll

windows10-2004-x64

1

전산 및...��.exe

windows10-2004-x64

10

전산 및...�1.exe

windows10-2004-x64

10

Resubmissions

15/04/2025, 17:34

250415-v5ylksypw9 10

15/04/2025, 06:16

250415-g1p7ras1dw 10

14/04/2025, 08:06

250414-jzpwpstxhx 10

14/04/2025, 07:59

250414-jvg1assky4 10

14/04/2025, 07:22

250414-h7g1dss1h1 10

14/04/2025, 07:16

250414-h3xv2s1nv6 10

11/04/2025, 21:39

250411-1h113szzaz 10

01/04/2025, 21:24

250401-z8184awycs 10

Analysis

  • max time kernel
    148s
  • max time network
    129s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250410-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250410-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/04/2025, 08:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    oof.exe

  • Size

    662KB

  • MD5

    0760d43d4adebe20fa0b5e5a7bca1714

  • SHA1

    a0a9dae5e9be39bca31021dd9cf565fcdefb8474

  • SHA256

    8f9067f2bd4a374539a40fddb8915600c9fd6ba3e5db20cbddcb3c5f22d9da44

  • SHA512

    7e60c2726711bb8e822375f93cfb9ced7d172f3f0ae07041cbeea8c4cdb45488d1de90ee77dfef52aa86722a5dcbe521d1affeace3aec8811e851f693d74ef77

  • SSDEEP

    12288:9TEUsvsVEcwaFNaxr7IwFnm1p7BmC10sHo0AhHL:9oBvRcxuxrksqRNI0i

Score
10/10
betabotbackdoorbotnetdefense_evasiondiscoverypersistencetrojan

Malware Config

Signatures

  • BetaBot

    Beta Bot is a Trojan that infects computers and disables Antivirus.

    trojanbackdoorbotnetbetabot
  • Betabot family
    betabot
  • Modifies firewall policy service 3 TTPs 64 IoCs
    defense_evasion
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 34 IoCs
    persistence
  • Checks BIOS information in registry 2 TTPs 16 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 64 IoCs
  • Adds Run key to start application 2 TTPs 32 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 48 IoCs
    defense_evasiontrojan
  • Indicator Removal: Clear Persistence 1 TTPs 1 IoCs

    remove IFEO.

