Analysis
- max time kernel
156s - max time network
168s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
26/03/2022, 16:10
Static task
static1
Behavioral task
behavioral1
Sample
bf5583a1b318ba14bae72e9fa7bb8a6a.exe
Resource
win7-20220311-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
bf5583a1b318ba14bae72e9fa7bb8a6a.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
- Target bf5583a1b318ba14bae72e9fa7bb8a6a.exe
- Size 223KB
- Sample220326-tmf35sbbfn
- SHA256 a37cbddb545f168aa1dbb09433e228e5a956f6d8fbc00fae892a5f047990a71f
- MD5 bf5583a1b318ba14bae72e9fa7bb8a6a
- SHA1 4cc2567863cb1f440cffe323fe85aedc1250ba61
- SHA512 592d84e4631fbff7b699f24119cda4c2c11d5dd8379c4dd2109d859b0c73e4e0db93ecd36098ff27a3ab3087e638d5883cc99b1b4c43376adc9bd1ffa4ec2248
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://coralee.at/upload/
-
http://ducvietcao.com/upload/
-
http://biz-acc.ru/upload/
-
http://toimap.com/upload/
-
http://bbb7d.com/upload/
-
http://piratia-life.ru/upload/
-
http://curvreport.com/upload/
-
http://viagratos.com/upload/
-
http://mordo.ru/upload/
-
http://pkodev.net/upload/
rc4.i32
rc4.i32
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- suricata: ET MALWARE Danabot Key Exchange Request
suricata: ET MALWARE Danabot Key Exchange Request
- Blocklisted process makes network request 2 IoCs
flow pid Process 53 1492 rundll32.exe 76 4780 rundll32.exe - Downloads MZ/PE file
- Executes dropped EXE 1 IoCs
pid Process 4168 F7DA.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4168 set thread context of 4780 4168 F7DA.exe 103 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 5 IoCs
pid pid_target Process procid_target 696 4168 WerFault.exe 90 4016 4168 WerFault.exe 90 3140 4168 WerFault.exe 90 1484 4168 WerFault.exe 90 4660 4168 WerFault.exe 90 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bf5583a1b318ba14bae72e9fa7bb8a6a.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bf5583a1b318ba14bae72e9fa7bb8a6a.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bf5583a1b318ba14bae72e9fa7bb8a6a.exe - Checks processor information in registry 2 TTPs 46 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 F7DA.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision F7DA.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor F7DA.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString F7DA.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status F7DA.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 F7DA.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier F7DA.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1 F7DA.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status F7DA.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 F7DA.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision F7DA.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString F7DA.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision F7DA.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 F7DA.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet F7DA.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet rundll32.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor F7DA.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet F7DA.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier F7DA.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision F7DA.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz F7DA.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 F7DA.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information F7DA.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz F7DA.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data F7DA.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\Toolbar Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" Process not Found Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Process not Found - Modifies registry class 19 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic" Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff Process not Found Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff Process not Found Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 19002f433a5c000000000000000000000000000000000000000000 Process not Found Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags Process not Found Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 Process not Found Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Process not Found Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\NodeSlot = "2" Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = ffffffff Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 Process not Found Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 Process not Found - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2216 Process not Found - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3004 bf5583a1b318ba14bae72e9fa7bb8a6a.exe 3004 bf5583a1b318ba14bae72e9fa7bb8a6a.exe 2216 Process not Found 2216 Process not Found 2216 Process not Found 2216 Process not Found 2216 Process not Found 2216 Process not Found 2216 Process not Found 2216 Process not Found 2216 Process not Found 2216 Process not Found 2216 Process not Found 2216 Process not Found 2216 Process not Found 2216 Process not Found 2216 Process not Found 2216 Process not Found 2216 Process not Found 2216 Process not Found 2216 Process not Found 2216 Process not Found 2216 Process not Found 2216 Process not Found 2216 Process not Found 2216 Process not Found 2216 Process not Found 2216 Process not Found 2216 Process not Found 2216 Process not Found 2216 Process not Found 2216 Process not Found 2216 Process