smokeloader | ee4a5edf71fdd7e60e4fc6bc05bcadb0ab766c9b7b514804afac9deb5ebed9c3

Analysis

max time kernel
59s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27/10/2022, 15:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b15f6a5eecb7b2d94fa5880f72f9f625.exe
Size 259KB
Sample221027-tag5nscfc5
SHA256 ee4a5edf71fdd7e60e4fc6bc05bcadb0ab766c9b7b514804afac9deb5ebed9c3
MD5 b15f6a5eecb7b2d94fa5880f72f9f625
SHA1 1add1a0163c61d5b32969edc899e6799f78e85f8
SHA512 b8aee7b297499910701155f7b959c6fa36eeabffefd8ef243bca0fbfde99dff653176b45337a1e4050da298e51c67dc6287ebeae38c6007d6fa84b54e6339cbd
SSDEEP 3072:SXKjOcb00D0BTKXvh45z8KxfTe+mEewEYx3Fyb34k8i7irn+6cp40Ko:SzsRuTKXv4bqE1ssiWSe0T
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

smokeloader backdoor trojan

Malware Config

Signatures

Detects Smokeloader packer 1 IoCs

resource	yara_rule
behavioral2/memory/3960-133-0x0000000002CC0000-0x0000000002CC9000-memory.dmp	family_smokeloader

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Blocklisted process makes network request 1 IoCs

flow	pid	Process
53	64	rundll32.exe

Downloads MZ/PE file

Executes dropped EXE 4 IoCs

pid	Process
4580	F002.exe
4320	F002.exe
4708	F002.exe
1476	F002.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	F002.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	F002.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	F002.exe

Loads dropped DLL 3 IoCs

pid	Process
64	rundll32.exe
3548	rundll32.exe
3548	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 64 IoCs

pid	pid_target	Process	procid_target
208	4580	WerFault.exe	89
3712	4580	WerFault.exe	89
3456	4580	WerFault.exe	89
3440	4580	WerFault.exe	89
4516	4580	WerFault.exe	89
2040	4580	WerFault.exe	89
4608	4580	WerFault.exe	89
1284	4580	WerFault.exe	89
3128	4320	WerFault.exe	105
4492	4320	WerFault.exe	105
4700	4320	WerFault.exe	105
2992	4320	WerFault.exe	105
2144	4320	WerFault.exe	105
1680	4320	WerFault.exe	105
552	4320	WerFault.exe	105
1876	4320	WerFault.exe	105
2848	4708	WerFault.exe	122
2184	4708	WerFault.exe	122
2352	4708	WerFault.exe	122
2308	4708	WerFault.exe	122
2028	4580	WerFault.exe	89
3572	4708	WerFault.exe	122
2392	4708	WerFault.exe	122
1856	4708	WerFault.exe	122
4132	4708	WerFault.exe	122
4824	4708	WerFault.exe	122
972	4708	WerFault.exe	122
4164	1476	WerFault.exe	146
3440	4320	WerFault.exe	105
4104	1476	WerFault.exe	146
2428	1476	WerFault.exe	146
1928	1476	WerFault.exe	146
3472	1476	WerFault.exe	146
3272	1476	WerFault.exe	146
2520	1476	WerFault.exe	146
4812	1476	WerFault.exe	146
4308	1476	WerFault.exe	146
2248	1476	WerFault.exe	146
2352	2272	WerFault.exe	172
4180	2272	WerFault.exe	172
4500	2272	WerFault.exe	172
3640	2272	WerFault.exe	172
1880	2272	WerFault.exe	172
3532	2272	WerFault.exe	172
532	2272	WerFault.exe	172
2232	2272	WerFault.exe	172
4072	2272	WerFault.exe	172
4236	1732	WerFault.exe	192
4028	1732	WerFault.exe	192
1524	1732	WerFault.exe	192
4652	1732	WerFault.exe	192
4256	1732	WerFault.exe	192
3972	1732	WerFault.exe	192
3540	1732	WerFault.exe	192
1608	1732	WerFault.exe	192
1988	1732	WerFault.exe	192
3208	1732	WerFault.exe	192
2364	4248	WerFault.exe	220
3520	4248	WerFault.exe	220
5056	4248	WerFault.exe	220
4416	4248	WerFault.exe	220
4088	4248	WerFault.exe	220
1628	4248	WerFault.exe	220
712	4248	WerFault.exe	220

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	b15f6a5eecb7b2d94fa5880f72f9f625.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	b15f6a5eecb7b2d94fa5880f72f9f625.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	b15f6a5eecb7b2d94fa5880f72f9f625.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3960	b15f6a5eecb7b2d94fa5880f72f9f625.exe
3960	b15f6a5eecb7b2d94fa5880f72f9f625.exe
1272	Process not Found
1272	Process not Found
1272	Process not Found
1272	Process not Found
1272	Process not Found
1272	Process not Found
1272	Process not Found
1272	Process not Found
1272	Process not Found
1272	Process not Found
1272	Process not Found
1272	Process not Found
1272	Process not Found
1272	Process not Found
1272	Process not Found
1272	Process not Found
1272	Process not Found
1272	Process not Found
1272	Process not Found
1272	Process not Found
1272	Process not Found
1272	Process not Found
1272	Process not Found
1272	Process not Found
1272	Process not Found
1272	Process not Found
1272	Process not Found
1272	Process not Found
1272	Process not Found
1272	Process not Found
1272	Process not Found
1272	Process not Found
1272	Process not Found
1272	Process not Found
1272	Process not Found
1272	Process not Found
1272	Process not Found
1272	Process not Found
1272	Process not Found
1272	Process not Found
1272	Process not Found
1272	Process not Found
1272	Process not Found
1272	Process not Found
1272	Process not Found
1272	Process not Found
1272	Process not Found
1272	Process not Found
1272	Process not Found
1272	Process not Found
1272	Process not Found
1272	Process not Found
1272	Process not Found
1272	Process not Found
1272	Process not Found
1272	Process not Found
1272	Process not Found
1272	Process not Found
1272	Process not Found
1272	Process not Found
1272	Process not Found
1272	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3960	b15f6a5eecb7b2d94fa5880f72f9f625.exe

Suspicious use of AdjustPrivilegeToken 52 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1272	Process not Found
Token: SeCreatePagefilePrivilege	1272	Process not Found
Token: SeShutdownPrivilege	1272	Process not Found
Token: SeCreatePagefilePrivilege	1272	Process not Found
Token: SeShutdownPrivilege	1272	Process not Found
Token: SeCreatePagefilePrivilege	1272	Process not Found
Token: SeShutdownPrivilege	1272	Process not Found
Token: SeCreatePagefilePrivilege	1272	Process not Found
Token: SeShutdownPrivilege	1272	Process not Found
Token: SeCreatePagefilePrivilege	1272	Process not Found
Token: SeShutdownPrivilege	1272	Process not Found
Token: SeCreatePagefilePrivilege	1272	Process not Found
Token: SeShutdownPrivilege	1272	Process not Found
Token: SeCreatePagefilePrivilege	1272	Process not Found
Token: SeShutdownPrivilege	1272	Process not Found
Token: SeCreatePagefilePrivilege	1272	Process not Found
Token: SeShutdownPrivilege	1272	Process not Found
Token: SeCreatePagefilePrivilege	1272	Process not Found
Token: SeShutdownPrivilege	1272	Process not Found
Token: SeCreatePagefilePrivilege	1272	Process not Found
Token: SeShutdownPrivilege	1272	Process not Found
Token: SeCreatePagefilePrivilege	1272	Process not Found
Token: SeShutdownPrivilege	1272	Process not Found
Token: SeCreatePagefilePrivilege	1272	Process not Found
Token: SeShutdownPrivilege	1272	Process not Found
Token: SeCreatePagefilePrivilege	1272	Process not Found
Token: SeShutdownPrivilege	1272	Process not Found
Token: SeCreatePagefilePrivilege	1272	Process not Found
Token: SeShutdownPrivilege	1272	Process not Found
Token: SeCreatePagefilePrivilege	1272	Process not Found
Token: SeShutdownPrivilege	1272	Process not Found
Token: SeCreatePagefilePrivilege	1272	Process not Found
Token: SeShutdownPrivilege	1272	Process not Found
Token: SeCreatePagefilePrivilege	1272	Process not Found
Token: SeShutdownPrivilege	1272	Process not Found
Token: SeCreatePagefilePrivilege	1272	Process not Found
Token: SeShutdownPrivilege	1272	Process not Found
Token: SeCreatePagefilePrivilege	1272	Process not Found
Token: SeShutdownPrivilege	1272	Process not Found
Token: SeCreatePagefilePrivilege	1272	Process not Found
Token: SeShutdownPrivilege	1272	Process not Found
Token: SeCreatePagefilePrivilege	1272	Process not Found
Token: SeShutdownPrivilege	1272	Process not Found
Token: SeCreatePagefilePrivilege	1272	Process not Found
Token: SeShutdownPrivilege	1272	Process not Found
Token: SeCreatePagefilePrivilege	1272	Process not Found
Token: SeShutdownPrivilege	1272	Process not Found
Token: SeCreatePagefilePrivilege	1272	Process not Found
Token: SeShutdownPrivilege	1272	Process not Found
Token: SeCreatePagefilePrivilege	1272	Process not Found
Token: SeShutdownPrivilege	1272	Process not Found
Token: SeCreatePagefilePrivilege	1272	Process not Found

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1272 wrote to memory of 4580	1272	Process not Found	89
PID 1272 wrote to memory of 4580	1272	Process not Found	89
PID 1272 wrote to memory of 4580	1272	Process not Found	89
PID 4580 wrote to memory of 4320	4580	F002.exe	105
PID 4580 wrote to memory of 4320	4580	F002.exe	105
PID 4580 wrote to memory of 4320	4580	F002.exe	105
PID 4320 wrote to memory of 4708	4320	F002.exe	122
PID 4320 wrote to memory of 4708	4320	F002.exe	122
PID 4320 wrote to memory of 4708	4320	F002.exe	122
PID 4580 wrote to memory of 64	4580	F002.exe	134
PID 4580 wrote to memory of 64	4580	F002.exe	134
PID 4580 wrote to memory of 64	4580	F002.exe	134
PID 4708 wrote to memory of 1476	4708	F002.exe	146
PID 4708 wrote to memory of 1476	4708	F002.exe	146
PID 4708 wrote to memory of 1476	4708	F002.exe	146
PID 4708 wrote to memory of 3548	4708	F002.exe	145
PID 4708 wrote to memory of 3548	4708	F002.exe	145
PID 4708 wrote to memory of 3548	4708	F002.exe	145

C:\Users\Admin\AppData\Local\Temp\b15f6a5eecb7b2d94fa5880f72f9f625.exe
"C:\Users\Admin\AppData\Local\Temp\b15f6a5eecb7b2d94fa5880f72f9f625.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3960