    defense_evasion
  • Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
  • Suspicious use of SetThreadContext 48 IoCs
  • Program crash 16 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 64 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 32 IoCs
  • Modifies Internet Explorer Protected Mode 1 TTPs 64 IoCs
  • Modifies Internet Explorer Protected Mode Banner 1 TTPs 16 IoCs
  • Modifies Internet Explorer settings 1 TTPs 16 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\oof.exe
    "C:\Users\Admin\AppData\Local\Temp\oof.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:1700
    • C:\Users\Admin\AppData\Local\Temp\oof.exe
      "C:\Users\Admin\AppData\Local\Temp\oof.exe"
      2⤵
      • Event Triggered Execution: Image File Execution Options Injection
      • Checks whether UAC is enabled
      • Indicator Removal: Clear Persistence
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Checks processor information in registry
      • Suspicious behavior: MapViewOfSection
      • Suspicious behavior: RenamesItself
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2952
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        3⤵
        • Modifies firewall policy service
        • Event Triggered Execution: Image File Execution Options Injection
        • Checks BIOS information in registry
        • Adds Run key to start application
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Enumerates system info in registry
        • Modifies Internet Explorer Protected Mode
        • Modifies Internet Explorer Protected Mode Banner
        • Modifies Internet Explorer settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3344
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 1120
          4⤵
          • Program crash
          PID:4932
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
    1⤵
      PID:4092
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:620
      • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
        "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:4844
        • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
          "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
          3⤵
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Checks processor information in registry
          • Suspicious use of AdjustPrivilegeToken
          PID:4468
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
      1⤵
        PID:4032
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:1672
        • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
          "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
          2⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of WriteProcessMemory
          PID:2040
          • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
            "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
            3⤵
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious use of AdjustPrivilegeToken
            PID:3672
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
        1⤵
          PID:2256
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
          1⤵
          • Suspicious use of WriteProcessMemory
          PID:5052
          • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
            "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
            2⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of WriteProcessMemory
            PID:4816
            • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
              "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
              3⤵
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Checks processor information in registry
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:368
              • C:\Windows\SysWOW64\explorer.exe
                C:\Windows\SysWOW64\explorer.exe
                4⤵
                • Modifies firewall policy service
                • Event Triggered Execution: Image File Execution Options Injection
                • Checks BIOS information in registry
                • Adds Run key to start application
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Checks processor information in registry
                • Enumerates system info in registry
                • Modifies Internet Explorer Protected Mode
                • Modifies Internet Explorer Protected Mode Banner
                • Modifies Internet Explorer settings
                • Suspicious behavior: EnumeratesProcesses
                PID:2144
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 2144 -s 1112
                  5⤵
                  • Program crash
                  PID:3636
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3344 -ip 3344
          1⤵
            PID:4540
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
            1⤵
            • Suspicious use of WriteProcessMemory
            PID:744
            • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
              "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
              2⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of WriteProcessMemory
              PID:4100
              • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                3⤵
                • Executes dropped EXE
                • Checks whether UAC is enabled
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Checks processor information in registry
                PID:1988
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
            1⤵
              PID:4048
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
              1⤵
                PID:4568
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                1⤵
                • Suspicious use of WriteProcessMemory
                PID:1372
                • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                  "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious behavior: MapViewOfSection
                  • Suspicious use of WriteProcessMemory
                  PID:3220
                  • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                    "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                    3⤵
                    • Executes dropped EXE
                    • Checks whether UAC is enabled
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Checks processor information in registry
                    PID:2612
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                1⤵
                • Suspicious use of WriteProcessMemory
                PID:2752
                • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                  "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious behavior: MapViewOfSection
                  • Suspicious use of WriteProcessMemory
                  PID:1852
                  • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                    "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                    3⤵
                    • Executes dropped EXE
                    • Checks whether UAC is enabled
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • System Location Discovery: System Language Discovery
                    • Checks processor information in registry
                    • Suspicious behavior: MapViewOfSection
                    • Suspicious use of WriteProcessMemory
                    PID:3584
                    • C:\Windows\SysWOW64\explorer.exe
                      C:\Windows\SysWOW64\explorer.exe
                      4⤵
                      • Modifies firewall policy service
                      • Event Triggered Execution: Image File Execution Options Injection
                      • Checks BIOS information in registry
                      • Adds Run key to start application
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • System Location Discovery: System Language Discovery
                      • Enumerates system info in registry
                      • Modifies Internet Explorer Protected Mode
                      • Modifies Internet Explorer Protected Mode Banner
                      • Modifies Internet Explorer settings
                      • Suspicious behavior: EnumeratesProcesses
                      PID:4056
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 4056 -s 1148
                        5⤵
                        • Program crash
                        PID:2256
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                1⤵
                  PID:4440
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2144 -ip 2144
                  1⤵
                    PID:648
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                    1⤵
                      PID:4980
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                      1⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4532
                      • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                        "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                        2⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious behavior: MapViewOfSection
                        • Suspicious use of WriteProcessMemory
                        PID:3484
                        • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                          "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                          3⤵
                          • Executes dropped EXE
                          • Checks whether UAC is enabled
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          PID:760
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                      1⤵
                        PID:4316
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                        1⤵
                        • Suspicious use of WriteProcessMemory
                        PID:4712
                        • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                          "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                          2⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious behavior: MapViewOfSection
                          • Suspicious use of WriteProcessMemory
                          PID:2976
                          • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                            "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                            3⤵
                            • Executes dropped EXE
                            • Checks whether UAC is enabled
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            • Checks processor information in registry
                            PID:1504
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                        1⤵
                          PID:1664
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                          1⤵
                          • Suspicious use of WriteProcessMemory
                          PID:1628
                          • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                            "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                            2⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious behavior: MapViewOfSection
                            • Suspicious use of WriteProcessMemory
                            PID:2184
                            • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                              "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                              3⤵
                              • Executes dropped EXE
                              • Checks whether UAC is enabled
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • Checks processor information in registry
                              • Suspicious behavior: MapViewOfSection
                              PID:3648
                              • C:\Windows\SysWOW64\explorer.exe
                                C:\Windows\SysWOW64\explorer.exe
                                4⤵
                                • Modifies firewall policy service
                                • Event Triggered Execution: Image File Execution Options Injection
                                • Checks BIOS information in registry
                                • Adds Run key to start application
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                • System Location Discovery: System Language Discovery
                                • Checks processor information in registry
                                • Enumerates system info in registry
                                • Modifies Internet Explorer Protected Mode
                                • Modifies Internet Explorer Protected Mode Banner
                                • Modifies Internet Explorer settings
                                • Suspicious behavior: EnumeratesProcesses
                                PID:2956
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 2956 -s 1120
                                  5⤵
                                  • Program crash
                                  PID:4520
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4056 -ip 4056
                          1⤵
                            PID:1612
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                            1⤵
                              PID:1192
                              • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                2⤵
                                • Executes dropped EXE
                                • Suspicious use of SetThreadContext
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious behavior: MapViewOfSection
                                PID:1964
                                • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                  "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                  3⤵
                                  • Executes dropped EXE
                                  • Checks whether UAC is enabled
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  PID:4772
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                              1⤵
                                PID:4816
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                1⤵
                                  PID:4412
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                  1⤵
                                    PID:608
                                    • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                      "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                      2⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetThreadContext
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious behavior: MapViewOfSection
                                      PID:428
                                      • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                        "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                        3⤵
                                        • Executes dropped EXE
                                        • Checks whether UAC is enabled
                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                        • Checks processor information in registry
                                        PID:2276
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                    1⤵
                                      PID:4132
                                      • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                        "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                        2⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetThreadContext
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious behavior: MapViewOfSection
                                        PID:1212
                                        • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                          "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                          3⤵
                                          • Executes dropped EXE
                                          • Checks whether UAC is enabled
                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious behavior: MapViewOfSection
                                          PID:2100
                                          • C:\Windows\SysWOW64\explorer.exe
                                            C:\Windows\SysWOW64\explorer.exe
                                            4⤵
                                            • Modifies firewall policy service
                                            • Event Triggered Execution: Image File Execution Options Injection
                                            • Checks BIOS information in registry
                                            • Adds Run key to start application
                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                            • System Location Discovery: System Language Discovery
                                            • Checks processor information in registry
                                            • Enumerates system info in registry
                                            • Modifies Internet Explorer Protected Mode
                                            • Modifies Internet Explorer Protected Mode Banner
                                            • Modifies Internet Explorer settings