not Found 2216 Process not Found 2216 Process not Found 2216 Process not Found 2216 Process not Found 2216 Process not Found 2216 Process not Found 2216 Process not Found 2216 Process not Found 2216 Process not Found 2216 Process not Found 2216 Process not Found 2216 Process not Found 2216 Process not Found 2216 Process not Found 2216 Process not Found 2216 Process not Found 2216 Process not Found 2216 Process not Found 2216 Process not Found 2216 Process not Found 2216 Process not Found 2216 Process not Found 2216 Process not Found 2216 Process not Found 2216 Process not Found 2216 Process not Found 2216 Process not Found 2216 Process not Found 2216 Process not Found 2216 Process not Found 2216 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2216 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 3004 bf5583a1b318ba14bae72e9fa7bb8a6a.exe - Suspicious use of AdjustPrivilegeToken 32 IoCs
description pid Process Token: SeShutdownPrivilege 2216 Process not Found Token: SeCreatePagefilePrivilege 2216 Process not Found Token: SeShutdownPrivilege 2216 Process not Found Token: SeCreatePagefilePrivilege 2216 Process not Found Token: SeShutdownPrivilege 2216 Process not Found Token: SeCreatePagefilePrivilege 2216 Process not Found Token: SeShutdownPrivilege 2216 Process not Found Token: SeCreatePagefilePrivilege 2216 Process not Found Token: SeShutdownPrivilege 2216 Process not Found Token: SeCreatePagefilePrivilege 2216 Process not Found Token: SeShutdownPrivilege 2216 Process not Found Token: SeCreatePagefilePrivilege 2216 Process not Found Token: SeShutdownPrivilege 2216 Process not Found Token: SeCreatePagefilePrivilege 2216 Process not Found Token: SeShutdownPrivilege 2216 Process not Found Token: SeCreatePagefilePrivilege 2216 Process not Found Token: SeShutdownPrivilege 2216 Process not Found Token: SeCreatePagefilePrivilege 2216 Process not Found Token: SeShutdownPrivilege 2216 Process not Found Token: SeCreatePagefilePrivilege 2216 Process not Found Token: SeShutdownPrivilege 2216 Process not Found Token: SeCreatePagefilePrivilege 2216 Process not Found Token: SeShutdownPrivilege 2216 Process not Found Token: SeCreatePagefilePrivilege 2216 Process not Found Token: SeShutdownPrivilege 2216 Process not Found Token: SeCreatePagefilePrivilege 2216 Process not Found Token: SeShutdownPrivilege 2216 Process not Found Token: SeCreatePagefilePrivilege 2216 Process not Found Token: SeShutdownPrivilege 2216 Process not Found Token: SeCreatePagefilePrivilege 2216 Process not Found Token: SeShutdownPrivilege 2216 Process not Found Token: SeCreatePagefilePrivilege 2216 Process not Found - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4780 rundll32.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2216 Process not Found 2216 Process not Found - Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 2216 wrote to memory of 4168 2216 Process not Found 90 PID 2216 wrote to memory of 4168 2216 Process not Found 90 PID 2216 wrote to memory of 4168 2216 Process not Found 90 PID 4168 wrote to memory of 1492 4168 F7DA.exe 92 PID 4168 wrote to memory of 1492 4168 F7DA.exe 92 PID 4168 wrote to memory of 1492 4168 F7DA.exe 92 PID 4168 wrote to memory of 1492 4168 F7DA.exe 92 PID 4168 wrote to memory of 1492 4168 F7DA.exe 92 PID 4168 wrote to memory of 1492 4168 F7DA.exe 92 PID 4168 wrote to memory of 1492 4168 F7DA.exe 92 PID 4168 wrote to memory of 1492 4168 F7DA.exe 92 PID 4168 wrote to memory of 1492 4168 F7DA.exe 92 PID 4168 wrote to memory of 1492 4168 F7DA.exe 92 PID 4168 wrote to memory of 1492 4168 F7DA.exe 92 PID 4168 wrote to memory of 1492 4168 F7DA.exe 92 PID 4168 wrote to memory of 1492 4168 F7DA.exe 92 PID 4168 wrote to memory of 1492 4168 F7DA.exe 92 PID 4168 wrote to memory of 1492 4168 F7DA.exe 92 PID 4168 wrote to memory of 1492 4168 F7DA.exe 92 PID 4168 wrote to memory of 1492 4168 F7DA.exe 92 PID 4168 wrote to memory of 1492 4168 F7DA.exe 92 PID 4168 wrote to memory of 1492 4168 F7DA.exe 92 PID 4168 wrote to memory of 4780 4168 F7DA.exe 103 PID 4168 wrote to memory of 4780 4168 F7DA.exe 103 PID 4168 wrote to memory of 4780 4168 F7DA.exe 103 PID 4168 wrote to memory of 4780 4168 F7DA.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\bf5583a1b318ba14bae72e9fa7bb8a6a.exe"C:\Users\Admin\AppData\Local\Temp\bf5583a1b318ba14bae72e9fa7bb8a6a.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3004
-
C:\Users\Admin\AppData\Local\Temp\F7DA.exeC:\Users\Admin\AppData\Local\Temp\F7DA.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#612⤵
- Blocklisted process makes network request
PID:1492
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4168 -s 6122⤵
- Program crash
PID:696
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4168 -s 8802⤵
- Program crash
PID:4016
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4168 -s 9402⤵
- Program crash
PID:3140
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4168 -s 9002⤵
- Program crash
PID:1484
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4168 -s 9042⤵
- Program crash
PID:4660
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#612⤵
- Blocklisted process makes network request
- Checks processor information in registry
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:4780
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4168 -ip 41681⤵PID:1752
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4168 -ip 41681⤵PID:212
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4168 -ip 41681⤵PID:4428
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4168 -ip 41681⤵PID:3644
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4168 -ip 41681⤵PID:4516