C:\Users\Admin\AppData\Local\Temp\F002.exe
C:\Users\Admin\AppData\Local\Temp\F002.exe
1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4580 -s 628
  2⤵
  - Program crash
  PID:208
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4580 -s 912
  2⤵
  - Program crash
  PID:3712
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4580 -s 980
  2⤵
  - Program crash
  PID:3456
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4580 -s 988
  2⤵
  - Program crash
  PID:3440
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4580 -s 952
  2⤵
  - Program crash
  PID:4516
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4580 -s 1140
  2⤵
  - Program crash
  PID:2040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4580 -s 1156
  2⤵
  - Program crash
  PID:4608
- C:\Users\Admin\AppData\Local\Temp\F002.exe
  "C:\Users\Admin\AppData\Local\Temp\F002.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4320
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4320 -s 604
    3⤵
    - Program crash
    PID:3128
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4320 -s 996
    3⤵
    - Program crash
    PID:4492
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4320 -s 1004
    3⤵
    - Program crash
    PID:4700
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4320 -s 1092
    3⤵
    - Program crash
    PID:2992
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4320 -s 1068
    3⤵
    - Program crash
    PID:2144
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4320 -s 1116
    3⤵
    - Program crash
    PID:1680
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4320 -s 1124
    3⤵
    - Program crash
    PID:552
- - C:\Users\Admin\AppData\Local\Temp\F002.exe
    "C:\Users\Admin\AppData\Local\Temp\F002.exe"
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:4708
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 600
      4⤵
      Program crash
      PID:2848
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 1000
      4⤵
      Program crash
      PID:2184
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 1088
      4⤵
      Program crash
      PID:2352
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 1088
      4⤵
      Program crash
      PID:2308
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 1140
      4⤵
      Program crash
      PID:3572
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 1148
      4⤵
      Program crash
      PID:2392
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 1156
      4⤵
      Program crash
      PID:1856
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 1128
      4⤵
      Program crash
      PID:4132
  - - C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll,start
      4⤵
      Loads dropped DLL
      PID:3548
  - - C:\Users\Admin\AppData\Local\Temp\F002.exe
      "C:\Users\Admin\AppData\Local\Temp\F002.exe"
      4⤵
      Executes dropped EXE
      PID:1476
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1476 -s 604
        5⤵
        Program crash
        
        PID:4164
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1476 -s 996
        5⤵
        Program crash
        
        PID:4104
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1476 -s 1000
        5⤵
        Program crash
        
        PID:2428
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1476 -s 996
        5⤵
        Program crash
        
        PID:1928
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1476 -s 1092
        5⤵
        Program crash
        
        PID:3472
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1476 -s 1120
        5⤵
        Program crash
        
        PID:3272
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1476 -s 1140
        5⤵
        Program crash
        
        PID:2520
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1476 -s 1148
        5⤵
        Program crash
        
        PID:4812
    - - C:\Windows\SysWOW64\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll,start
        5⤵
        
        PID:4856
      - C:\Windows\system32\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 14029
        6⤵
        
        PID:3684
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
        6⤵
        
        PID:3608
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
        6⤵
        
        PID:3792
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1476 -s 984
        5⤵
        Program crash
        
        PID:4308
    - - C:\Users\Admin\AppData\Local\Temp\F002.exe
        
        "C:\Users\Admin\AppData\Local\Temp\F002.exe"
        5⤵
        
        PID:2272
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 600
        6⤵
        Program crash
        
        PID:2352
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 996
        6⤵
        Program crash
        
        PID:4180
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 1004
        6⤵
        Program crash
        
        PID:4500
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 1004
        6⤵
        Program crash
        
        PID:3640
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 1088
        6⤵
        Program crash
        
        PID:1880
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 1072
        6⤵
        Program crash
        
        PID:3532
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 1060
        6⤵
        Program crash
        
        PID:532
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 984
        6⤵
        Program crash
        
        PID:2232
      - C:\Windows\SysWOW64\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll,start
        6⤵
        
        PID:4892
      - C:\Users\Admin\AppData\Local\Temp\F002.exe
        
        "C:\Users\Admin\AppData\Local\Temp\F002.exe"
        6⤵
        
        PID:1732
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 600
        7⤵
        Program crash
        
        PID:4236
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 996
        7⤵
        Program crash
        
        PID:4028
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 1000
        7⤵
        Program crash
        
        PID:1524
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 1096
        7⤵
        Program crash
        
        PID:4652
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 1120
        7⤵
        Program crash
        
        PID:4256
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 1096
        7⤵
        Program crash
        
        PID:3972
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 1008
        7⤵
        Program crash
        
        PID:3540
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 1124
        7⤵
        Program crash
        
        PID:1608
        
        C:\Windows\SysWOW64\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll,start
        7⤵
        
        PID:1900
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 984
        7⤵
        Program crash
        
        PID:1988
        
        C:\Users\Admin\AppData\Local\Temp\F002.exe
        
        "C:\Users\Admin\AppData\Local\Temp\F002.exe"
        7⤵
        
        PID:4248
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4248 -s 600
        8⤵
        Program crash
        
        PID:2364
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4248 -s 908
        8⤵
        Program crash
        
        PID:3520
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4248 -s 1008
        8⤵
        Program crash
        
        PID:5056
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4248 -s 1016
        8⤵
        Program crash
        
        PID:4416
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4248 -s 1092
        8⤵
        Program crash
        
        PID:4088
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4248 -s 1088
        8⤵
        Program crash
        
        PID:1628
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4248 -s 1128
        8⤵
        Program crash
        
        PID:712
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4248 -s 996
        8⤵
        
        PID:4356
        
        C:\Windows\SysWOW64\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll,start
        8⤵
        
        PID:3920
        
        C:\Users\Admin\AppData\Local\Temp\F002.exe
        
        "C:\Users\Admin\AppData\Local\Temp\F002.exe"
        8⤵
        
        PID:1612
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 604
        9⤵
        
        PID:3988
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 900
        9⤵
        
        PID:3864
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 992
        9⤵
        
        PID:4444
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 1000
        9⤵
        
        PID:4308
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 1092
        9⤵
        
        PID:2140
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 1092
        9⤵
        
        PID:1020
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 1076
        9⤵
        
        PID:2324
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 1016
        9⤵
        
        PID:3540
        
        C:\Windows\SysWOW64\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll,start
        9⤵
        
        PID:4372
        
        C:\Users\Admin\AppData\Local\Temp\F002.exe
        
        "C:\Users\Admin\AppData\Local\Temp\F002.exe"
        9⤵
        
        PID:4008
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 600
        10⤵
        
        PID:2512
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 948
        10⤵
        
        PID:4564
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 952
        10⤵
        
        PID:1132
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 1076
        10⤵
        
        PID:1464
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 1100
        10⤵
        
        PID:3584
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 1136
        10⤵
        
        PID:1428
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 1108
        10⤵
        
        PID:2272
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 1132
        10⤵
        
        PID:4340
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 1004
        10⤵
        
        PID:2148
        
        C:\Windows\SysWOW64\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll,start
        10⤵
        
        PID:1624
        
        C:\Users\Admin\AppData\Local\Temp\F002.exe
        
        "C:\Users\Admin\AppData\Local\Temp\F002.exe"
        10⤵
        
        PID:3180
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 600
        11⤵
        
        PID:396
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 876
        11⤵
        
        PID:3728
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 1004
        11⤵
        
        PID:4652
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 1004
        11⤵
        
        PID:1268
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 1064
        11⤵
        
        PID:2140
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 1112
        11⤵
        
        PID:1280
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 1148
        11⤵
        
        PID:4136
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 992
        11⤵
        
        PID:1608
        
        C:\Windows\SysWOW64\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll,start
        11⤵
        
        PID:4180
        
        C:\Users\Admin\AppData\Local\Temp\F002.exe
        
        "C:\Users\Admin\AppData\Local\Temp\F002.exe"
        11⤵
        
        PID:920
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 920 -s 536
        12⤵
        
        PID:4716
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 920 -s 896
        12⤵
        
        PID:1416
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 920 -s 1012
        12⤵
        
        PID:2760
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 920 -s 1076
        12⤵
        
        PID:4364
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 920 -s 992
        12⤵
        
        PID:4916
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 920 -s 992
        12⤵
        
        PID:4084
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 920 -s 1016
        12⤵
        
        PID:5092
        
        C:\Windows\SysWOW64\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll,start
        12⤵
        
        PID:4504
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 920 -s 1000
        12⤵
        
        PID:1540
        
        C:\Users\Admin\AppData\Local\Temp\F002.exe
        
        "C:\Users\Admin\AppData\Local\Temp\F002.exe"
        12⤵
        
        PID:3028
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 604
        13⤵
        
        PID:3988
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 896
        13⤵
        
        PID:3940
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 896
        13⤵
        
        PID:3732
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 1076
        13⤵
        
        PID:1888
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 1084
        13⤵
        
        PID:3972
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 1084
        13⤵
        
        PID:1724
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 956
        13⤵
        
        PID:2656
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 1016
        13⤵
        
        PID:3712
        
        C:\Windows\SysWOW64\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll,start
        13⤵
        
        PID:1608
        
        C:\Users\Admin\AppData\Local\Temp\F002.exe
        
        "C:\Users\Admin\AppData\Local\Temp\F002.exe"
        13⤵
        
        PID:3640
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3640 -s 536
        14⤵
        
        PID:4716
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3640 -s 996
        14⤵
        
        PID:1416
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3640 -s 1088
        14⤵
        
        PID:1696
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3640 -s 1108
        14⤵
        
        PID:5072
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3640 -s 1088
        14⤵
        
        PID:4880
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3640 -s 1012
        14⤵
        
        PID:4928
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3640 -s 1144
        14⤵
        
        PID:2280
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3640 -s 1136
        14⤵
        
        PID:5080
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3640 -s 984
        14⤵
        
        PID:4088
        
        C:\Windows\SysWOW64\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll,start
        14⤵
        
        PID:1880
        
        C:\Users\Admin\AppData\Local\Temp\F002.exe
        
        "C:\Users\Admin\AppData\Local\Temp\F002.exe"
        14⤵
        
        PID:2256
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 536
        15⤵
        
        PID:2060
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 1000
        15⤵
        
        PID:2504
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 1008
        15⤵
        
        PID:4120
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 1076
        15⤵
        
        PID:1020
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 1012
        15⤵
        
        PID:4760
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 1104
        15⤵
        
        PID:1736
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 1120
        15⤵
        
        PID:448
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 988
        15⤵
        
        PID:2352
        
        C:\Windows\SysWOW64\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll,start
        15⤵
        
        PID:3180
        
        C:\Users\Admin\AppData\Local\Temp\F002.exe
        
        "C:\Users\Admin\AppData\Local\Temp\F002.exe"
        15⤵
        
        PID:3440
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3440 -s 536
        16⤵
        
        PID:4072
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3440 -s 908
        16⤵
        
        PID:4472
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3440 -s 968
        16⤵
        
        PID:4880
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3440 -s 980
        16⤵
        
        PID:4092
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3440 -s 1072
        16⤵
        
        PID:2296
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3440 -s 1100
        16⤵
        
        PID:5080
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3440 -s 1104
        16⤵
        
        PID:4512
        
        C:\Windows\SysWOW64\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll,start
        16⤵
        
        PID:2196
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3440 -s 996
        16⤵
        
        PID:3724
        
        C:\Users\Admin\AppData\Local\Temp\F002.exe
        
        "C:\Users\Admin\AppData\Local\Temp\F002.exe"
        16⤵
        
        PID:3128
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3128 -s 536
        17⤵
        
        PID:2892
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3128 -s 896
        17⤵
        
        PID:2592
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3128 -s 1008
        17⤵
        
        PID:1724
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3128 -s 1016
        17⤵
        
        PID:2284
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3128 -s 1004
        17⤵
        
        PID:1776
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3128 -s 1080
        17⤵
        
        PID:4356
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3128 -s 952
        17⤵
        
        PID:4852
        
        C:\Windows\SysWOW64\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll,start
        17⤵
        
        PID:4168
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3128 -s 996
        17⤵
        
        PID:4608
        
        C:\Users\Admin\AppData\Local\Temp\F002.exe
        
        "C:\Users\Admin\AppData\Local\Temp\F002.exe"
        17⤵
        
        PID:4712
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4712 -s 600
        18⤵
        
        PID:624
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4712 -s 896
        18⤵
        
        PID:2120
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4712 -s 1008
        18⤵
        
        PID:1340
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4712 -s 1004
        18⤵
        
        PID:2280
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4712 -s 1092
        18⤵
        
        PID:4008
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4712 -s 1084
        18⤵
        
        PID:4512
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4712 -s 1132
        18⤵
        