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:2752
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -u -p 2752 -s 1124
                                              5⤵
                                              • Program crash
                                              PID:1332
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                      1⤵
                                        PID:3424
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2956 -ip 2956
                                        1⤵
                                          PID:1604
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                          1⤵
                                            PID:4496
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                            1⤵
                                              PID:3416
                                              • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                2⤵
                                                • Executes dropped EXE
                                                • Suspicious use of SetThreadContext
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious behavior: MapViewOfSection
                                                PID:1620
                                                • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                  "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                  3⤵
                                                  • Executes dropped EXE
                                                  • Checks whether UAC is enabled
                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                  • Checks processor information in registry
                                                  PID:4024
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                              1⤵
                                                PID:2968
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                1⤵
                                                  PID:4696
                                                  • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                    "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                    2⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetThreadContext
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious behavior: MapViewOfSection
                                                    PID:4968
                                                    • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                      "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                      3⤵
                                                      • Executes dropped EXE
                                                      • Checks whether UAC is enabled
                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                      PID:1700
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                  1⤵
                                                    PID:1420
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                    1⤵
                                                      PID:4704
                                                      • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                        "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                        2⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetThreadContext
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious behavior: MapViewOfSection
                                                        PID:3512
                                                        • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                          "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                          3⤵
                                                          • Executes dropped EXE
                                                          • Checks whether UAC is enabled
                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious behavior: MapViewOfSection
                                                          PID:4088
                                                          • C:\Windows\SysWOW64\explorer.exe
                                                            C:\Windows\SysWOW64\explorer.exe
                                                            4⤵
                                                            • Modifies firewall policy service
                                                            • Event Triggered Execution: Image File Execution Options Injection
                                                            • Checks BIOS information in registry
                                                            • Adds Run key to start application
                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                            • System Location Discovery: System Language Discovery
                                                            • Checks processor information in registry
                                                            • Enumerates system info in registry
                                                            • Modifies Internet Explorer Protected Mode
                                                            • Modifies Internet Explorer Protected Mode Banner
                                                            • Modifies Internet Explorer settings
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:4236
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 4236 -s 1144
                                                              5⤵
                                                              • Program crash
                                                              PID:3424
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2752 -ip 2752
                                                      1⤵
                                                        PID:1932
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                        1⤵
                                                          PID:2896
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                          1⤵
                                                            PID:1100
                                                            • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                              "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                              2⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of SetThreadContext
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious behavior: MapViewOfSection
                                                              PID:4472
                                                              • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                3⤵
                                                                • Executes dropped EXE
                                                                • Checks whether UAC is enabled
                                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                • Checks processor information in registry
                                                                PID:2268
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                            1⤵
                                                              PID:1548
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                              1⤵
                                                                PID:736
                                                                • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                  "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                  2⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of SetThreadContext
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  • Suspicious behavior: MapViewOfSection
                                                                  PID:4048
                                                                  • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                    "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                    3⤵
                                                                    • Executes dropped EXE
                                                                    • Checks whether UAC is enabled
                                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                    • Checks processor information in registry
                                                                    PID:2392
                                                              • C:\Windows\system32\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                1⤵
                                                                  PID:3996
                                                                  • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                    "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                    2⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of SetThreadContext
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    • Suspicious behavior: MapViewOfSection
                                                                    PID:1660
                                                                    • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                      "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                      3⤵
                                                                      • Executes dropped EXE
                                                                      • Checks whether UAC is enabled
                                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Checks processor information in registry
                                                                      • Suspicious behavior: MapViewOfSection
                                                                      PID:3700
                                                                      • C:\Windows\SysWOW64\explorer.exe
                                                                        C:\Windows\SysWOW64\explorer.exe
                                                                        4⤵
                                                                        • Modifies firewall policy service
                                                                        • Event Triggered Execution: Image File Execution Options Injection
                                                                        • Checks BIOS information in registry
                                                                        • Adds Run key to start application
                                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                        • Checks processor information in registry
                                                                        • Enumerates system info in registry
                                                                        • Modifies Internet Explorer Protected Mode
                                                                        • Modifies Internet Explorer Protected Mode Banner
                                                                        • Modifies Internet Explorer settings
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        PID:884
                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 884 -s 1148
                                                                          5⤵
                                                                          • Program crash
                                                                          PID:1672
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                  1⤵
                                                                    PID:3656
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4236 -ip 4236
                                                                    1⤵
                                                                      PID:804
                                                                    • C:\Windows\system32\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                      1⤵
                                                                        PID:5068
                                                                        • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                          "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                          2⤵
                                                                          • Executes dropped EXE
                                                                          • Suspicious use of SetThreadContext
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Suspicious behavior: MapViewOfSection
                                                                          PID:4832
                                                                          • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                            "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                            3⤵
                                                                            • Executes dropped EXE
                                                                            • Checks whether UAC is enabled
                                                                            • Checks processor information in registry
                                                                            PID:680
                                                                      • C:\Windows\system32\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                        1⤵
                                                                          PID:4204
                                                                        • C:\Windows\system32\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                          1⤵
                                                                            PID:3540
                                                                          • C:\Windows\system32\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                            1⤵
                                                                              PID:2884
                                                                              • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                2⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of SetThreadContext
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious behavior: MapViewOfSection
                                                                                PID:512
                                                                                • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                  "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                  3⤵
                                                                                  • Executes dropped EXE
                                                                                  • Checks whether UAC is enabled
                                                                                  PID:3388
                                                                            • C:\Windows\system32\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                              1⤵
                                                                                PID:2112
                                                                              • C:\Windows\system32\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                1⤵
                                                                                  PID:3060
                                                                                  • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                    "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                    2⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of SetThreadContext
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Suspicious behavior: MapViewOfSection
                                                                                    PID:3236
                                                                                    • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                      "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                      3⤵
                                                                                      • Executes dropped EXE
                                                                                      • Checks whether UAC is enabled
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Checks processor information in registry
                                                                                      • Suspicious behavior: MapViewOfSection
                                                                                      PID:1664
                                                                                      • C:\Windows\SysWOW64\explorer.exe