        PID:4836
        
        C:\Windows\SysWOW64\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll,start
        18⤵
        
        PID:2620
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4712 -s 996
        18⤵
        
        PID:1956
        
        C:\Users\Admin\AppData\Local\Temp\F002.exe
        
        "C:\Users\Admin\AppData\Local\Temp\F002.exe"
        18⤵
        
        PID:4688
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4712 -s 1088
        18⤵
        
        PID:4700
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3128 -s 1136
        17⤵
        
        PID:644
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3440 -s 1132
        16⤵
        
        PID:3864
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 1172
        15⤵
        
        PID:4564
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3640 -s 1020
        14⤵
        
        PID:816
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 1132
        13⤵
        
        PID:712
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 920 -s 904
        12⤵
        
        PID:1880
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 1152
        11⤵
        
        PID:4984
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 1292
        10⤵
        
        PID:1368
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 992
        9⤵
        
        PID:3680
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4248 -s 1156
        8⤵
        
        PID:1368
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 1204
        7⤵
        Program crash
        
        PID:3208
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 1088
        6⤵
        Program crash
        
        PID:4072
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1476 -s 1184
        5⤵
        Program crash
        
        PID:2248
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 988
      4⤵
      Program crash
      PID:4824
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 1164
      4⤵
      Program crash
      PID:972
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4320 -s 984
    3⤵
    - Program crash
    PID:1876
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll,start
    3⤵
    PID:3808
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4320 -s 1068
    3⤵
    - Program crash
    PID:3440
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4580 -s 1048
  2⤵
  - Program crash
  PID:1284
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll,start
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  PID:64
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4580 -s 920
  2⤵
  - Program crash
  PID:2028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4580 -ip 4580
1⤵
PID:240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4580 -ip 4580
1⤵
PID:404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4580 -ip 4580
1⤵
PID:3872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4580 -ip 4580
1⤵
PID:3972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4580 -ip 4580
1⤵
PID:1156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4580 -ip 4580
1⤵
PID:5044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4580 -ip 4580
1⤵
PID:480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4580 -ip 4580
1⤵
PID:4884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4320 -ip 4320
1⤵
PID:3476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4320 -ip 4320
1⤵
PID:1516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4320 -ip 4320
1⤵
PID:2336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4320 -ip 4320
1⤵
PID:1972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4320 -ip 4320
1⤵
PID:4128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4320 -ip 4320
1⤵
PID:4308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4320 -ip 4320
1⤵
PID:4996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4320 -ip 4320
1⤵
PID:4260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4708 -ip 4708
1⤵
PID:3948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4708 -ip 4708
1⤵
PID:4076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4708 -ip 4708
1⤵
PID:3172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4708 -ip 4708
1⤵
PID:3024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4580 -ip 4580
1⤵
PID:2568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4708 -ip 4708
1⤵
PID:1248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4708 -ip 4708
1⤵
PID:4248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4708 -ip 4708
1⤵
PID:3348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4708 -ip 4708
1⤵
PID:2516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4708 -ip 4708
1⤵
PID:4304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4708 -ip 4708
1⤵
PID:2512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1476 -ip 1476
1⤵
PID:404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4320 -ip 4320
1⤵
PID:3672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1476 -ip 1476
1⤵
PID:1104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1476 -ip 1476
1⤵
PID:2148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 1476 -ip 1476
1⤵
PID:1368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1476 -ip 1476
1⤵
PID:5028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1476 -ip 1476
1⤵
PID:3812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1476 -ip 1476
1⤵
PID:4744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1476 -ip 1476
1⤵
PID:2180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1476 -ip 1476
1⤵
PID:3888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 1476 -ip 1476
1⤵
PID:4996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2272 -ip 2272
1⤵
PID:1480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2272 -ip 2272
1⤵
PID:1724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2272 -ip 2272
1⤵
PID:4888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 2272 -ip 2272
1⤵
PID:1536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2272 -ip 2272
1⤵
PID:2392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 2272 -ip 2272
1⤵
PID:2064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 2272 -ip 2272
1⤵
PID:4312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 2272 -ip 2272
1⤵
PID:4780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 2272 -ip 2272
1⤵
PID:1252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1732 -ip 1732
1⤵
PID:4320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 1732 -ip 1732
1⤵
PID:1928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1732 -ip 1732
1⤵
PID:3272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 1732 -ip 1732
1⤵
PID:3932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 1732 -ip 1732
1⤵
PID:1920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 1732 -ip 1732
1⤵
PID:2140

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 1732 -ip 1732
1⤵
PID:2236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 1732 -ip 1732
1⤵
PID:4800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 1732 -ip 1732
1⤵
PID:3680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 1732 -ip 1732
1⤵
PID:4692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 4248 -ip 4248
1⤵
PID:4312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 4248 -ip 4248
1⤵
PID:3196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 4248 -ip 4248
1⤵
PID:224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4248 -ip 4248
1⤵
PID:1528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 4248 -ip 4248
1⤵
PID:5064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4248 -ip 4248
1⤵
PID:4128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 4248 -ip 4248
1⤵
PID:2120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 4248 -ip 4248
1⤵
PID:3368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 4248 -ip 4248
1⤵
PID:3380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 1612 -ip 1612
1⤵
PID:396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 1612 -ip 1612
1⤵
PID:4744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 1612 -ip 1612
1⤵
PID:1524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 1612 -ip 1612
1⤵
PID:3732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 1612 -ip 1612
1⤵
PID:424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 1612 -ip 1612
1⤵
PID:1492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 1612 -ip 1612
1⤵
PID:2236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 1612 -ip 1612
1⤵
PID:920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 1612 -ip 1612
1⤵
PID:4888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 4008 -ip 4008
1⤵
PID:3208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 4008 -ip 4008
1⤵
PID:4716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 4008 -ip 4008
1⤵
PID:1416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 4008 -ip 4008
1⤵
PID:2844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 4008 -ip 4008
1⤵
PID:3172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 4008 -ip 4008
1⤵
PID:4176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 4008 -ip 4008
1⤵
PID:4880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 4008 -ip 4008
1⤵
PID:1628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 4008 -ip 4008
1⤵
PID:820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 4008 -ip 4008
1⤵
PID:4884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 3180 -ip 3180
1⤵
PID:1928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 3180 -ip 3180
1⤵
PID:4968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 3180 -ip 3180
1⤵
PID:3932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 3180 -ip 3180
1⤵
PID:1872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 3180 -ip 3180
1⤵
PID:2924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 3180 -ip 3180
1⤵
PID:3112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 3180 -ip 3180
1⤵
PID:4684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 3180 -ip 3180
1⤵
PID:3812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 3180 -ip 3180
1⤵
PID:3680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 920 -ip 920
1⤵
PID:4056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 920 -ip 920
1⤵
PID:4168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 920 -ip 920
1⤵
PID:3520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 920 -ip 920
1⤵
PID:5056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 920 -ip 920
1⤵
PID:4416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 920 -ip 920
1⤵
PID:4880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 920 -ip 920
1⤵
PID:4928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 920 -ip 920
1⤵
PID:2296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 920 -ip 920
1⤵
PID:1244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 3028 -ip 3028
1⤵
PID:1592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 3028 -ip 3028
1⤵
PID:3864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 3028 -ip 3028
1⤵
PID:1284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 3028 -ip 3028
1⤵
PID:4308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 3028 -ip 3028
1⤵
PID:932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 3028 -ip 3028
1⤵
PID:1864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 3028 -ip 3028
1⤵
PID:4760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 3028 -ip 3028
1⤵
PID:1736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 3028 -ip 3028
1⤵
PID:3564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 3640 -ip 3640
1⤵
PID:4712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 3640 -ip 3640
1⤵
PID:1684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 3640 -ip 3640
1⤵
PID:4500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 3640 -ip 3640
1⤵
PID:1252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 3640 -ip 3640
1⤵
PID:1428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 3640 -ip 3640
1⤵
PID:3284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 3640 -ip 3640
1⤵
PID:1340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 3640 -ip 3640
1⤵
PID:912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 3640 -ip 3640
1⤵
PID:4000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 3640 -ip 3640
1⤵
PID:4508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2256 -ip 2256
1⤵
PID:480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 2256 -ip 2256
1⤵
PID:2188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 2256 -ip 2256
1⤵
PID:1500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 2256 -ip 2256
1⤵
PID:756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 2256 -ip 2256
1⤵
PID:3024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 2256 -ip 2256
1⤵
PID:2284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 2256 -ip 2256
1⤵
PID:1776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 2256 -ip 2256
1⤵
PID:2168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 2256 -ip 2256
1⤵
PID:4548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 3440 -ip 3440
1⤵
PID:2232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 3440 -ip 3440
1⤵
PID:976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 3440 -ip 3440
1⤵
PID:1128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 3440 -ip 3440
1⤵
PID:1628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 3440 -ip 3440
1⤵
PID:5068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 3440 -ip 3440
1⤵
PID:3700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 3440 -ip 3440
1⤵
PID:4384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3440 -ip 3440
1⤵
PID:396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 3440 -ip 3440
1⤵
PID:4688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3128 -ip 3128
1⤵
PID:3376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 3128 -ip 3128
1⤵
PID:1500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3128 -ip 3128
1⤵
PID:1864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 3128 -ip 3128
1⤵
PID:3540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 3128 -ip 3128
1⤵
PID:3984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 3128 -ip 3128
1⤵
PID:3564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3128 -ip 3128
1⤵
PID:916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3128 -ip 3128
1⤵
PID:3404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3128 -ip 3128
1⤵
PID:1408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4712 -ip 4712
1⤵
PID:1228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4712 -ip 4712
1⤵
PID:1128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 4712 -ip 4712
1⤵
PID:1860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 4712 -ip 4712
1⤵
PID:5040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4712 -ip 4712
1⤵
PID:696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 4712 -ip 4712
1⤵
PID:4808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4712 -ip 4712
1⤵
PID:4796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4712 -ip 4712
1⤵
PID:3932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4712 -ip 4712
1⤵
PID:1368

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0d502779-c529-4ae0-a0cb-e70926e21349.tmp

Path C:\Users\Admin\AppData\Local\Temp\0d502779-c529-4ae0-a0cb-e70926e21349.tmp
Size 22KB
SHA256 d6f11c606729d553e9c9b3d0db9e5d51567ea969bedd98008cce7b9415a17490
MD5 99e972f6d63ded5a9f3d6a06ff481bec
SHA1 b3c98ed6975c649454bce3d88806ad1883e22327
SHA512 ecc322a906b25ea835fdfcb528fb0bc11ade80112b9d0783f0c02100a83368b718c45ca5bdbe38c106e3559db7723dc2fdf38e2bf473fb461ddade999d02f416
SSDEEP 384:kP4jVvuNEsXSOS7H02hXspXoIEoUClPgZXhYmosVgSeZfB8/:Q42Eh97HbchoItUOEYsORBc
MD5 SHA1 SHA512 SSDEEP

Submit Download

514c4da3-c1a5-46c5-8d2b-306ae49d7593.tmp

Path C:\Users\Admin\AppData\Local\Temp\514c4da3-c1a5-46c5-8d2b-306ae49d7593.tmp
Size 25KB
SHA256 d7089602fa181dfd161165dc1bb34271e7481f88ee2ca06230da2a2269a68c80
MD5 9f670566b87be47f09e3871cd67ed6d9
SHA1 8b49dd7fb4bf06df0a16cfc03a42832b78bdfabd
SHA512 6e53a2d3c4329114f7e562d84bcb6345176ce4d7006c9d699d6dab9886d5aa277b5b8fe5cfb9e574a49e0c1de6414efa913cf9b3ffecd95e9fafa28370fc2456
SSDEEP 768:+MXwy+QbM88WQLzOKTTbgba7CKWaMzrFUJS9ABp5:lXU82OydunFwS9ABp5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dydhshsoe.dll

Path C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll
Size 3.2MB
SHA256 b4df09544520fe66b96345a87499483f285db179482625c565699babe1b66fd2
MD5 78e0a585877712609e292ca7b8842bff
SHA1 5ac97374b4e6bf1225cd8fcb3cd4b033a93730c0
SHA512 9c7b55a73706f4e58c4e1e5e27f3194bac1317be3f6229c31b3f336e1c4380a9aa671508ec578d5dbcf46312827af2417a5d63ecfee4ae3e4c1885fc44413778
SSDEEP 49152:0fUHCLZPeghimcFLug6n7c1waTzXs9WbZN6oT3Us:0fUHmvbcFLug6n7c1XXs9WbZN6gU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dydhshsoe.dll

Path C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll
Size 3.2MB
SHA256 b4df09544520fe66b96345a87499483f285db179482625c565699babe1b66fd2
MD5 78e0a585877712609e292ca7b8842bff
SHA1 5ac97374b4e6bf1225cd8fcb3cd4b033a93730c0
SHA512 9c7b55a73706f4e58c4e1e5e27f3194bac1317be3f6229c31b3f336e1c4380a9aa671508ec578d5dbcf46312827af2417a5d63ecfee4ae3e4c1885fc44413778
SSDEEP 49152:0fUHCLZPeghimcFLug6n7c1waTzXs9WbZN6oT3Us:0fUHmvbcFLug6n7c1XXs9WbZN6gU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dydhshsoe.dll

Path C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll
Size 3.2MB
SHA256 b4df09544520fe66b96345a87499483f285db179482625c565699babe1b66fd2
MD5 78e0a585877712609e292ca7b8842bff
SHA1 5ac97374b4e6bf1225cd8fcb3cd4b033a93730c0
SHA512 9c7b55a73706f4e58c4e1e5e27f3194bac1317be3f6229c31b3f336e1c4380a9aa671508ec578d5dbcf46312827af2417a5d63ecfee4ae3e4c1885fc44413778
SSDEEP 49152:0fUHCLZPeghimcFLug6n7c1waTzXs9WbZN6oT3Us:0fUHmvbcFLug6n7c1XXs9WbZN6gU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dydhshsoe.dll

Path C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll
Size 3.2MB
SHA256 b4df09544520fe66b96345a87499483f285db179482625c565699babe1b66fd2
MD5 78e0a585877712609e292ca7b8842bff
SHA1 5ac97374b4e6bf1225cd8fcb3cd4b033a93730c0
SHA512 9c7b55a73706f4e58c4e1e5e27f3194bac1317be3f6229c31b3f336e1c4380a9aa671508ec578d5dbcf46312827af2417a5d63ecfee4ae3e4c1885fc44413778
SSDEEP 49152:0fUHCLZPeghimcFLug6n7c1waTzXs9WbZN6oT3Us:0fUHmvbcFLug6n7c1XXs9WbZN6gU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dydhshsoe.dll

Path C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll
Size 3.2MB
SHA256 b4df09544520fe66b96345a87499483f285db179482625c565699babe1b66fd2
MD5 78e0a585877712609e292ca7b8842bff
SHA1 5ac97374b4e6bf1225cd8fcb3cd4b033a93730c0
SHA512 9c7b55a73706f4e58c4e1e5e27f3194bac1317be3f6229c31b3f336e1c4380a9aa671508ec578d5dbcf46312827af2417a5d63ecfee4ae3e4c1885fc44413778
SSDEEP 49152:0fUHCLZPeghimcFLug6n7c1waTzXs9WbZN6oT3Us:0fUHmvbcFLug6n7c1XXs9WbZN6gU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dydhshsoe.dll

Path C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll
Size 3.2MB
SHA256 b4df09544520fe66b96345a87499483f285db179482625c565699babe1b66fd2
MD5 78e0a585877712609e292ca7b8842bff
SHA1 5ac97374b4e6bf1225cd8fcb3cd4b033a93730c0
SHA512 9c7b55a73706f4e58c4e1e5e27f3194bac1317be3f6229c31b3f336e1c4380a9aa671508ec578d5dbcf46312827af2417a5d63ecfee4ae3e4c1885fc44413778
SSDEEP 49152:0fUHCLZPeghimcFLug6n7c1waTzXs9WbZN6oT3Us:0fUHmvbcFLug6n7c1XXs9WbZN6gU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dydhshsoe.dll

Path C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll
Size 3.2MB
SHA256 b4df09544520fe66b96345a87499483f285db179482625c565699babe1b66fd2
MD5 78e0a585877712609e292ca7b8842bff
SHA1 5ac97374b4e6bf1225cd8fcb3cd4b033a93730c0
SHA512 9c7b55a73706f4e58c4e1e5e27f3194bac1317be3f6229c31b3f336e1c4380a9aa671508ec578d5dbcf46312827af2417a5d63ecfee4ae3e4c1885fc44413778
SSDEEP 49152:0fUHCLZPeghimcFLug6n7c1waTzXs9WbZN6oT3Us:0fUHmvbcFLug6n7c1XXs9WbZN6gU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dydhshsoe.dll

Path C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll
Size 3.2MB
SHA256 b4df09544520fe66b96345a87499483f285db179482625c565699babe1b66fd2
MD5 78e0a585877712609e292ca7b8842bff
SHA1 5ac97374b4e6bf1225cd8fcb3cd4b033a93730c0
SHA512 9c7b55a73706f4e58c4e1e5e27f3194bac1317be3f6229c31b3f336e1c4380a9aa671508ec578d5dbcf46312827af2417a5d63ecfee4ae3e4c1885fc44413778
SSDEEP 49152:0fUHCLZPeghimcFLug6n7c1waTzXs9WbZN6oT3Us:0fUHmvbcFLug6n7c1XXs9WbZN6gU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dydhshsoe.dll

Path C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll
Size 3.2MB
SHA256 b4df09544520fe66b96345a87499483f285db179482625c565699babe1b66fd2
MD5 78e0a585877712609e292ca7b8842bff
SHA1 5ac97374b4e6bf1225cd8fcb3cd4b033a93730c0
SHA512 9c7b55a73706f4e58c4e1e5e27f3194bac1317be3f6229c31b3f336e1c4380a9aa671508ec578d5dbcf46312827af2417a5d63ecfee4ae3e4c1885fc44413778
SSDEEP 49152:0fUHCLZPeghimcFLug6n7c1waTzXs9WbZN6oT3Us:0fUHmvbcFLug6n7c1XXs9WbZN6gU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dydhshsoe.dll

Path C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll
Size 3.2MB
SHA256 b4df09544520fe66b96345a87499483f285db179482625c565699babe1b66fd2
MD5 78e0a585877712609e292ca7b8842bff
SHA1 5ac97374b4e6bf1225cd8fcb3cd4b033a93730c0
SHA512 9c7b55a73706f4e58c4e1e5e27f3194bac1317be3f6229c31b3f336e1c4380a9aa671508ec578d5dbcf46312827af2417a5d63ecfee4ae3e4c1885fc44413778
SSDEEP 49152:0fUHCLZPeghimcFLug6n7c1waTzXs9WbZN6oT3Us:0fUHmvbcFLug6n7c1XXs9WbZN6gU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dydhshsoe.dll

Path C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll
Size 3.2MB
SHA256 b4df09544520fe66b96345a87499483f285db179482625c565699babe1b66fd2
MD5 78e0a585877712609e292ca7b8842bff
SHA1 5ac97374b4e6bf1225cd8fcb3cd4b033a93730c0
SHA512 9c7b55a73706f4e58c4e1e5e27f3194bac1317be3f6229c31b3f336e1c4380a9aa671508ec578d5dbcf46312827af2417a5d63ecfee4ae3e4c1885fc44413778
SSDEEP 49152:0fUHCLZPeghimcFLug6n7c1waTzXs9WbZN6oT3Us:0fUHmvbcFLug6n7c1XXs9WbZN6gU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dydhshsoe.dll

Path C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll
Size 3.2MB
SHA256 b4df09544520fe66b96345a87499483f285db179482625c565699babe1b66fd2
MD5 78e0a585877712609e292ca7b8842bff
SHA1 5ac97374b4e6bf1225cd8fcb3cd4b033a93730c0
SHA512 9c7b55a73706f4e58c4e1e5e27f3194bac1317be3f6229c31b3f336e1c4380a9aa671508ec578d5dbcf46312827af2417a5d63ecfee4ae3e4c1885fc44413778
SSDEEP 49152:0fUHCLZPeghimcFLug6n7c1waTzXs9WbZN6oT3Us:0fUHmvbcFLug6n7c1XXs9WbZN6gU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dydhshsoe.dll

Path C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll
Size 3.2MB
SHA256 b4df09544520fe66b96345a87499483f285db179482625c565699babe1b66fd2
MD5 78e0a585877712609e292ca7b8842bff
SHA1 5ac97374b4e6bf1225cd8fcb3cd4b033a93730c0
SHA512 9c7b55a73706f4e58c4e1e5e27f3194bac1317be3f6229c31b3f336e1c4380a9aa671508ec578d5dbcf46312827af2417a5d63ecfee4ae3e4c1885fc44413778
SSDEEP 49152:0fUHCLZPeghimcFLug6n7c1waTzXs9WbZN6oT3Us:0fUHmvbcFLug6n7c1XXs9WbZN6gU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dydhshsoe.dll

Path C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll
Size 3.2MB
SHA256 b4df09544520fe66b96345a87499483f285db179482625c565699babe1b66fd2
MD5 78e0a585877712609e292ca7b8842bff
SHA1 5ac97374b4e6bf1225cd8fcb3cd4b033a93730c0
SHA512 9c7b55a73706f4e58c4e1e5e27f3194bac1317be3f6229c31b3f336e1c4380a9aa671508ec578d5dbcf46312827af2417a5d63ecfee4ae3e4c1885fc44413778
SSDEEP 49152:0fUHCLZPeghimcFLug6n7c1waTzXs9WbZN6oT3Us:0fUHmvbcFLug6n7c1XXs9WbZN6gU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dydhshsoe.dll

Path C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll
Size 3.2MB
SHA256 b4df09544520fe66b96345a87499483f285db179482625c565699babe1b66fd2
MD5 78e0a585877712609e292ca7b8842bff
SHA1 5ac97374b4e6bf1225cd8fcb3cd4b033a93730c0
SHA512 9c7b55a73706f4e58c4e1e5e27f3194bac1317be3f6229c31b3f336e1c4380a9aa671508ec578d5dbcf46312827af2417a5d63ecfee4ae3e4c1885fc44413778
SSDEEP 49152:0fUHCLZPeghimcFLug6n7c1waTzXs9WbZN6oT3Us:0fUHmvbcFLug6n7c1XXs9WbZN6gU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dydhshsoe.dll

Path C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll
Size 3.2MB
SHA256 b4df09544520fe66b96345a87499483f285db179482625c565699babe1b66fd2
MD5 78e0a585877712609e292ca7b8842bff
SHA1 5ac97374b4e6bf1225cd8fcb3cd4b033a93730c0
SHA512 9c7b55a73706f4e58c4e1e5e27f3194bac1317be3f6229c31b3f336e1c4380a9aa671508ec578d5dbcf46312827af2417a5d63ecfee4ae3e4c1885fc44413778
SSDEEP 49152:0fUHCLZPeghimcFLug6n7c1waTzXs9WbZN6oT3Us:0fUHmvbcFLug6n7c1XXs9WbZN6gU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dydhshsoe.dll