                                                                                        C:\Windows\SysWOW64\explorer.exe
                                                                                        4⤵
                                                                                        • Modifies firewall policy service
                                                                                        • Event Triggered Execution: Image File Execution Options Injection
                                                                                        • Checks BIOS information in registry
                                                                                        • Adds Run key to start application
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Checks processor information in registry
                                                                                        • Enumerates system info in registry
                                                                                        • Modifies Internet Explorer Protected Mode
                                                                                        • Modifies Internet Explorer Protected Mode Banner
                                                                                        • Modifies Internet Explorer settings
                                                                                        PID:1932
                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 1084
                                                                                          5⤵
                                                                                          • Program crash
                                                                                          PID:2540
                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 884 -ip 884
                                                                                  1⤵
                                                                                    PID:1644
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                    1⤵
                                                                                      PID:2488
                                                                                      • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                        "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                        2⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of SetThreadContext
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Suspicious behavior: MapViewOfSection
                                                                                        PID:4704
                                                                                        • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                          "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                          3⤵
                                                                                          • Executes dropped EXE
                                                                                          • Checks whether UAC is enabled
                                                                                          • Checks processor information in registry
                                                                                          PID:2412
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                      1⤵
                                                                                        PID:708
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                        1⤵
                                                                                          PID:3692
                                                                                        • C:\Windows\system32\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                          1⤵
                                                                                            PID:4184
                                                                                            • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                              "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                              2⤵
                                                                                              • Executes dropped EXE
                                                                                              • Suspicious use of SetThreadContext
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Suspicious behavior: MapViewOfSection
                                                                                              PID:2640
                                                                                              • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                3⤵
                                                                                                • Executes dropped EXE
                                                                                                • Checks whether UAC is enabled
                                                                                                • Checks processor information in registry
                                                                                                PID:4472
                                                                                          • C:\Windows\system32\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                            1⤵
                                                                                              PID:744
                                                                                            • C:\Windows\system32\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                              1⤵
                                                                                                PID:1512
                                                                                                • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                  "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                  2⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Suspicious use of SetThreadContext
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:4100
                                                                                                  • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                    "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                    3⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Checks whether UAC is enabled
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Checks processor information in registry
                                                                                                    PID:3656
                                                                                                    • C:\Windows\SysWOW64\explorer.exe
                                                                                                      C:\Windows\SysWOW64\explorer.exe
                                                                                                      4⤵
                                                                                                      • Modifies firewall policy service
                                                                                                      • Event Triggered Execution: Image File Execution Options Injection
                                                                                                      • Checks BIOS information in registry
                                                                                                      • Adds Run key to start application
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Checks processor information in registry
                                                                                                      • Enumerates system info in registry
                                                                                                      • Modifies Internet Explorer Protected Mode
                                                                                                      • Modifies Internet Explorer Protected Mode Banner
                                                                                                      • Modifies Internet Explorer settings
                                                                                                      PID:3536
                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 3536 -s 1148
                                                                                                        5⤵
                                                                                                        • Program crash
                                                                                                        PID:2884
                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1932 -ip 1932
                                                                                                1⤵
                                                                                                  PID:4672
                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                  1⤵
                                                                                                    PID:4200
                                                                                                    • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                      "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                      2⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Suspicious use of SetThreadContext
                                                                                                      PID:3552
                                                                                                      • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                        "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                        3⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Checks whether UAC is enabled
                                                                                                        • Checks processor information in registry
                                                                                                        PID:3504
                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                    1⤵
                                                                                                      PID:4960
                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                      1⤵
                                                                                                        PID:3648
                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                        1⤵
                                                                                                          PID:620
                                                                                                          • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                            "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                            2⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of SetThreadContext
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:5020
                                                                                                            • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                              "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                              3⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Checks whether UAC is enabled
                                                                                                              • Checks processor information in registry
                                                                                                              PID:4948
                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                          1⤵
                                                                                                            PID:3468
                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                            1⤵
                                                                                                              PID:4536
                                                                                                              • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                                "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                                2⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                PID:3564
                                                                                                                • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                                  "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                                  3⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Checks whether UAC is enabled
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:4976
                                                                                                                  • C:\Windows\SysWOW64\explorer.exe
                                                                                                                    C:\Windows\SysWOW64\explorer.exe
                                                                                                                    4⤵
                                                                                                                    • Modifies firewall policy service
                                                                                                                    • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                    • Checks BIOS information in registry
                                                                                                                    • Adds Run key to start application
                                                                                                                    • Checks processor information in registry
                                                                                                                    • Enumerates system info in registry
                                                                                                                    • Modifies Internet Explorer Protected Mode
                                                                                                                    • Modifies Internet Explorer Protected Mode Banner
                                                                                                                    • Modifies Internet Explorer settings
                                                                                                                    PID:1360
                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1360 -s 1120
                                                                                                                      5⤵
                                                                                                                      • Program crash
                                                                                                                      PID:3512
                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3536 -ip 3536
                                                                                                              1⤵
                                                                                                                PID:2320
                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                                1⤵
                                                                                                                  PID:3856
                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                                  1⤵
                                                                                                                    PID:2112
                                                                                                                    • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                                      "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                                      2⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      PID:3012
                                                                                                                      • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                                        "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                                        3⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Checks whether UAC is enabled
                                                                                                                        PID:5108
                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                                    1⤵
                                                                                                                      PID:1140
                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                                      1⤵
                                                                                                                        PID:1328
                                                                                                                        • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                                          "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                                          2⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                          PID:3604
                                                                                                                          • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                                            "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                                            3⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Checks whether UAC is enabled
                                                                                                                            • Checks processor information in registry
                                                                                                                            PID:3412
                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                                        1⤵
                                                                                                                          PID:2504
                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                                          1⤵
                                                                                                                            PID:4932
                                                                                                                            • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                                              "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                                              2⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:1812
                                                                                                                              • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                                                "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                                                3⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Checks whether UAC is enabled
                                                                                                                                • Checks processor information in registry
                                                                                                                                PID:2712
                                                                                                                                • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                  C:\Windows\SysWOW64\explorer.exe
                                                                                                                                  4⤵
                                                                                                                                  • Modifies firewall policy service
                                                                                                                                  • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                  • Checks BIOS information in registry
                                                                                                                                  • Adds Run key to start application
                                                                                                                                  • Checks processor information in registry
                                                                                                                                  • Enumerates system info in registry
                                                                                                                                  • Modifies Internet Explorer Protected Mode
                                                                                                                                  • Modifies Internet Explorer Protected Mode Banner
                                                                                                                                  • Modifies Internet Explorer settings
                                                                                                                                  PID:3300
                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 3300 -s 1092
                                                                                                                                    5⤵
                                                                                                                                    • Program crash
                                                                                                                                    PID:4408
                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1360 -ip 1360
                                                                                                                            1⤵
                                                                                                                              PID:4252
                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                                              1⤵
                                                                                                                                PID:3688
                                                                                                                                • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                                                  "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                                                  2⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:1824
                                                                                                                                  • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                                                    "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                                                    3⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Checks whether UAC is enabled
                                                                                                                                    • Checks processor information in registry
                                                                                                                                    PID:4784
                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                                                1⤵
                                                                                                                                  PID:1192
                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                                                  1⤵
                                                                                                                                    PID:316
                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                                                    1⤵
                                                                                                                                      PID:724
                                                                                                                                      • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                                                        "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                                                        2⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:968
                                                                                                                                        • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                                                          "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                                                          3⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Checks whether UAC is enabled
                                                                                                                                          • Checks processor information in registry
                                                                                                                                          PID:228
                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                                                      1⤵
                                                                                                                                        PID:648
                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                                                        1⤵
                                                                                                                                          PID:3004
                                                                                                                                          • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                                                            "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                                                            2⤵
                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:4144
                                                                                                                                            • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                                                              "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                                                              3⤵
                                                                                                                                              • Checks whether UAC is enabled
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:3196
                                                                                                                                              • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                4⤵
                                                                                                                                                • Modifies firewall policy service
                                                                                                                                                • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                                • Checks BIOS information in registry
                                                                                                                                                • Adds Run key to start application
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                • Checks processor information in registry
                                                                                                                                                • Enumerates system info in registry
                                                                                                                                                • Modifies Internet Explorer Protected Mode
                                                                                                                                                • Modifies Internet Explorer Protected Mode Banner
                                                                                                                                                • Modifies Internet Explorer settings
                                                                                                                                                PID:5084
                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 1148
                                                                                                                                                  5⤵
                                                                                                                                                  • Program crash
                                                                                                                                                  PID:4112
                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3300 -ip 3300
                                                                                                                                          1⤵
                                                                                                                                            PID:1304
                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                                                            1⤵
                                                                                                                                              PID:3008
                                                                                                                                              • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                                                                "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                                                                2⤵
                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:2968
                                                                                                                                                • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                                                                  "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                                                                  3⤵
                                                                                                                                                  • Checks whether UAC is enabled
                                                                                                                                                  PID:244
                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                                                              1⤵
                                                                                                                                                PID:2296
                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                                                                1⤵
                                                                                                                                                  PID:3996
                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                                                                  1⤵
                                                                                                                                                    PID:3484
                                                                                                                                                    • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                                                                      "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                                                                      2⤵
                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:3964
                                                                                                                                                      • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                                                                        "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                                                                        3⤵
                                                                                                                                                        • Checks whether UAC is enabled
                                                                                                                                                        • Checks processor information in registry
                                                                                                                                                        PID:840
                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                                                                    1⤵