Path C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll
Size 3.2MB
SHA256 b4df09544520fe66b96345a87499483f285db179482625c565699babe1b66fd2
MD5 78e0a585877712609e292ca7b8842bff
SHA1 5ac97374b4e6bf1225cd8fcb3cd4b033a93730c0
SHA512 9c7b55a73706f4e58c4e1e5e27f3194bac1317be3f6229c31b3f336e1c4380a9aa671508ec578d5dbcf46312827af2417a5d63ecfee4ae3e4c1885fc44413778
SSDEEP 49152:0fUHCLZPeghimcFLug6n7c1waTzXs9WbZN6oT3Us:0fUHmvbcFLug6n7c1XXs9WbZN6gU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dydhshsoe.dll

Path C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll
Size 3.2MB
SHA256 b4df09544520fe66b96345a87499483f285db179482625c565699babe1b66fd2
MD5 78e0a585877712609e292ca7b8842bff
SHA1 5ac97374b4e6bf1225cd8fcb3cd4b033a93730c0
SHA512 9c7b55a73706f4e58c4e1e5e27f3194bac1317be3f6229c31b3f336e1c4380a9aa671508ec578d5dbcf46312827af2417a5d63ecfee4ae3e4c1885fc44413778
SSDEEP 49152:0fUHCLZPeghimcFLug6n7c1waTzXs9WbZN6oT3Us:0fUHmvbcFLug6n7c1XXs9WbZN6gU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dydhshsoe.dll

Path C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll
Size 3.2MB
SHA256 b4df09544520fe66b96345a87499483f285db179482625c565699babe1b66fd2
MD5 78e0a585877712609e292ca7b8842bff
SHA1 5ac97374b4e6bf1225cd8fcb3cd4b033a93730c0
SHA512 9c7b55a73706f4e58c4e1e5e27f3194bac1317be3f6229c31b3f336e1c4380a9aa671508ec578d5dbcf46312827af2417a5d63ecfee4ae3e4c1885fc44413778
SSDEEP 49152:0fUHCLZPeghimcFLug6n7c1waTzXs9WbZN6oT3Us:0fUHmvbcFLug6n7c1XXs9WbZN6gU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dydhshsoe.dll

Path C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll
Size 2.9MB
SHA256 a023a9c1156117cb31f12ab226b7cb60d37d783235cbf7c5e3a135781e4b6d58
MD5 29e18f92bd7ffd420764d823f978f45b
SHA1 e04f3792239edcdc7c218e2db6d7393cc111bedc
SHA512 2d93d887b39855dc0a8fc7f0a29f88949bf051c74203cd1a59a4a1825ff45e288c399334b573740004752ec9455c0446cad5aeb0f2440f3b504636f8560d69d5
SSDEEP 24576:O+XmMm2SNT3Cr/f/182pCSCsM9DPn4esVTtIp/h3D7LmqpYmcFj/Za+ugd8ec7cr:0fUHCLZPeghimcFLug6n7c1waTzXs9W/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dydhshsoe.dll

Path C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll
Size 2.9MB
SHA256 9c7827be3441fcc1665dddcadec0f8e95da7b30d0ddeeeb0d7f8f03c1796eebb
MD5 b3dbf2ed252c4df518457334db617c03
SHA1 730999e320028867246c29e3870541b496412dee
SHA512 cc1d61a027a8b603f0672cc6ed1123492ce0f96f95142d710a4b588e0684c6a870c1f2983d23dfb55feca6e0737e70f1506f316128a51d2a3f9b6715c3722e22
SSDEEP 24576:O+XmMm2SNT3Cr/f/182pCSCsM9DPn4esVTtIp/h3D7LmqpYmcFj/Za+ugd8ec7cf:0fUHCLZPeghimcFLug6n7c1waTzXsY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dydhshsoe.dll

Path C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll
Size 1.9MB
SHA256 795376e2ae0b93e726c4df0540a5b9fdccd01452defee2d5309b9ba50794bf67
MD5 7d8c5e9c6de315a87ca46a06f73381bd
SHA1 0948af07cdf7f52100dad89885b8b4c7aa9f6d4a
SHA512 479bb431b15bf59403f0dacccc56d184b96f46a9c2f56380cd1db56db06c937968d6aa35ef501ce34ddbb4b87e2b24f3434c957e1be5eb3c2bb301d5800dc26d
SSDEEP 24576:O+XmMm2SNT3Cr/f/182pCSCsM9DPn4esVTtIp/h3D7LmqpYmcFp:0fUHCLZPeghimcFp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dydhshsoe.dll

Path C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll
Size 2.4MB
SHA256 ac6aeea9223b729f5bbf1eaabb0ad2efbbd6355d40d08b622857659a87202bd6
MD5 aee86bbe35c8c72c2235168b57c0ac68
SHA1 e8cb35ff522fc30c576a23b2af24e29038e3a149
SHA512 f1db80bd9606cd613476f94d710b6df174eb346521f85d045da07a4bc768564dae714c29fa513e3477c75a6f48bf45da1173f548cef029e9e457ef36ecaa8b25
SSDEEP 24576:O+XmMm2SNT3Cr/f/182pCSCsM9DPn4esVTtIp/h3D7LmqpYmcFj/Za+ugd8ec7cH:0fUHCLZPeghimcFLug6n7cH
MD5 SHA1 SHA512 SSDEEP

Submit Download

F002.exe

Path C:\Users\Admin\AppData\Local\Temp\F002.exe
Size 6.1MB
SHA256 6c4b2d812687391687ff74826ee6b83e0119579d43fe66b8a53fa835d35f11ec
MD5 96a04fefa99d3fcf02a9da1da9e3bca6
SHA1 8ba1e93004fa24c8ef002a3cf355410e24428878
SHA512 406cc290e5c870f335082e90d046faa1b8f39ae9911fc6bbdf8c1f3a7bcf3ffc4bc09790a87e4fea57af1835c4900a6a3d597abb178fe4d301319812b47baf17
SSDEEP 98304:pX9goaRpJe2NDxlTDSDlV5gZOYyCVqM8YmZZ3mKjsTPkvoVfUb+rDl6aE:9qoaRjZZMD5+yCuhZ6jkgVsbWDl6a
MD5 SHA1 SHA512 SSDEEP

Submit Download

F002.exe

Path C:\Users\Admin\AppData\Local\Temp\F002.exe
Size 6.1MB
SHA256 6c4b2d812687391687ff74826ee6b83e0119579d43fe66b8a53fa835d35f11ec
MD5 96a04fefa99d3fcf02a9da1da9e3bca6
SHA1 8ba1e93004fa24c8ef002a3cf355410e24428878
SHA512 406cc290e5c870f335082e90d046faa1b8f39ae9911fc6bbdf8c1f3a7bcf3ffc4bc09790a87e4fea57af1835c4900a6a3d597abb178fe4d301319812b47baf17
SSDEEP 98304:pX9goaRpJe2NDxlTDSDlV5gZOYyCVqM8YmZZ3mKjsTPkvoVfUb+rDl6aE:9qoaRjZZMD5+yCuhZ6jkgVsbWDl6a
MD5 SHA1 SHA512 SSDEEP

Submit Download

F002.exe

Path C:\Users\Admin\AppData\Local\Temp\F002.exe
Size 6.1MB
SHA256 6c4b2d812687391687ff74826ee6b83e0119579d43fe66b8a53fa835d35f11ec
MD5 96a04fefa99d3fcf02a9da1da9e3bca6
SHA1 8ba1e93004fa24c8ef002a3cf355410e24428878
SHA512 406cc290e5c870f335082e90d046faa1b8f39ae9911fc6bbdf8c1f3a7bcf3ffc4bc09790a87e4fea57af1835c4900a6a3d597abb178fe4d301319812b47baf17
SSDEEP 98304:pX9goaRpJe2NDxlTDSDlV5gZOYyCVqM8YmZZ3mKjsTPkvoVfUb+rDl6aE:9qoaRjZZMD5+yCuhZ6jkgVsbWDl6a
MD5 SHA1 SHA512 SSDEEP

Submit Download

F002.exe

Path C:\Users\Admin\AppData\Local\Temp\F002.exe
Size 6.1MB
SHA256 6c4b2d812687391687ff74826ee6b83e0119579d43fe66b8a53fa835d35f11ec
MD5 96a04fefa99d3fcf02a9da1da9e3bca6
SHA1 8ba1e93004fa24c8ef002a3cf355410e24428878
SHA512 406cc290e5c870f335082e90d046faa1b8f39ae9911fc6bbdf8c1f3a7bcf3ffc4bc09790a87e4fea57af1835c4900a6a3d597abb178fe4d301319812b47baf17
SSDEEP 98304:pX9goaRpJe2NDxlTDSDlV5gZOYyCVqM8YmZZ3mKjsTPkvoVfUb+rDl6aE:9qoaRjZZMD5+yCuhZ6jkgVsbWDl6a
MD5 SHA1 SHA512 SSDEEP

Submit Download

F002.exe

Path C:\Users\Admin\AppData\Local\Temp\F002.exe
Size 6.1MB
SHA256 6c4b2d812687391687ff74826ee6b83e0119579d43fe66b8a53fa835d35f11ec
MD5 96a04fefa99d3fcf02a9da1da9e3bca6
SHA1 8ba1e93004fa24c8ef002a3cf355410e24428878
SHA512 406cc290e5c870f335082e90d046faa1b8f39ae9911fc6bbdf8c1f3a7bcf3ffc4bc09790a87e4fea57af1835c4900a6a3d597abb178fe4d301319812b47baf17
SSDEEP 98304:pX9goaRpJe2NDxlTDSDlV5gZOYyCVqM8YmZZ3mKjsTPkvoVfUb+rDl6aE:9qoaRjZZMD5+yCuhZ6jkgVsbWDl6a
MD5 SHA1 SHA512 SSDEEP

Submit Download

F002.exe

Path C:\Users\Admin\AppData\Local\Temp\F002.exe
Size 6.1MB
SHA256 6c4b2d812687391687ff74826ee6b83e0119579d43fe66b8a53fa835d35f11ec
MD5 96a04fefa99d3fcf02a9da1da9e3bca6
SHA1 8ba1e93004fa24c8ef002a3cf355410e24428878
SHA512 406cc290e5c870f335082e90d046faa1b8f39ae9911fc6bbdf8c1f3a7bcf3ffc4bc09790a87e4fea57af1835c4900a6a3d597abb178fe4d301319812b47baf17
SSDEEP 98304:pX9goaRpJe2NDxlTDSDlV5gZOYyCVqM8YmZZ3mKjsTPkvoVfUb+rDl6aE:9qoaRjZZMD5+yCuhZ6jkgVsbWDl6a
MD5 SHA1 SHA512 SSDEEP

Submit Download

F002.exe

Path C:\Users\Admin\AppData\Local\Temp\F002.exe
Size 6.1MB
SHA256 6c4b2d812687391687ff74826ee6b83e0119579d43fe66b8a53fa835d35f11ec
MD5 96a04fefa99d3fcf02a9da1da9e3bca6
SHA1 8ba1e93004fa24c8ef002a3cf355410e24428878
SHA512 406cc290e5c870f335082e90d046faa1b8f39ae9911fc6bbdf8c1f3a7bcf3ffc4bc09790a87e4fea57af1835c4900a6a3d597abb178fe4d301319812b47baf17
SSDEEP 98304:pX9goaRpJe2NDxlTDSDlV5gZOYyCVqM8YmZZ3mKjsTPkvoVfUb+rDl6aE:9qoaRjZZMD5+yCuhZ6jkgVsbWDl6a
MD5 SHA1 SHA512 SSDEEP

Submit Download

F002.exe

Path C:\Users\Admin\AppData\Local\Temp\F002.exe
Size 6.1MB
SHA256 6c4b2d812687391687ff74826ee6b83e0119579d43fe66b8a53fa835d35f11ec
MD5 96a04fefa99d3fcf02a9da1da9e3bca6
SHA1 8ba1e93004fa24c8ef002a3cf355410e24428878
SHA512 406cc290e5c870f335082e90d046faa1b8f39ae9911fc6bbdf8c1f3a7bcf3ffc4bc09790a87e4fea57af1835c4900a6a3d597abb178fe4d301319812b47baf17
SSDEEP 98304:pX9goaRpJe2NDxlTDSDlV5gZOYyCVqM8YmZZ3mKjsTPkvoVfUb+rDl6aE:9qoaRjZZMD5+yCuhZ6jkgVsbWDl6a
MD5 SHA1 SHA512 SSDEEP

Submit Download

F002.exe

Path C:\Users\Admin\AppData\Local\Temp\F002.exe
Size 6.1MB
SHA256 6c4b2d812687391687ff74826ee6b83e0119579d43fe66b8a53fa835d35f11ec
MD5 96a04fefa99d3fcf02a9da1da9e3bca6
SHA1 8ba1e93004fa24c8ef002a3cf355410e24428878
SHA512 406cc290e5c870f335082e90d046faa1b8f39ae9911fc6bbdf8c1f3a7bcf3ffc4bc09790a87e4fea57af1835c4900a6a3d597abb178fe4d301319812b47baf17
SSDEEP 98304:pX9goaRpJe2NDxlTDSDlV5gZOYyCVqM8YmZZ3mKjsTPkvoVfUb+rDl6aE:9qoaRjZZMD5+yCuhZ6jkgVsbWDl6a
MD5 SHA1 SHA512 SSDEEP

Submit Download

F002.exe

Path C:\Users\Admin\AppData\Local\Temp\F002.exe
Size 5.1MB
SHA256 78fcbba9459f4c6481817e94300fcf65163ce26eab2430c959fd648b4d0516a7
MD5 f68fe626f83fde6eda83ad707dc705d7
SHA1 f8eb3467e293e58c8b0cd1471dab1336c9a81a67
SHA512 17a249012c80fee604c4372fddc8e8cd8c11673ec5591eada782668cc403b4af19807e96211186a9a29c0f72024137f20770a95b83abdc5a9969c620cb7c98d3
SSDEEP 98304:pX9goaRpJe2NDxlTDSDlV5gZOYyCVqM8YmZZ3mKjsTPkvI:9qoaRjZZMD5+yCuhZ6jkw
MD5 SHA1 SHA512 SSDEEP

Submit Download

F002.exe

Path C:\Users\Admin\AppData\Local\Temp\F002.exe
Size 4.1MB
SHA256 f0bac5beea512a1f7b82613fa1e1242d3ebb97600746e444937b5c509b689d12
MD5 93c28bda09816e7924f7ba087fb2e92a
SHA1 4a63f3ad4a737941de8f4b3e5bd834189b06a08e
SHA512 6410e58a24f63a1b228e9761fff77fb2a0f9b20aafc5aa38454c27bc4e36cf863692e4eac47acf18412cbd06f303339c8009d9bc3bc183455d5e8649422b898e
SSDEEP 98304:pX9goaRpJe2NDxlTDSDlV5gZOYyCVqM8YmZZ3mi:9qoaRjZZMD5+yCuhZZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

F002.exe

Path C:\Users\Admin\AppData\Local\Temp\F002.exe
Size 3.9MB
SHA256 1638acc73e4117aa125c3e038ecc5759db17ba5746ed3830164f17b2a94b70f3
MD5 8d3c1e45ac17a49f1117e5ebe79ad5a9
SHA1 7a6fc16d1a556c0e1d81a63e65a7b1f2d4500f0f
SHA512 0ce4622e131e605d2987a5daf67b42cf82109f3de9503e05f2970fb8ef8aaf356cd557c16f00928901657519086bdee91e6295fde9f64831378e83f1757554ed
SSDEEP 98304:pX9goaRpJe2NDxlTDSDlV5gZOYyCVqM8YmZ8:9qoaRjZZMD5+yCuh8
MD5 SHA1 SHA512 SSDEEP

Submit Download

F002.exe

Path C:\Users\Admin\AppData\Local\Temp\F002.exe
Size 4.1MB
SHA256 d6a29b1c5bf6a67249f2899b7e7f868fe20185b0c33cf176ddadf91f2a0b8efb
MD5 5779b35cfe6a79e2ec765486aedf7427
SHA1 8d47722006fc04cc0805f695bd5f569000a8dafc
SHA512 b09ecbed668739ff7fd30ee9345c83c980ab378e97f5e87dc64b3bf563731f044c7b6a43f304692b95cb97a15a8a553a39293a0ad8c646af1640e0d06c6d7369
SSDEEP 98304:pX9goaRpJe2NDxlTDSDlV5gZOYyCVqM8YmZZ3mP:9qoaRjZZMD5+yCuhZs
MD5 SHA1 SHA512 SSDEEP

Submit Download

F002.exe

Path C:\Users\Admin\AppData\Local\Temp\F002.exe
Size 2.9MB
SHA256 98d1c73fb757ce1b013329057b52acbda87bbddc322f3743de6012d1a5d09032
MD5 e0ce4991b44b14eda667ee82c97ed77d
SHA1 5b3eb7618daa7418754075c28b6638af240e0549
SHA512 89fe1513b3ae0bcb61f5c9da84a68c8ab4fda63323aba594e0230a870934e0ac8eb169e044ade5057b8ff9500ad4bee9ff7d476ebbd5531fcf1cc0f509f57b1d
SSDEEP 49152:p/v9HUAOunnbaRwojfHFqSFHP7JFEX0rNp5HjVruaTQ5c/nSFuGnBR7dy:pX9goaRpJe2NDxlTDSDly
MD5 SHA1 SHA512 SSDEEP

Submit Download

F002.exe

Path C:\Users\Admin\AppData\Local\Temp\F002.exe
Size 2.9MB
SHA256 4f99e1d898abc8ed2320434dcf238fe1f6baf2cc7123eab5024ab013ed33b010
MD5 dc8c682b84ac73534f7689dace79a0d3
SHA1 8b804480e2db9d03df734935ec4c1bc20e8fff35
SHA512 85772a6bf9621e7a4184b545480b22b1cd285596fe96c9241bce0bc7f703100bd1b25e6c0f95cb2b5ff76bb5bbe2addc808f7f7d5e3e079387f270f8548a8704
SSDEEP 49152:p/v9HUAOunnbaRwojfHFqSFHP7JFEX0rNp5HjVruaTQ5c/nSFuGnBR7dtr:pX9goaRpJe2NDxlTDSDl9
MD5 SHA1 SHA512 SSDEEP

Submit Download

F002.exe

Path C:\Users\Admin\AppData\Local\Temp\F002.exe
Size 2.9MB
SHA256 4f99e1d898abc8ed2320434dcf238fe1f6baf2cc7123eab5024ab013ed33b010
MD5 dc8c682b84ac73534f7689dace79a0d3
SHA1 8b804480e2db9d03df734935ec4c1bc20e8fff35
SHA512 85772a6bf9621e7a4184b545480b22b1cd285596fe96c9241bce0bc7f703100bd1b25e6c0f95cb2b5ff76bb5bbe2addc808f7f7d5e3e079387f270f8548a8704
SSDEEP 49152:p/v9HUAOunnbaRwojfHFqSFHP7JFEX0rNp5HjVruaTQ5c/nSFuGnBR7dtr:pX9goaRpJe2NDxlTDSDl9
MD5 SHA1 SHA512 SSDEEP

Submit Download

F002.exe

Path C:\Users\Admin\AppData\Local\Temp\F002.exe
Size 1.9MB
SHA256 55e68854ece60ab55dea183c391445e5fc72bbd5fb70f1f380065db8f04a2246
MD5 f82ac53dcaf3dc1d6dbf09c38dd64edc
SHA1 aca28d9b05266b060729e46400a3c26a75809c14
SHA512 999343130983f324eab6fbcaff65e0b10c98643366422c0a201a9949e207e9bb19484c17aec8d3e53564c2bebfe855a8655000abbe2078193174dcf51b92f93e
SSDEEP 49152:p/v9HUAOunnbaRwojfHFqSFHP7JFEX0rNpW:pX9goaRpJe2q
MD5 SHA1 SHA512 SSDEEP

Submit Download

GBQHURCC-20220812-1921a.log

Path C:\Users\Admin\AppData\Local\Temp\GBQHURCC-20220812-1921a.log
Size 182KB
SHA256 00df70d4ee47546f5ab79f093a44ef92b18ba766939d03e9d25611b536173459
MD5 6c2ebb04a6025a98e01a40fcfdc8fdfd
SHA1 9e87e55a503eba6994f94f218d5f0367c318b53f
SHA512 2867bf7d057194ef6cc4af4b50267fc5798eb60950a2252275d1d36abbb1ff1a3c787b5cf80ed78099d2d03c5ba13ec195b5b72a1c157723e415335a2ccb3e33
SSDEEP 1536:XU+ALdKGj5subUwC3/zCjDUWX8fimqv5qc+a4EJbSCzJ0l5C2QF1Sh0VCBhSoFyJ:Ve3SE49+vscG36/P/y/Mr
MD5 SHA1 SHA512 SSDEEP

Submit Download

JavaDeployReg.log

Path C:\Users\Admin\AppData\Local\Temp\JavaDeployReg.log
Size 25KB
SHA256 fae1c05269e8dd5949302a1ec38625e70e8167a0cfe0734bb0aaf8533ce6bf1e
MD5 6f6eb502bc56ef0c6af70970cab6b6bd
SHA1 80b18c9e92eec4d3efb993baa1cbb65b9f2efefe
SHA512 1865e8155bb6838f068d29cdb33eddbae49e5cfc94e8a3f97ea50d008ef0cd34b0fc3cffec43cea7b104dd8673ab77c9d3103a2272ec6c418b3da4c4b6a023d3
SSDEEP 768:mz8r65zdlUpr3f55555O41/G3O/mTuUBuPuqZe9NExxxxxqj7Q:Nr65Rla55555O41JLUBu2qpxxxxxqj7Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

JavaDeployReg.log

Path C:\Users\Admin\AppData\Local\Temp\JavaDeployReg.log
Size 25KB
SHA256 fae1c05269e8dd5949302a1ec38625e70e8167a0cfe0734bb0aaf8533ce6bf1e
MD5 6f6eb502bc56ef0c6af70970cab6b6bd
SHA1 80b18c9e92eec4d3efb993baa1cbb65b9f2efefe
SHA512 1865e8155bb6838f068d29cdb33eddbae49e5cfc94e8a3f97ea50d008ef0cd34b0fc3cffec43cea7b104dd8673ab77c9d3103a2272ec6c418b3da4c4b6a023d3
SSDEEP 768:mz8r65zdlUpr3f55555O41/G3O/mTuUBuPuqZe9NExxxxxqj7Q:Nr65Rla55555O41JLUBu2qpxxxxxqj7Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft .NET Framework 4.7.2 Setup_20220812_191538705.html

Path C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20220812_191538705.html
Size 94KB
SHA256 0be98a2f88b59cc8a14e48b604678303a0855a629751c2a31940a7b4073fa5a3
MD5 c37a4768436536ce937e2f4ae25bdee9
SHA1 d2ee32b61d348838b16b49005ffd112c77686970
SHA512 2a9b95cb00e59a9365fd50589b68de9886e2b81a53ddee4032d25ff53024d3dd1b4620ae651cf665e639764e283db52987257eecb7525d2cdc44003e1a4f6f46
SSDEEP 768:fdsOTLyUFJFEWUxFzvjvrWDQbZOhZBLTQH:fdsWyUr+WUxpvjDWDQLH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft .NET Framework 4.7.2 Setup_20220812_191538705.html