                                                                                                                                                      PID:1520
                                                                                                                                                      • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                                                                        "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                                                                        2⤵
                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        PID:3128
                                                                                                                                                        • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                                                                          "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                                                                          3⤵
                                                                                                                                                          • Checks whether UAC is enabled
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          • Checks processor information in registry
                                                                                                                                                          PID:2256
                                                                                                                                                          • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                            C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                            4⤵
                                                                                                                                                            • Modifies firewall policy service
                                                                                                                                                            • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                                            • Checks BIOS information in registry
                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            • Checks processor information in registry
                                                                                                                                                            • Enumerates system info in registry
                                                                                                                                                            • Modifies Internet Explorer Protected Mode
                                                                                                                                                            • Modifies Internet Explorer Protected Mode Banner
                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                            PID:1696
                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 1120
                                                                                                                                                              5⤵
                                                                                                                                                              • Program crash
                                                                                                                                                              PID:396
                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                                                                      1⤵
                                                                                                                                                        PID:3404
                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 5084 -ip 5084
                                                                                                                                                        1⤵
                                                                                                                                                          PID:3616
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                                                                          1⤵
                                                                                                                                                            PID:3892
                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                                                                            1⤵
                                                                                                                                                              PID:1836
                                                                                                                                                              • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                                                                                "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                                                                                2⤵
                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                PID:1032
                                                                                                                                                                • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                                                                                  "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                                                                                  3⤵
                                                                                                                                                                  • Checks whether UAC is enabled
                                                                                                                                                                  • Checks processor information in registry
                                                                                                                                                                  PID:4932
                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                                                                              1⤵
                                                                                                                                                                PID:3740
                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:4884
                                                                                                                                                                  • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                                                                                    "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                                                                                    2⤵
                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    PID:3264
                                                                                                                                                                    • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                                                                                      "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                                                                                      3⤵
                                                                                                                                                                      • Checks whether UAC is enabled
                                                                                                                                                                      • Checks processor information in registry
                                                                                                                                                                      PID:4048
                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:1932
                                                                                                                                                                    • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                                                                                      "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                                                                                      2⤵
                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                      PID:2964
                                                                                                                                                                      • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                                                                                        "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                                                                                        3⤵
                                                                                                                                                                        • Checks whether UAC is enabled
                                                                                                                                                                        • Checks processor information in registry
                                                                                                                                                                        PID:1380
                                                                                                                                                                        • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                          C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                          4⤵
                                                                                                                                                                          • Modifies firewall policy service
                                                                                                                                                                          • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                                                          • Checks BIOS information in registry
                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                          • Enumerates system info in registry
                                                                                                                                                                          • Modifies Internet Explorer Protected Mode
                                                                                                                                                                          • Modifies Internet Explorer Protected Mode Banner
                                                                                                                                                                          • Modifies Internet Explorer settings
                                                                                                                                                                          PID:232
                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 232 -s 1148
                                                                                                                                                                            5⤵
                                                                                                                                                                            • Program crash
                                                                                                                                                                            PID:4712
                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:3220
                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1696 -ip 1696
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:1220
                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                                                                                        1⤵
                                                                                                                                                                          PID:4580
                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                                                                                          1⤵
                                                                                                                                                                            PID:1584
                                                                                                                                                                            • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                                                                                              "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                                                                                              2⤵
                                                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:1656
                                                                                                                                                                              • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                                                                                                "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                                                                                                3⤵
                                                                                                                                                                                • Checks whether UAC is enabled
                                                                                                                                                                                • Checks processor information in registry
                                                                                                                                                                                PID:1480
                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                                                                                            1⤵
                                                                                                                                                                              PID:964
                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                                                                                              1⤵
                                                                                                                                                                                PID:2880
                                                                                                                                                                                • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                                                                                                  "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                                                                                                  2⤵
                                                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                                                  PID:4512
                                                                                                                                                                                  • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                                                                                                    "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                                                                                                    3⤵
                                                                                                                                                                                    • Checks whether UAC is enabled
                                                                                                                                                                                    • Checks processor information in registry
                                                                                                                                                                                    PID:1724
                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                                                                                                1⤵
                                                                                                                                                                                  PID:3996
                                                                                                                                                                                  • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                                                                                                    "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    PID:1924
                                                                                                                                                                                    • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                                                                                                      "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                                                                                                      3⤵
                                                                                                                                                                                      • Checks whether UAC is enabled
                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                      PID:1756
                                                                                                                                                                                      • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                        C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                        4⤵
                                                                                                                                                                                        • Modifies firewall policy service
                                                                                                                                                                                        • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                                                                        • Checks BIOS information in registry
                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        • Checks processor information in registry
                                                                                                                                                                                        • Enumerates system info in registry
                                                                                                                                                                                        • Modifies Internet Explorer Protected Mode
                                                                                                                                                                                        • Modifies Internet Explorer Protected Mode Banner
                                                                                                                                                                                        • Modifies Internet Explorer settings
                                                                                                                                                                                        PID:940
                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 940 -s 1132
                                                                                                                                                                                          5⤵
                                                                                                                                                                                          • Program crash
                                                                                                                                                                                          PID:2092
                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                                                                                                  1⤵
                                                                                                                                                                                    PID:4952
                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 232 -ip 232
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:4180
                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                                                                                                      1⤵
                                                                                                                                                                                        PID:3448
                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                                                                                                        1⤵
                                                                                                                                                                                          PID:2680
                                                                                                                                                                                          • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                                                                                                            "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                                                                                                            2⤵
                                                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            PID:836
                                                                                                                                                                                            • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                                                                                                              "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                                                                                                              3⤵
                                                                                                                                                                                              • Checks whether UAC is enabled
                                                                                                                                                                                              • Checks processor information in registry
                                                                                                                                                                                              PID:1948
                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                                                                                                          1⤵
                                                                                                                                                                                            PID:4896
                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                                                                                                            1⤵
                                                                                                                                                                                              PID:3304
                                                                                                                                                                                              • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                                                                                                                "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                PID:5024
                                                                                                                                                                                                • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                                                                                                                  "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                  • Checks whether UAC is enabled
                                                                                                                                                                                                  • Checks processor information in registry
                                                                                                                                                                                                  PID:3692
                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                                                                                                              1⤵
                                                                                                                                                                                                PID:1160
                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                  PID:2348
                                                                                                                                                                                                  • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                                                                                                                    "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                                    PID:3156
                                                                                                                                                                                                    • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                                                                                                                      "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                      • Checks whether UAC is enabled
                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                      PID:4156
                                                                                                                                                                                                      • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                        C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                        • Modifies firewall policy service
                                                                                                                                                                                                        • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                                                                                        • Checks BIOS information in registry
                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                        • Checks processor information in registry
                                                                                                                                                                                                        • Enumerates system info in registry
                                                                                                                                                                                                        • Modifies Internet Explorer Protected Mode
                                                                                                                                                                                                        • Modifies Internet Explorer Protected Mode Banner
                                                                                                                                                                                                        • Modifies Internet Explorer settings
                                                                                                                                                                                                        PID:1516
                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 1112
                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                          PID:4372
                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 940 -ip 940
                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                    PID:3512
                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                      PID:316
                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                        PID:3220
                                                                                                                                                                                                        • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                                                                                                                          "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                          PID:4524
                                                                                                                                                                                                          • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                                                                                                                            "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                            • Checks whether UAC is enabled
                                                                                                                                                                                                            • Checks processor information in registry
                                                                                                                                                                                                            PID:5064
                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                          PID:4228
                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                            PID:1660
                                                                                                                                                                                                            • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                                                                                                                              "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                              PID:4520
                                                                                                                                                                                                              • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                                                                                                                                "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                • Checks whether UAC is enabled
                                                                                                                                                                                                                • Checks processor information in registry
                                                                                                                                                                                                                PID:4516
                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                              PID:2936
                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                PID:4236
                                                                                                                                                                                                                • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                                                                                                                                  "C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe"
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                  PID:4368
                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1516 -ip 1516
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                  PID:544