Path C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20220812_191538705.html
Size 94KB
SHA256 0be98a2f88b59cc8a14e48b604678303a0855a629751c2a31940a7b4073fa5a3
MD5 c37a4768436536ce937e2f4ae25bdee9
SHA1 d2ee32b61d348838b16b49005ffd112c77686970
SHA512 2a9b95cb00e59a9365fd50589b68de9886e2b81a53ddee4032d25ff53024d3dd1b4620ae651cf665e639764e283db52987257eecb7525d2cdc44003e1a4f6f46
SSDEEP 768:fdsOTLyUFJFEWUxFzvjvrWDQbZOhZBLTQH:fdsWyUr+WUxpvjDWDQLH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Seeesisuoeiaqit.tmp

Path C:\Users\Admin\AppData\Local\Temp\Seeesisuoeiaqit.tmp
Size 3.5MB
SHA256 364c226e4aadbfbe0ba89b0eeb4e8346462cf33f8e4a26ba9cf6501f196f3710
MD5 30d9bc7452d5819b304b121c517a8f73
SHA1 ea1b8ffa9f4918a90dfd7f574b5b0694bedb1d01
SHA512 db2e7649e3bbfa81234442e70666bf966edf904f3f33551940af6c77dada6cd958be81c003c34d71eb929e3f7ce3d3aa4665135fb67f420092b03931209c8fa6
SSDEEP 98304:lw+iklOA+LfnQnn9Q4gJJ34/oTMtI1YCUVVClcdeU0p:O+TlOBLfQiXUI1YJClcdE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Seeesisuoeiaqit.tmp

Path C:\Users\Admin\AppData\Local\Temp\Seeesisuoeiaqit.tmp
Size 3.5MB
SHA256 364c226e4aadbfbe0ba89b0eeb4e8346462cf33f8e4a26ba9cf6501f196f3710
MD5 30d9bc7452d5819b304b121c517a8f73
SHA1 ea1b8ffa9f4918a90dfd7f574b5b0694bedb1d01
SHA512 db2e7649e3bbfa81234442e70666bf966edf904f3f33551940af6c77dada6cd958be81c003c34d71eb929e3f7ce3d3aa4665135fb67f420092b03931209c8fa6
SSDEEP 98304:lw+iklOA+LfnQnn9Q4gJJ34/oTMtI1YCUVVClcdeU0p:O+TlOBLfQiXUI1YJClcdE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Seeesisuoeiaqit.tmp

Path C:\Users\Admin\AppData\Local\Temp\Seeesisuoeiaqit.tmp
Size 3.5MB
SHA256 364c226e4aadbfbe0ba89b0eeb4e8346462cf33f8e4a26ba9cf6501f196f3710
MD5 30d9bc7452d5819b304b121c517a8f73
SHA1 ea1b8ffa9f4918a90dfd7f574b5b0694bedb1d01
SHA512 db2e7649e3bbfa81234442e70666bf966edf904f3f33551940af6c77dada6cd958be81c003c34d71eb929e3f7ce3d3aa4665135fb67f420092b03931209c8fa6
SSDEEP 98304:lw+iklOA+LfnQnn9Q4gJJ34/oTMtI1YCUVVClcdeU0p:O+TlOBLfQiXUI1YJClcdE
MD5 SHA1 SHA512 SSDEEP

Submit Download

a6b75105-7dc9-45ac-b70c-19519ab6d538.tmp

Path C:\Users\Admin\AppData\Local\Temp\a6b75105-7dc9-45ac-b70c-19519ab6d538.tmp
Size 21KB
SHA256 7f4e382d1c6724a5f173f3617e35d5ad74c28ffce9a918f00b48c88f978dc34e
MD5 301ea18f32584b0102b1e4f710c6054d
SHA1 e970ec47138c443ec94a4c3671622f578ed09a26
SHA512 3c1dd0687ff4a98324f8f0c054e2bf24a3adc2edb28a4ee095f5e71d5943702bcdf36b4c5b2e163e17cc207833194539ed98b7830e94ac446a9d48d29837627b
SSDEEP 192:kQ3oiVaUq4aaL/ytEQp1HQfjVa02W3NfNpEqn744ohU8A4/MBJZR3K4DBHAgaZCh:Jo6aUqw+1wbV+OEq3EU3qMXZTtH1PxvH
MD5 SHA1 SHA512 SSDEEP

Submit Download

a6b75105-7dc9-45ac-b70c-19519ab6d538.tmp

Path C:\Users\Admin\AppData\Local\Temp\a6b75105-7dc9-45ac-b70c-19519ab6d538.tmp
Size 21KB
SHA256 7f4e382d1c6724a5f173f3617e35d5ad74c28ffce9a918f00b48c88f978dc34e
MD5 301ea18f32584b0102b1e4f710c6054d
SHA1 e970ec47138c443ec94a4c3671622f578ed09a26
SHA512 3c1dd0687ff4a98324f8f0c054e2bf24a3adc2edb28a4ee095f5e71d5943702bcdf36b4c5b2e163e17cc207833194539ed98b7830e94ac446a9d48d29837627b
SSDEEP 192:kQ3oiVaUq4aaL/ytEQp1HQfjVa02W3NfNpEqn744ohU8A4/MBJZR3K4DBHAgaZCh:Jo6aUqw+1wbV+OEq3EU3qMXZTtH1PxvH
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_installer.log

Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
Size 1KB
SHA256 90d944e4a4aa77a6d376114db46b8b3b47fb7e46e7769d34c978c93ec27b0cd1
MD5 f42f2a2ee390bc203d1984162fd57a8f
SHA1 4cfad4d5561b33d6afcaf06a374ba8cc5b7da289
SHA512 387f2b06a71bd2680b851c69812e9b3af4a41f15d0731d316b258f5453bfb24579dbee389573fbed9d1b775072daec16255ad541e8956608b2e7574de45d27f9
MD5 SHA1 SHA512

Submit Download

dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt

Path C:\Users\Admin\AppData\Local\Temp\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt
Size 1KB
SHA256 edb2daddf55d78188d2e7b53da4896a8006c181cad2737ad6a2f9217adf0ce88
MD5 0e90961b61fe2bba06fe5a0b29b9f7a3
SHA1 ea023ea3fba4e3e086e939cc2fd4e114552140a9
SHA512 9656c5517490628310e8660190a5f8131aa8e6ec1c93472f92204c352b0deada6ad1c1228771bd5579a103e238c4ad6a40c6c558607cdb613afe881159ed3c13
MD5 SHA1 SHA512

Submit Download

dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt

Path C:\Users\Admin\AppData\Local\Temp\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt
Size 1KB
SHA256 edb2daddf55d78188d2e7b53da4896a8006c181cad2737ad6a2f9217adf0ce88
MD5 0e90961b61fe2bba06fe5a0b29b9f7a3
SHA1 ea023ea3fba4e3e086e939cc2fd4e114552140a9
SHA512 9656c5517490628310e8660190a5f8131aa8e6ec1c93472f92204c352b0deada6ad1c1228771bd5579a103e238c4ad6a40c6c558607cdb613afe881159ed3c13
MD5 SHA1 SHA512

Submit Download

dd_vcredistUI4F1D.txt

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI4F1D.txt
Size 11KB
SHA256 be8cdd1dd28c10adcfeff612a41b0985342246f049091a1d9e09d9e85e6ed392
MD5 73cf8fc42f7a737ab5796c9e02dd7bc3
SHA1 91fa4c983663d8bb8af0608d8146168738901d45
SHA512 ee6c1a6dbfcbb3583be78b2d32330b080624431d16324dc523e0438e0aadcc0f865265bb9ab4d3141130196e956a50000e7b86893e549ca11a7007e7c8c859eb
SSDEEP 192:mxUalKZY43BnJnzjnJnrMuvnJnmZGp8vBOG8mv:mxUalKZY43BJfJrMuvJ3i+mv
MD5 SHA1 SHA512 SSDEEP

Submit Download

jawshtml.html

Path C:\Users\Admin\AppData\Local\Temp\jawshtml.html
Size 13B
SHA256 7b4f72a40bd21934680f085afe8a30bf85acff1a8365af43102025c4ccf52b73
MD5 b2a4bc176e9f29b0c439ef9a53a62a1a
SHA1 1ae520cbbf7e14af867232784194366b3d1c3f34
SHA512 e04b85d8d45d43479abbbe34f57265b64d1d325753ec3d2ecadb5f83fa5822b1d999b39571801ca39fa32e4a0a7caab073ccd003007e5b86dac7b1c892a5de3f
MD5 SHA1 SHA512

Submit Download

msedge_installer.log

Path C:\Users\Admin\AppData\Local\Temp\msedge_installer.log
Size 3KB
SHA256 7bc05c175a0201ec193933f45c3a16ae8f4b9d959ef9f8253ebd6d0d7579d569
MD5 c46f084c955c9413f1f375707a49141d
SHA1 591830d0afefb8c15c06527d072a1fb8902395e6
SHA512 94915075cdbf3b7cb87b19466a4543f5a3191ca123da8a0ba14ca1ab610ce025ab18af671c7e62eeb5bcc7e76ba9e84444f2d8904961af430556a1ed2e83f4a3
MD5 SHA1 SHA512

Submit Download

msedge_installer.log

Path C:\Users\Admin\AppData\Local\Temp\msedge_installer.log
Size 3KB
SHA256 7bc05c175a0201ec193933f45c3a16ae8f4b9d959ef9f8253ebd6d0d7579d569
MD5 c46f084c955c9413f1f375707a49141d
SHA1 591830d0afefb8c15c06527d072a1fb8902395e6
SHA512 94915075cdbf3b7cb87b19466a4543f5a3191ca123da8a0ba14ca1ab610ce025ab18af671c7e62eeb5bcc7e76ba9e84444f2d8904961af430556a1ed2e83f4a3
MD5 SHA1 SHA512

Submit Download

wct1510.tmp

Path C:\Users\Admin\AppData\Local\Temp\wct1510.tmp
Size 62KB
SHA256 094754a618b102b7ad0800dd4c9c02c882cf2d1e7996ba864f422fa4312427e1
MD5 7185e716980842db27c3b3a88e1fe804
SHA1 e4615379cd4797629b4cc3da157f4d4a5412fb2b
SHA512 dea331907f5f1de407ca07e24be7ad808fa43a0eef2d1b5009721f937ab2a8f77832e332d5ac3d9662e5b02ecaabbec0f4228af279fa6562be4dccb6c829246c
SSDEEP 384:poaSLZTSy3x02SMU9mCzmT2zu/649Pji7iJI5TZCP56vS1xDR+dfUFv8WTT:WIyWcU9mCzmKu/JV2iP56vcDR+p0T
MD5 SHA1 SHA512 SSDEEP

Submit Download

wct1510.tmp

Path C:\Users\Admin\AppData\Local\Temp\wct1510.tmp
Size 62KB
SHA256 094754a618b102b7ad0800dd4c9c02c882cf2d1e7996ba864f422fa4312427e1
MD5 7185e716980842db27c3b3a88e1fe804
SHA1 e4615379cd4797629b4cc3da157f4d4a5412fb2b
SHA512 dea331907f5f1de407ca07e24be7ad808fa43a0eef2d1b5009721f937ab2a8f77832e332d5ac3d9662e5b02ecaabbec0f4228af279fa6562be4dccb6c829246c
SSDEEP 384:poaSLZTSy3x02SMU9mCzmT2zu/649Pji7iJI5TZCP56vS1xDR+dfUFv8WTT:WIyWcU9mCzmKu/JV2iP56vcDR+p0T
MD5 SHA1 SHA512 SSDEEP