                                                                                                                                                                                                                Network

                                                                                                                                                                                                                MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                Reconnaissance

                                                                                                                                                                                                                Resource Development

                                                                                                                                                                                                                Initial Access

                                                                                                                                                                                                                Execution

                                                                                                                                                                                                                Persistence

                                                                                                                                                                                                                Boot or Logon Autostart Execution

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1547

                                                                                                                                                                                                                Registry Run Keys / Startup Folder

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1547.001

                                                                                                                                                                                                                Create or Modify System Process

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1543

                                                                                                                                                                                                                Windows Service

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1543.003

                                                                                                                                                                                                                Event Triggered Execution

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1546

                                                                                                                                                                                                                Image File Execution Options Injection

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1546.012

                                                                                                                                                                                                                Privilege Escalation

                                                                                                                                                                                                                Boot or Logon Autostart Execution

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1547

                                                                                                                                                                                                                Registry Run Keys / Startup Folder

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1547.001

                                                                                                                                                                                                                Create or Modify System Process

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1543

                                                                                                                                                                                                                Windows Service

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1543.003

                                                                                                                                                                                                                Event Triggered Execution

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1546

                                                                                                                                                                                                                Image File Execution Options Injection

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1546.012

                                                                                                                                                                                                                Defense Evasion

                                                                                                                                                                                                                Impair Defenses

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1562

                                                                                                                                                                                                                Disable or Modify System Firewall

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1562.004

                                                                                                                                                                                                                Indicator Removal

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1070

                                                                                                                                                                                                                Clear Persistence

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1070.009

                                                                                                                                                                                                                Modify Registry

                                                                                                                                                                                                                5
                                                                                                                                                                                                                T1112

                                                                                                                                                                                                                Credential Access

                                                                                                                                                                                                                Discovery

                                                                                                                                                                                                                Query Registry

                                                                                                                                                                                                                3
                                                                                                                                                                                                                T1012

                                                                                                                                                                                                                System Information Discovery

                                                                                                                                                                                                                4
                                                                                                                                                                                                                T1082

                                                                                                                                                                                                                System Location Discovery

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1614

                                                                                                                                                                                                                System Language Discovery

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1614.001

                                                                                                                                                                                                                Lateral Movement

                                                                                                                                                                                                                Collection

                                                                                                                                                                                                                Command and Control

                                                                                                                                                                                                                Exfiltration

                                                                                                                                                                                                                Impact

                                                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                                                Downloads

                                                                                                                                                                                                                • C:\ProgramData\Google Updater 2.0\3755q5i19mc.exe
                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  662KB

                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                  0760d43d4adebe20fa0b5e5a7bca1714

                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                  a0a9dae5e9be39bca31021dd9cf565fcdefb8474

                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                  8f9067f2bd4a374539a40fddb8915600c9fd6ba3e5db20cbddcb3c5f22d9da44

                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                  7e60c2726711bb8e822375f93cfb9ced7d172f3f0ae07041cbeea8c4cdb45488d1de90ee77dfef52aa86722a5dcbe521d1affeace3aec8811e851f693d74ef77

                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                • memory/368-50-0x0000000000800000-0x0000000000866000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  408KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/1700-1-0x0000000000455000-0x000000000045C000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  28KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/1700-2-0x0000000000400000-0x00000000004AC000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  688KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/1700-0-0x0000000002330000-0x0000000002331000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/1988-66-0x0000000000680000-0x00000000006E6000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  408KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/2040-31-0x0000000000400000-0x00000000004AC000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  688KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/2144-52-0x00000000008A0000-0x0000000000CD4000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  4.2MB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/2144-53-0x00000000008A0000-0x0000000000CD4000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  4.2MB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/2144-54-0x0000000001000000-0x000000000110F000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  1.1MB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/2144-81-0x00000000008A0000-0x0000000000CD3000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  4.2MB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/2612-73-0x0000000002140000-0x00000000021A6000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  408KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/2952-18-0x0000000000440000-0x0000000000509000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  804KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/2952-21-0x0000000002810000-0x0000000002811000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/2952-20-0x0000000074920000-0x00000000749F4000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  848KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/2952-10-0x00000000022C0000-0x0000000002326000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  408KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/2952-9-0x0000000000400000-0x0000000000435000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  212KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/2952-5-0x0000000000400000-0x0000000000435000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  212KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/2952-3-0x0000000000400000-0x0000000000435000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  212KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/2952-6-0x0000000000400000-0x0000000000435000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  212KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/3220-72-0x0000000000400000-0x00000000004AC000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  688KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/3344-12-0x00000000008A0000-0x0000000000CD4000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  4.2MB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/3344-17-0x00000000008A0000-0x0000000000CD3000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  4.2MB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/3344-15-0x00000000006F0000-0x00000000007FF000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  1.1MB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/3344-14-0x00000000008A0000-0x0000000000CD4000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  4.2MB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/3672-36-0x0000000002190000-0x00000000021F6000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  408KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/4100-65-0x0000000000400000-0x00000000004AC000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  688KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/4468-39-0x0000000000400000-0x0000000000435000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  212KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/4468-33-0x00000000004D0000-0x0000000000536000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  408KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/4468-27-0x0000000000400000-0x0000000000435000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  212KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/4816-47-0x0000000000400000-0x00000000004AC000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  688KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/4844-28-0x0000000000400000-0x00000000004AC000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  688KB

                                                                                                                                                                                                                  Download