Submit Download

wct399A.tmp

Path C:\Users\Admin\AppData\Local\Temp\wct399A.tmp
Size 62KB
SHA256 094754a618b102b7ad0800dd4c9c02c882cf2d1e7996ba864f422fa4312427e1
MD5 7185e716980842db27c3b3a88e1fe804
SHA1 e4615379cd4797629b4cc3da157f4d4a5412fb2b
SHA512 dea331907f5f1de407ca07e24be7ad808fa43a0eef2d1b5009721f937ab2a8f77832e332d5ac3d9662e5b02ecaabbec0f4228af279fa6562be4dccb6c829246c
SSDEEP 384:poaSLZTSy3x02SMU9mCzmT2zu/649Pji7iJI5TZCP56vS1xDR+dfUFv8WTT:WIyWcU9mCzmKu/JV2iP56vcDR+p0T
MD5 SHA1 SHA512 SSDEEP

Submit Download

wctC61E.tmp

Path C:\Users\Admin\AppData\Local\Temp\wctC61E.tmp
Size 62KB
SHA256 094754a618b102b7ad0800dd4c9c02c882cf2d1e7996ba864f422fa4312427e1
MD5 7185e716980842db27c3b3a88e1fe804
SHA1 e4615379cd4797629b4cc3da157f4d4a5412fb2b
SHA512 dea331907f5f1de407ca07e24be7ad808fa43a0eef2d1b5009721f937ab2a8f77832e332d5ac3d9662e5b02ecaabbec0f4228af279fa6562be4dccb6c829246c
SSDEEP 384:poaSLZTSy3x02SMU9mCzmT2zu/649Pji7iJI5TZCP56vS1xDR+dfUFv8WTT:WIyWcU9mCzmKu/JV2iP56vcDR+p0T
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 697B
SHA256 c4975a51f52c7e43048be7ca33fca70869ad84845a489967ab7c93d4be28cf3c
MD5 bdcd60d0f8f1a5c5541b99599702de47
SHA1 e18d6ad9df2a91c55f90c725fb0a5885cef369bc
SHA512 c98abf7754f78d171e18e5ca3ba8fb25f4793b02bc1f3f43ecf626c1c4f80f28f9ebec95b2ff4548235db7dbe4f15338623b3259ca73feade3bca6ff76bf3e76
MD5 SHA1 SHA512

Submit Download

memory/64-210-0x0000000003840000-0x000000000439F000-memory.dmp

Download

memory/64-199-0x0000000000400000-0x000000000074D000-memory.dmp

Download

memory/64-207-0x0000000003840000-0x000000000439F000-memory.dmp

Download

memory/64-209-0x0000000000400000-0x000000000074D000-memory.dmp

Download

memory/64-208-0x0000000003840000-0x000000000439F000-memory.dmp

Download

memory/64-154-0x0000000000400000-0x000000000074D000-memory.dmp

Download

memory/1476-170-0x0000000000400000-0x0000000003203000-memory.dmp

Download

memory/1476-187-0x0000000000400000-0x0000000003203000-memory.dmp

Download

memory/1476-169-0x0000000003692000-0x0000000003C7C000-memory.dmp

Download

memory/1608-374-0x0000000002AB0000-0x000000000360F000-memory.dmp

Download

memory/1608-372-0x0000000002AB0000-0x000000000360F000-memory.dmp

Download

memory/1608-369-0x00000000021C0000-0x000000000250D000-memory.dmp

Download

memory/1612-287-0x0000000000400000-0x0000000003203000-memory.dmp

Download

memory/1612-288-0x00000000037C8000-0x0000000003DB2000-memory.dmp

Download

memory/1612-298-0x0000000000400000-0x0000000003203000-memory.dmp

Download

memory/1624-316-0x0000000002330000-0x000000000267D000-memory.dmp

Download

memory/1624-320-0x0000000002C20000-0x000000000377F000-memory.dmp

Download

memory/1624-321-0x0000000002C20000-0x000000000377F000-memory.dmp

Download

memory/1732-256-0x0000000000400000-0x0000000003203000-memory.dmp

Download

memory/1732-246-0x00000000035D0000-0x0000000003BBA000-memory.dmp

Download

memory/1732-242-0x0000000000400000-0x0000000003203000-memory.dmp

Download

memory/1880-386-0x00000000033D0000-0x0000000003F2F000-memory.dmp

Download

memory/1880-388-0x00000000033D0000-0x0000000003F2F000-memory.dmp

Download

memory/1900-299-0x0000000003380000-0x0000000003EDF000-memory.dmp

Download

memory/1900-263-0x0000000003380000-0x0000000003EDF000-memory.dmp

Download

memory/1900-289-0x0000000000400000-0x000000000074D000-memory.dmp

Download

memory/1900-258-0x0000000003380000-0x0000000003EDF000-memory.dmp

Download

memory/1900-257-0x0000000003380000-0x0000000003EDF000-memory.dmp

Download

memory/1900-255-0x0000000000400000-0x000000000074D000-memory.dmp

Download

memory/2196-423-0x0000000002AD0000-0x000000000362F000-memory.dmp

Download

memory/2196-418-0x00000000022E0000-0x000000000262D000-memory.dmp

Download

memory/2196-422-0x0000000002AD0000-0x000000000362F000-memory.dmp

Download

memory/2272-203-0x0000000000400000-0x0000000003203000-memory.dmp

Download

memory/2272-221-0x0000000000400000-0x0000000003203000-memory.dmp

Download

memory/2272-206-0x00000000036EE000-0x0000000003CD8000-memory.dmp

Download

memory/3180-403-0x0000000003060000-0x0000000003BBF000-memory.dmp

Download

memory/3548-229-0x00000000034B0000-0x000000000400F000-memory.dmp

Download

memory/3548-161-0x0000000002310000-0x000000000265D000-memory.dmp

Download

memory/3548-220-0x00000000034B0000-0x000000000400F000-memory.dmp

Download

memory/3548-223-0x00000000034B0000-0x000000000400F000-memory.dmp

Download

memory/3548-164-0x0000000002310000-0x000000000265D000-memory.dmp

Download

memory/3548-211-0x0000000002310000-0x000000000265D000-memory.dmp

Download

memory/3684-239-0x0000000000E10000-0x00000000010B8000-memory.dmp

Download

memory/3684-231-0x000001B413BC0000-0x000001B413D00000-memory.dmp

Download

memory/3684-230-0x000001B413BC0000-0x000001B413D00000-memory.dmp

Download

memory/3684-240-0x000001B412160000-0x000001B412419000-memory.dmp

Download

memory/3808-244-0x0000000003480000-0x0000000003FDF000-memory.dmp

Download

memory/3808-168-0x0000000002570000-0x00000000028BD000-memory.dmp

Download

memory/3808-245-0x0000000003480000-0x0000000003FDF000-memory.dmp

Download

memory/3808-226-0x0000000002570000-0x00000000028BD000-memory.dmp

Download

memory/3808-172-0x0000000002570000-0x00000000028BD000-memory.dmp

Download

memory/3808-247-0x0000000003480000-0x0000000003FDF000-memory.dmp

Download

memory/3808-279-0x0000000003480000-0x0000000003FDF000-memory.dmp

Download

memory/3920-272-0x0000000000400000-0x000000000074D000-memory.dmp

Download

memory/3920-280-0x0000000002D60000-0x00000000038BF000-memory.dmp

Download

memory/3920-310-0x0000000000400000-0x000000000074D000-memory.dmp

Download

memory/3920-286-0x0000000002D60000-0x00000000038BF000-memory.dmp

Download

memory/3920-281-0x0000000002D60000-0x00000000038BF000-memory.dmp

Download

memory/3960-134-0x0000000000400000-0x0000000002C2E000-memory.dmp

Download

memory/3960-132-0x0000000002E47000-0x0000000002E5C000-memory.dmp

Download

memory/3960-135-0x0000000000400000-0x0000000002C2E000-memory.dmp

Download

memory/3960-133-0x0000000002CC0000-0x0000000002CC9000-memory.dmp

Download

memory/4008-308-0x0000000003726000-0x0000000003D10000-memory.dmp

Download

memory/4008-309-0x0000000000400000-0x0000000003203000-memory.dmp

Download

memory/4168-438-0x0000000002F10000-0x0000000003A6F000-memory.dmp

Download

memory/4168-437-0x0000000002F10000-0x0000000003A6F000-memory.dmp

Download

memory/4180-338-0x0000000002F90000-0x0000000003AEF000-memory.dmp

Download

memory/4180-337-0x0000000002F90000-0x0000000003AEF000-memory.dmp

Download

memory/4248-278-0x0000000000400000-0x0000000003203000-memory.dmp

Download

memory/4248-264-0x00000000037DD000-0x0000000003DC7000-memory.dmp

Download

memory/4248-265-0x0000000000400000-0x0000000003203000-memory.dmp

Download

memory/4320-171-0x0000000000400000-0x0000000003203000-memory.dmp

Download

memory/4320-162-0x0000000000400000-0x0000000003203000-memory.dmp

Download

memory/4320-145-0x0000000000400000-0x0000000003203000-memory.dmp

Download

memory/4320-144-0x00000000037FE000-0x0000000003DE8000-memory.dmp

Download

memory/4372-295-0x00000000025B0000-0x00000000028FD000-memory.dmp

Download

memory/4372-302-0x0000000002D60000-0x00000000038BF000-memory.dmp

Download

memory/4372-300-0x00000000025B0000-0x00000000028FD000-memory.dmp

Download

memory/4372-307-0x0000000002D60000-0x00000000038BF000-memory.dmp

Download

memory/4504-353-0x0000000003430000-0x0000000003F8F000-memory.dmp

Download

memory/4504-352-0x0000000003430000-0x0000000003F8F000-memory.dmp

Download

memory/4580-141-0x0000000000400000-0x0000000003203000-memory.dmp

Download

memory/4580-148-0x0000000000400000-0x0000000003203000-memory.dmp

Download

memory/4580-155-0x0000000000400000-0x0000000003203000-memory.dmp

Download

memory/4580-139-0x000000000372F000-0x0000000003D19000-memory.dmp

Download

memory/4580-140-0x00000000055C0000-0x0000000005BE0000-memory.dmp

Download

memory/4708-150-0x0000000000400000-0x0000000003203000-memory.dmp

Download

memory/4708-149-0x0000000003754000-0x0000000003D3E000-memory.dmp

Download

memory/4708-163-0x0000000000400000-0x0000000003203000-memory.dmp

Download

memory/4856-238-0x0000000003B3D000-0x0000000003B3F000-memory.dmp

Download

memory/4856-227-0x0000000003A30000-0x0000000003B70000-memory.dmp

Download

memory/4856-200-0x0000000002DD0000-0x000000000392F000-memory.dmp

Download

memory/4856-188-0x0000000002DD0000-0x000000000392F000-memory.dmp

Download

memory/4856-202-0x0000000003A30000-0x0000000003B70000-memory.dmp

Download

memory/4856-180-0x0000000002620000-0x000000000296D000-memory.dmp

Download

memory/4856-201-0x0000000003A30000-0x0000000003B70000-memory.dmp

Download

memory/4856-271-0x0000000003B3D000-0x0000000003B3F000-memory.dmp

Download

memory/4856-250-0x0000000002DD0000-0x000000000392F000-memory.dmp

Download

memory/4856-222-0x00000000046F0000-0x0000000004830000-memory.dmp

Download

memory/4856-224-0x00000000046F0000-0x0000000004830000-memory.dmp

Download

memory/4856-189-0x0000000002DD0000-0x000000000392F000-memory.dmp

Download

memory/4856-225-0x0000000003A30000-0x0000000003B70000-memory.dmp

Download

memory/4856-248-0x0000000002620000-0x000000000296D000-memory.dmp

Download

memory/4856-179-0x0000000002620000-0x000000000296D000-memory.dmp

Download

memory/4892-241-0x0000000002DD0000-0x000000000392F000-memory.dmp

Download

memory/4892-233-0x0000000002DD0000-0x000000000392F000-memory.dmp

Download

memory/4892-216-0x0000000000400000-0x000000000074D000-memory.dmp

Download

memory/4892-266-0x0000000000400000-0x000000000074D000-memory.dmp

Download